Binance’s October 29 breach turned a corporate security incident into a lesson for every finance team that holds crypto. Global Finance Magazine reported that victims of the hack, which Binance put at roughly $6.3 billion in token assets, will be made whole with company funds. That promise settles the customer question. It leaves the treasury question wide open, because the same weaknesses that let attackers reach Binance’s hot wallets exist in many corporate crypto setups.
Binance said its hot wallets were compromised at about 20:05 UTC on October 29, 2026. Its first investigation pointed to a compromised DevOps engineer’s laptop, and the company said it found no evidence that wallet private keys leaked. It later said the incident involved more breach points than the laptop alone. The exchange has since set aside more than $6.34 billion to cover losses, including about $5 billion in the affected tokens.
This analysis walks through what happened, how the money moved, who froze what, and what the episode means for crypto treasury security risks. It separates confirmed facts from open claims, compares the breach with earlier exchange failures, and closes with a control checklist and five predictions for custody practice over the next year.
What Happened on October 29, 2026
Binance disclosed the incident late on Thursday, October 29, and paused withdrawals while it investigated. NBC News reported that the exchange said more than $6 billion appeared to have moved through wallets tied to a security breach, the highest dollar amount ever linked to a crypto cyberattack. About $3 billion of that had potentially been located and frozen across several exchanges, though early reports could not say whether the funds were recoverable.
Binance revoked authorization on the affected addresses and brought in law-enforcement and blockchain-intelligence partners. Reuters reported that the platform froze withdrawals for more than two days, then reopened them on Sunday morning, with US dollar cash withdrawals returning on Monday. The table below collects the core figures and who reported them.
| Metric | Reported figure | Source |
|---|---|---|
| Estimated total impact | About $6.3 billion in token assets | Binance |
| Hot wallet compromise | About 20:05 UTC, October 29, 2026 | Binance |
| Funds frozen | About $3 billion | Tether, Circle and other firms (reported) |
| Reserve set aside | More than $6.34 billion, about $5 billion in affected tokens | Binance |
| Secure Asset Fund for Users | $1.2 billion | Binance |
| Circle USDC freeze | More than $1.1 billion | Reuters |
| Net customer outflow after reopening | $4.72 billion, around 3% of platform assets | Reuters, citing Binance |
| Bitcoin on Friday, October 30 | $77,065, down about 4% on the day | CNBC |
The DevOps Laptop: Where the Intrusion Started
Binance said its initial investigation indicated that a compromised DevOps engineer’s laptop gave the attacker a path into a service container. From there, the intruder submitted unauthorized withdrawal transactions. The chain is mundane by design. A workstation that holds credentials for build systems or internal services is a far cheaper target than a hardened signing environment.
For treasury teams, the lesson is about blast radius. An engineer’s laptop should never sit one hop away from a service that can authorize movement of customer assets. Yet in many organizations the people who deploy wallet infrastructure also hold the credentials that run it. When one device falls, the attacker inherits everything that device could reach.
Binance later said the picture was bigger than a single laptop. Global Finance Magazine reported that further investigation showed the hot wallet compromise was far more complex and involved multiple breach points. The company has not published a full technical report, so the exact sequence beyond the laptop and the service container remains unconfirmed.
EIP-7702 and the Approval Controls That Never Fired
Binance said the attack involved EIP-7702, an Ethereum standard that lets an ordinary wallet delegate execution to smart-contract code. According to Global Finance, Richard Teng described the mechanism this way: the attacker used it to obtain on-chain execution approval for a hot wallet, and the delegation did not pass through Binance’s normal approval controls. Teng also said the attacker ran a self-destruct mechanism that wiped tooling and tracers as it went, which slows the investigation.
That detail matters more than the dollar figure. A control that watches transfers but ignores delegation changes leaves a gap the size of the whole wallet. Our earlier coverage of the EIP-7702 authorizations tied to the sweeper contract traced how that delegation step works on-chain. Treasury engineers should read it as a design warning: every way a wallet can grant execution rights belongs under the same policy engine as a withdrawal.
An illustrative policy rule for delegation events
The snippet below is a generic example of how a treasury policy engine could treat delegation as a gated action. It is not Binance’s configuration and not a recommendation tied to any vendor.
{
"rule": "block-unapproved-delegation",
"applies_to": ["eip7702_authorization", "set_code_transaction"],
"require": {
"approvers": 2,
"out_of_band_confirmation": true,
"allowed_delegate_contracts": "allowlist-v3"
},
"on_violation": ["halt_hot_wallet", "page_oncall", "freeze_pending_withdrawals"]
}A 20-Minute Window Across 10 Blockchains
SecurityWeek reported that TRM Labs calculated about $6.36 billion moved out of Binance wallets on October 29, spread over 10 blockchains. Most of it left within roughly 20 minutes, beginning near 20:05 UTC. Speed is the core feature of this class of attack. A human review loop that takes an hour cannot compete with an automated sweep that finishes before the on-call engineer opens a laptop.
Ari Redbord, global head of policy at TRM Labs, told Global Finance that the attacker sold about 325 million USDT to market makers within minutes of receiving it. Binance has not confirmed that figure, so treat it as a reported claim. Our look at the 20-minute heist and its signing-infrastructure lessons covers the engineering side of that tempo in more detail.
Reuters, citing blockchain analytics firm Elliptic, reported that the hackers still controlled around $3.28 billion, mostly in bitcoin and ether, and that only a negligible amount had been cashed out into fiat currency. Elliptic called the laundering process highly complex and clearly automated. Stolen coins that sit unmoved give investigators time. Coins that hop chains in bulk shrink that time fast.
Why Private Keys Were Not the Weak Point
Binance said it saw no evidence that wallet private keys leaked. Take that statement at face value and the incident still happened. Attackers drained assets by compromising the application layer around the keys, which means key custody alone does not define treasury safety. A vault with a perfect lock is no help if the process that opens it can be tricked into opening it.
Many corporate treasury policies still center on one question: who holds the keys? This breach shifts the focus to three others. Who can instruct the system that uses the keys? Which policy checks stand between an instruction and a signature? And how quickly can the whole path be shut off? Firms that outsource custody should put those questions to their providers in writing.
Sam Callahan, director of bitcoin strategy and research at crypto treasury firm OranjeBTC, told CNBC that investors grasped one important distinction: bitcoin itself was not hacked, and the failure sat at a centralized exchange rather than in the Bitcoin network. That framing explains why the price reaction stayed muted. It also underlines why treasuries that hold coins on a platform carry the platform’s operational risk on top of market risk.
Stablecoin Freezes: Tether, Circle and a Fast Clawback
The most encouraging part of the story came from stablecoin issuers. Tether and Circle, along with other crypto firms, reportedly froze about $3 billion in stolen funds. Redbord said issuers froze roughly $2.7 billion within hours, and Reuters reported on Monday that Circle alone had frozen more than $1.1 billion in USDC. About half the stolen value sat in stablecoins, so issuer action reached a large share of the loot.
Issuer freezes have limits. They work on tokens whose issuers keep freeze powers, and they do nothing for bitcoin or ether once those assets move. We broke down the numbers in our report on how stablecoin issuers froze funds from the theft. The takeaway for treasurers is blunt: a freeze is a recovery aid, and it should never replace prevention.
The paper trail decides who gets frozen funds back
Global Finance advised CFOs whose stablecoins sit on a platform that suffers a freeze to prepare proof of ownership. That means account agreements, every deposit and withdrawal address, transaction hashes, statements and approval logs. Redbord said treasury should own that file and keep copies on its own systems, since a custodian’s platform can go dark during an incident. When issuers freeze funds, the records settle who recovers them.
How Binance Is Paying: Reserves, a $1.2 Billion Fund and Treasury Cash
Binance says it will cover the losses with company funds. Teng said in a video statement that the assets are safe, and the company said it would absorb the financial impact, not its users. NBC News reported that Teng pointed to existing reserves above $1 billion and to an extra $6 billion set aside from a $167 billion balance sheet. Binance also has a $1.2 billion Secure Asset Fund for Users.
Global Finance reported that Binance had already spent $5 billion buying the affected assets, including USDC, USDT and bitcoin, through market and over-the-counter purchases. Teng said most of the exchange’s daily earnings are held in crypto and reinvested in the business and in security, which is why it could absorb a loss of this size at once. That explanation is also a risk disclosure. A company whose treasury is mostly crypto carries the same price swings as its customers.
Binance planned to publish a full proof-of-reserves report by November 2 and said it was rebuilding and retesting its infrastructure. Reuters reported that Binance had raised $6 billion from its corporate treasury, an insurance fund and reserves set aside for security breaches. Whether those numbers hold up under outside review is the next test of the company’s message.
Customer Reaction: $4.72 Billion Out, Confidence Mostly Holds
Customers pulled a net $4.72 billion from Binance after withdrawals reopened, Reuters reported via BNN Bloomberg. Binance said that equals around 3 percent of assets on the platform, and most withdrawals came as Tether’s USDT. The exchange said it also saw $2.7 billion in customer inflows after Sunday and that withdrawal volumes were stabilizing after an initial spike. Binance reports more than 335 million users and average daily volume of $95 billion.
Our own breakdown of the net outflow as a share of Binance’s assets arrives at a similar low-single-digit percentage. Analysts quoted by Reuters read the pattern as proof that confidence largely held. Tim Sun, a senior researcher at HashKey Group, said the hack had not triggered widespread panic or a massive concentrated withdrawal.
| Stress event | Net outflow | Window |
|---|---|---|
| Binance after the October 2026 hack | $4.72 billion | Since withdrawals reopened on Sunday |
| Binance after the FTX collapse (2022) | About $6 billion | 72 hours |
| Circle USDC after the Silicon Valley Bank collapse (2023) | About $7 billion | One week |
Competing exchanges saw some of that money. DeFiLlama data cited by Reuters showed $284.87 million of inflows at OKX in 24 hours, $93.22 million at Gate and $29.25 million at Bybit. The data could not show how much came from Binance users. One Binance customer told Reuters he moved his holdings to a personal wallet after FTX failed and saw no reason to rush now.
What Executives and Industry Figures Said
Teng’s headline message to users was short. “Your assets are safe,” he said in the video statement NBC News described. Binance founder and former CEO Changpeng Zhao, who no longer manages the exchange, weighed in on social media. Per CoinDesk’s live coverage, Zhao said: “It does look like a hack on Binance.”
Zhao also addressed responsibility for customer funds. In the same CoinDesk coverage he wrote: “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.” He credited the stablecoin issuers for their speed too: “Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).” Those two figures add up to roughly $1.8 billion, which is below the roughly $3 billion total freeze reported across all firms.
Zhao made the point that matters most for security teams in a separate public reply, reported by Cryptopolitan. He said “all hacks generally have a compromised device (or algorithm) at some point.” The line fits what Binance disclosed about the DevOps laptop, and it reads as a warning that endpoint security is the first control in any treasury stack, not the last.
Attribution: What Is Confirmed and What Is Not
The identity of the attacker or attackers remains unconfirmed in Binance’s own statements. Reuters reported that the FBI said North Korean state-sponsored group TraderTraitor carried out the attack, and TRM Labs has said North Korea-linked hackers stole $7.4 billion so far in 2026. Binance has not made that attribution itself, and we found no FBI statement in the sources we reviewed. Treat the North Korea link as a reported allegation until a primary document appears.
Pyongyang has pushed back. Our report on North Korea’s rejection of the heist claim covers that denial. Separately, CNBC and NBC News describe the incident as the largest crypto theft on record. That is a media characterization, not a finding in Binance’s updates, and the exact ranking depends on how analysts count recovered or frozen funds.
US authorities have engaged. NBC News reported that the Secret Service said it was working with private-sector partners to identify, freeze, trace and recover the stolen funds, though the investigation was in early stages. President Donald Trump said his administration was examining the incident and that he felt reassured by Binance’s pledge to reimburse losses.
How the Binance Breach Compares With Bybit and Bitget
CNBC placed the breach in a longer line of exchange failures. Bybit lost roughly $1.5 billion in an exploit that targeted its trading platform, and Bitget was drained of more than $350 million last month. In the early 2010s, Mt. Gox suffered several hacks that shook bitcoin’s price. The table pairs reported losses with bitcoin’s first-day reaction, using Anchorage Digital data cited by CNBC.
| Event | Reported loss | Bitcoin move in first 24 hours |
|---|---|---|
| Binance, October 2026 | About $6.3 billion | Down about 4% on Friday to $77,065 |
| Bybit exploit | Roughly $1.5 billion | Not stated in the CNBC report |
| Bitget, September 2026 | More than $350 million | Not stated in the CNBC report |
| Mt. Gox, February 2014 | Not stated in the CNBC report | Down as much as 23.7% |
| Average of past exchange exploits | Not applicable | Down 8.3% on average |
Spencer Hallarn, head of markets at GSR, told CNBC the difference this time was that confidence in crypto markets did not collapse the way it did after other major incidents. He tied part of that to Binance saying it had started recovering affected assets. The comparison with Bybit also shows a trend: the biggest losses now come from operational compromise, not from a flaw in a blockchain protocol.
A Control Checklist for Crypto Treasury Teams
Redbord suggested that every corporate treasury ask its custodian to commit to five things in writing: a set time to inform you of an incident, clear legal title to your assets separate from the custodian’s, reviewable insurance and audit controls, systems divided by chain and wallet type, and round-the-clock cooperation with stablecoin issuers and law enforcement. Add engineering controls from this breach and the checklist grows to eight items. Browse the wider cybersecurity coverage on Tech Insider for related incident breakdowns.
- Incident clock: require a written notification window from every custodian and exchange.
- Title separation: confirm in the contract that your assets are legally distinct from the provider’s own.
- Segmentation: demand separate systems by chain and wallet type so one breach does not spread.
- Endpoint isolation: keep engineer laptops away from any service that can authorize withdrawals.
- Delegation monitoring: treat EIP-7702 authorizations as gated events with their own approvals.
- Circuit breakers: pre-agree automatic halts when withdrawal patterns break normal limits.
- Issuer contacts: test the freeze path with Tether and Circle before you need it.
- Evidence file: store agreements, addresses, hashes and approval logs on your own systems.
Market Impact: Bitcoin, ETFs and Stablecoin Supply
NBC News reported that bitcoin fell as much as 5 percent to below $76,000 and that other cryptocurrencies dropped as much as 9 percent, extending a month-long downturn. CNBC reported a milder first-day move of about 4 percent. Reuters said bitcoin recovered through the weekend to trade above $77,000 on Monday, while ether rebounded from a two-month low.
Institutional flows showed more stress than spot prices. Redbord told Reuters that spot bitcoin ETFs saw $643 million of outflows on Friday, the largest daily withdrawal of October, and that more than $1.3 billion in leveraged positions were liquidated. Stablecoin market capitalizations also fell after Friday, which Reuters read as a sign that some investors moved into cash or traditional assets. Analysts told Reuters the scale of the hack could curb institutional appetite for crypto.
Policy risk sits in the background too. NBC News noted that the Clarity Act failed in Congress shortly before the hack, so the industry enters this period without the legal protections that bill would have created. A major theft at the largest exchange by daily trading volume gives skeptics fresh material. It also gives corporate treasuries a reason to demand regulated, auditable custody terms rather than platform promises.
Five Predictions for Crypto Treasury Security
These forecasts are our analysis, built from the reported facts above. They are not statements from Binance or any named expert.
- Custody contracts will add incident clocks. Expect finance teams to push for written notification windows and title-separation clauses within the next two quarters.
- Delegation events will join standard monitoring. Wallet providers and exchanges will likely add alerts and approval gates for EIP-7702 style authorizations before year-end.
- Issuer freeze drills will become routine. The speed of the Tether and Circle response gives treasurers a template, and testing it ahead of time is cheap.
- Proof-of-reserves scrutiny will intensify. Binance’s reserve claims will draw outside review, and rivals will publish their own reserve data to court the customers who left.
- Endpoint hardening will get budget. Boards that read about a single laptop opening a $6.3 billion hole will fund device isolation for engineers with production access.
Frequently Asked Questions
How much did the Binance hack cost? Binance estimated the total impact at approximately $6.3 billion in token assets. TRM Labs, as reported by SecurityWeek, calculated about $6.36 billion moving across 10 blockchains on October 29, 2026.
Did attackers steal wallet private keys? Binance said it found no evidence that wallet private keys were leaked. Its early investigation pointed to a compromised DevOps engineer’s laptop, a service container and unauthorized withdrawal transactions, and the company later said more breach points were involved.
Will Binance customers lose money? Binance says no. The company said it will cover the losses with company funds and has reserved more than $6.34 billion. It also cites a $1.2 billion Secure Asset Fund for Users.
Who carried out the attack? That remains unconfirmed in Binance’s statements. Reuters reported that the FBI named the North Korean group TraderTraitor, but we found no FBI statement in the sources reviewed, and the claim stays an allegation.
What role did EIP-7702 play? Binance said the attack involved EIP-7702, an Ethereum standard that lets a wallet delegate execution to smart-contract code. Per Global Finance, Teng said the delegation did not pass through Binance’s normal approval controls.
How much was frozen? Tether, Circle and other firms reportedly froze about $3 billion. Reuters said Circle alone froze more than $1.1 billion in USDC, and Redbord said issuers froze about $2.7 billion within hours.
What should a company holding crypto do now? Keep its own evidence file of agreements, addresses and transaction records. Ask custodians for written incident timelines, title separation and issuer cooperation, and test the freeze path before an emergency.