Plain-English guide
The main questions people ask, and what the sources say about each. Every answer below is a claim somebody made, shown with who said it, how it is labelled and a link to the original. This page does not state anything in its own voice.
Answers differ between sources and change over time. Where they conflict, see Contradictions and Numbers. What nobody has answered yet is on Open questions. Speculation is kept on Theories.
Questions
- How much is said to have been taken?
- Who is said to be responsible?
- How is the attack said to have happened?
- Has any of it been frozen, and by whom?
- Is any of it said to have been recovered?
- How have the affected parties responded?
- What is said about customer withdrawals?
- What is said about reserves and customer funds?
- What is said about effects on markets?
- What have regulators and authorities said?
- What else do sources say?
How much is said to have been taken?
Our last update explained that Binance had set aside more than $6.34B in company funds to cover hacked losses, and we had already covered approximately 80% of the impacted amount of the hacked loss at that time.
The estimated total impact sits at around $6.3B.
At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
Binance 16, the second Ethereum hot wallet, signed nine ordinary transfers to the attacker worth about $174 million, with no delegation at all.
Reported Elliptic said that about $6.43 billion was stolen from Binance across 11 blockchains on October 29.
On October 29, about $6.43 billion was stolen from Binance across 11 blockchains.
The previous record was the $1.5 billion Bybit exploit in February 2025.
Showing 6 of 64. See all claims on this topic.
Who is said to be responsible?
The following addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
Federal Bureau of Investigation (FBI), FBI. Original Claim 188 Captured .
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
Federal Bureau of Investigation (FBI), FBI. Original Claim 187 Captured .
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
Federal Bureau of Investigation (FBI), FBI. Original Claim 186 Captured .
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
Federal Bureau of Investigation (FBI), FBI. Original Claim 185 Captured .
Official The FBI stated that North Korea is responsible for a Binance attack involving over $6 billion.
10.31.2026 North Korea Responsible for $6 Billion+ Binance Attack
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Federal Bureau of Investigation (FBI), FBI. Original Claim 295 Captured .
Showing 6 of 60. See all claims on this topic.
How is the attack said to have happened?
Once the investigation is complete, we will publish a post-incident report with further details on the incident.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.
We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.
At this stage, we have found no evidence that wallet private keys were leaked.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
Showing 6 of 69. See all claims on this topic.
Has any of it been frozen, and by whom?
Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
Approximately $3 billion has been frozen on-chain to date.
We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
The issuers froze about 2.8 billion dollars, and most of it within 47 minutes of the main sweep, but the attacker had moved 700 million USDT out of the hub before the first freeze landed and converted close to 800 million dollars of stablecoins into assets nobody can freeze.
On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.
Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.
Showing 6 of 58. See all claims on this topic.
Is any of it said to have been recovered?
As shared in our previous update, Binance had already covered approximately 90% of the impacted amount, up from approximately 80% in the prior update.
Binance will absorb the financial impact of the stolen funds, not our users.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update. The outstanding 5% are tokens outside the top ten listed above, and are less liquid in the market and take longer time to source at the required scale.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update.
Binance is committing to replenishing the SAFU to return the fund size to approximately US$1 billion.
The replenishment employed: - A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here. - A portion of our Futures insurance fund. The remaining balance of the Futures insurance fund is a regulatory requirement. Users can check the updated balance of the fund here. - Binance's own corporate treasury.
Showing 6 of 30. See all claims on this topic.
How have the affected parties responded?
Deposit services remain open and are not affected by the incident.
Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.
Official Binance stated that it will absorb the financial impact of the stolen funds, not its users.
Binance will absorb the financial impact of these stolen funds, not our users.
We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.
For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.
we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.
Showing 6 of 22. See all claims on this topic.
What is said about customer withdrawals?
Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC).
Our next milestone in focus is resuming the withdrawal services for users. We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01) and will provide a further update as soon as details are confirmed.
We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01) and will provide a further update as soon as details are confirmed.
Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks.
Showing 6 of 18. See all claims on this topic.
What is said about reserves and customer funds?
We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.
SAFU is an emergency reserve fund established by Binance in July 2018 to protect user assets in extreme cases, such as security breaches or platform-level incidents. Binance allocated a percentage of trading fees to grow the fund to a substantial level over time. The SAFU fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority. A portion of the funds serves as capital reserves as part of Binance regulatory obligations in the ADGM.
The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload, so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.
so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
The SAFU fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority.
Showing 6 of 30. See all claims on this topic.
What is said about effects on markets?
Bitcoin traded near $77,400 at 4:00 pm on Saturday, about 4% below its price shortly before the attack began Thursday
Cointelegraph reported that cryptocurrency markets extended their decline early Friday following the Binance hack , with BNB down more than 8% over 24 hours and Bitcoin trading near $77,000. Decentralized finance tokens also declined. Aave’s AAVE fell 11.3% to $118.54, while Uniswap’s UNI dropped 10.4% to $6.48, according to CoinGecko.
Shares of publicly traded cryptocurrency companies fell sharply Friday, with Coinbase dropping more than 13% a day after reporting a decline in third-quarter revenue
The effects of the hack on crypto markets were compounded by tech-stock losses that came with Q4 earnings projections.
Cryptocurrency-related firms Coinbase, Strategy, and Robinhood fell in the wake of reports that hackers stole $6.3bn from Binance, the world’s biggest cryptocurrency exchange.
Bitcoin fell below $77,000 late Thursday as the Binance exploit intensified a market-wide sell-off. * BNB lost 7.1%, Ethereum slid 5.2%, and XRP fell 7%.
What have regulators and authorities said?
Soon after the $6.3 billion hack of Binance, the biggest in crypto history, some political and administration figures began offering their opinions with a US election approaching on Nov. 3 and voting already having begun in many locations.
It was not clear whether there was any immediate political advantage to be gained from the hack, which was widely attributed to a North Korean group, but Republican and Democratic sides began staking out positions almost immediately.
The exchange also said it submits weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority under a requirement that predated the hack.
In the US, Commodity Futures Trading Commission (CFTC) chairman Michael Selig told reporters that “we have the ability to trace all this in the blockchain”. Speaking to CNBC, Selig said it was “very concerning” that there had been “several cyber incidents involving crypto” and the CFTC has regulations in place to prevent this sort of attack.
“This proves our exact point in proposing regulations for crypto markets.
The Clarity Act would have given crypto firms legal cover to freeze suspicious transactions the instant law enforcement calls.
Showing 6 of 8. See all claims on this topic.
What else do sources say?
The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
Federal Bureau of Investigation (FBI), FBI IC3. Original Claim 793 Captured .
TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.
Federal Bureau of Investigation (FBI), FBI IC3. Original Claim 792 Captured .
FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor
Federal Bureau of Investigation (FBI), FBI IC3. Original Claim 791 Captured .
The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.
Federal Bureau of Investigation (FBI), FBI IC3. Original Claim 790 Captured .
In late-May 2024, the actors likely used this access to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC, worth $308 million at the time of the attack.
Federal Bureau of Investigation (FBI), FBI. Original Claim 798 Captured .
After mid-May 2024, TraderTraitor actors exploited session cookie information to impersonate the compromised employee
Federal Bureau of Investigation (FBI), FBI. Original Claim 797 Captured .
Showing 6 of 47. See all claims on this topic.