Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
What is still unanswered, why it matters and who could answer it. A question is marked answered only when an approved, quoted claim answers it, and the answer is shown as that party's statement, not as settled fact.
16 questions, 16 not fully answered.
Open Updated
Why it matters. Elliptic says about $3.25 billion could not be frozen. A first deposit to an exchange would show where the attacker tries to cash out.
Who could answer. On-chain analysts; exchanges; law enforcement
No approved answer yet.
Open Updated
Why it matters. The main drain took about 20 minutes. Blockaid says it flagged the sweep in under two minutes.
Who could answer. Binance
No approved answer yet.
Open Updated
Why it matters. Hacken notes nobody outside Binance knows whether a policy layer was set.
Who could answer. Binance
No approved answer yet.
Partly answered Updated
Why it matters. The FBI statement names the group but, in the sources captured as of 2026-11-01, the statement we captured does not set out its evidence.
Who could answer. FBI
FBI. Original Claim 295The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Partly answered Updated
Who could answer. FBI; US Secret Service; IRS-CI; Abu Dhabi FSRA; CFTC
FBI. Original Claim 295The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
Partly answered Updated
Why it matters. Binance names SAFU, treasury and part of its Futures insurance fund but, in the sources captured as of 2026-11-01, gives no split.
Who could answer. Binance
Binance said on 31 October that replenishment used a partial deployment of SAFU.
Binance. Original Claim 290A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here.
Partly answered Updated
Why it matters. Frozen funds are not automatically returned to Binance or users, as far as the sources captured as of 2026-11-01 show.
Who could answer. Binance; law enforcement; token issuers
Cointelegraph. Original Claim 405frozen funds don’t necessarily equate to recovered funds. Immobilizing assets prevents the suspected attackers from spending them, but it doesn’t automatically return them to Binance or its users.
Partly answered Updated
Who could answer. Binance
Cointelegraph. Original Claim 134The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”
Partly answered Updated
Why it matters. In the sources captured as of 2026-11-01 there is no public account of the full chain, so outsiders cannot judge whether other exchanges are exposed to the same path.
Who could answer. Binance post-mortem; law enforcement
Binance. Original Claim 284Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
Partly answered Updated
Why it matters. Teng said it was not carried out by one person.
Who could answer. Binance; law enforcement
The BBC quoted Richard Teng as saying the attack was not carried out by one person.
BBC News. Original Claim 337This was not carried out by one person.
Partly answered Updated
Why it matters. Binance says the laptop may have been the start but also that there were additional points of breach.
Who could answer. Binance
Binance. Original Claim 280Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Partly answered Updated
Why it matters. Binance said it expected to share further findings within about 48 hours of 30 October. It later said it will publish a post-incident report when the investigation is complete.
Who could answer. Binance
Binance. Original Claim 183Once the investigation is complete, we will publish a post-incident report with further details on the incident.
Partly answered Updated
Why it matters. The full zero-knowledge proof is still being generated.
Who could answer. Binance; independent verifiers
Binance. Original Claim 407so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
Partly answered Updated
Why it matters. Binance says it does. Experts warned the promise may not be legally binding.
Who could answer. Binance; regulators; courts
Binance. Original Claim 406Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.
Partly answered Updated
Why it matters. Published totals run from $5.9B to $6.43B and the methods differ.
Who could answer. Binance; on-chain analysts
Binance. Original Claim 167At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
Partly answered Updated
Why it matters. Binance says it found no evidence of a key leak. Analysts say its signing system signed for the attacker.
Who could answer. Binance; law enforcement
Binance. Original Claim 285At this stage, we have found no evidence that wallet private keys were leaked.
Know a source that answers one of these? Tip and report forms are not available yet; see About.