# Binance hack: frozen funds and five different price paths

> What happened in the Binance hack: frozen funds, affected assets and our analysis of five crypto prices, their recovery and downloadable data.


Published: 2026-10-30. Original source: [Binance · recovery and company funds reserved](https://x.com/binance/status/2116121748555153621).

![HeyMark editorial cover with the Binance logo and a headline about the hack and affected funds.](/news/binance-hack/cover-clean-en.webp)

HeyMark editorial cover featuring the visual identity of [Binance](https://x.com/binance). 

Binance estimates that an attack affected around **$6.3 billion** in crypto assets. The company says it will cover all losses using SAFU and its own funds. The incident began on October 29, 2026; the investigation and containment continued on October 30. [Binance’s initial statement](https://x.com/binance/status/2115993361517891592).

One development explains much of this story: Binance says its partners froze around **$3 billion**. That prevents certain assets from moving while leaving their recovery unresolved. It also raises a question: how much control over your funds would you accept if that control could help stop a thief? [Official October 30 update](https://x.com/binance/status/2116089661408108712).

## How BTC, ETH, BNB, SOL and XRP moved

We calculated 1,200 five-minute Binance Spot closes, 240 per asset, all quoted in USDT. We used the **October 29 close at 20:00 UTC** as a common baseline and **October 30 at 15:00 UTC** as the cutoff. The chart adds one preceding hour for context. These are changes measured within that window, rather than rolling 24-hour returns or an estimate of how much the hack caused. [Binance API and candlestick definitions](https://developers.binance.com/en/docs/catalog/core-trading-spot-trading/api/rest-api/market).

**BNB finished with the largest decline of the five: −6.18% versus baseline.** Bitcoin ended at −4.45%, Ether at −4.23%, Solana at −5.26% and XRP at −3.00%. BNB also recorded the deepest minimum close, −8.17%, at 00:30 UTC.

The path adds information a final number hides. BNB had the lowest change versus baseline in **171 of the 228 subsequent closes**, or 75%. Another asset occupied that position in the remaining closes. Its largest gap below Bitcoin was 4.57 percentage points at 21:05 UTC. The original Binance statement linked here is timestamped 21:16 UTC; these are reference points in the sequence. [Observed first statement, original version](https://x.com/binance/status/2115915708504900039).

### HeyMark price analysis

Binance Spot · USDT pairs · five-minute closes. Common baseline: Oct 29, 2026 at 20:00 UTC; cutoff: Oct 30 at 15:00 UTC. These are changes within this window, rather than rolling 24-hour returns or a causal estimate of the hack.

| Asset | Baseline (USDT) | Cutoff (USDT) | Minimum close (USDT) | Minimum vs baseline | Cutoff vs baseline | Dip recovered |

| --- | ---: | ---: | ---: | ---: | ---: | ---: |

| BTC | 80848.64 | 77251.95 | 76587.4 | -5.27% | -4.45% | 15.60% |

| ETH | 2336.89 | 2237.94 | 2184.51 | -6.52% | -4.23% | 35.06% |

| BNB | 744.89 | 698.83 | 684.06 | -8.17% | -6.18% | 24.28% |

| SOL | 99.82 | 94.57 | 93.07 | -6.76% | -5.26% | 22.22% |

| XRP | 1.2823 | 1.2438 | 1.2067 | -5.90% | -3.00% | 49.07% |

BNB had the lowest change versus baseline in 171 of 228 subsequent closes. Its largest gap below BTC was 4.57 percentage points at 21:05 UTC on October 29.

Change = 100 × (price / baseline price − 1). Dip recovered = 100 × (cutoff price − minimum close) / (baseline price − minimum close). Recovering 49% of a drop is different from gaining 49%; every asset in this comparison remained below its baseline at the cutoff. The minimum uses five-minute closes, rather than the intrabar low.

[BTCUSDT · Binance API](https://data-api.binance.vision/api/v3/klines?symbol=BTCUSDT&interval=5m&startTime=1793300400000&endTime=1793372399999&limit=1000)

[ETHUSDT · Binance API](https://data-api.binance.vision/api/v3/klines?symbol=ETHUSDT&interval=5m&startTime=1793300400000&endTime=1793372399999&limit=1000)

[BNBUSDT · Binance API](https://data-api.binance.vision/api/v3/klines?symbol=BNBUSDT&interval=5m&startTime=1793300400000&endTime=1793372399999&limit=1000)

[SOLUSDT · Binance API](https://data-api.binance.vision/api/v3/klines?symbol=SOLUSDT&interval=5m&startTime=1793300400000&endTime=1793372399999&limit=1000)

[XRPUSDT · Binance API](https://data-api.binance.vision/api/v3/klines?symbol=XRPUSDT&interval=5m&startTime=1793300400000&endTime=1793372399999&limit=1000)

[CSV](/news/binance-hack/market-5m.csv) · [Method and provenance](/news/binance-hack/market-method.json) · [Documentation](https://developers.binance.com/en/docs/catalog/core-trading-spot-trading/api/rest-api/market)

### What it means that XRP recovered 49% of its dip

XRP’s baseline was 1.2823 USDT. Its lowest subsequent close was 1.2067; at the cutoff, it traded at 1.2438. It had recovered **49.07% of the decline between baseline and that minimum**, while remaining 3.00% below baseline. Bitcoin had recovered 15.60% of its dip. These are proportions of declines recovered, rather than gains of 49% and 16%.

The calculation is `(cutoff price − minimum close) / (baseline price − minimum close) × 100`. The minimum uses five-minute closes, rather than the lowest trade within each candle. You can change the chart’s time, hide individual curves and download the [1,200 observations as CSV](/news/binance-hack/market-5m.csv) and the [method with its sources](/news/binance-hack/market-method.json).

## Which assets left Binance

TRM’s breakdown puts around $3.79 billion on the **Ethereum network**. That total includes ETH and numerous tokens; it does not represent $3.79 billion exclusively in Ether. The firm attributes around $1.47 billion to Bitcoin, $628 million to Tron and $296 million to XRP Ledger. These are estimated transfer values, distinct from the price changes in the chart. [TRM’s breakdown](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history).

| Asset | Network | Approximate units transferred |

| --- | --- | ---: |

| BTC | Bitcoin | 18,270 BTC |

| ETH | Ethereum | 200,630 ETH |

| USDT | Ethereum | 1,875,000,000 USDT |

| USDT | Tron | 612,700,000 USDT |

| USDC | Ethereum | 823,000,000 USDC |

| RLUSD | Ethereum | 88,500,000 RLUSD |

| XRP | XRP Ledger | 233,460,000 XRP |

| SOL | Solana | 970,500 SOL |

| TRX | Tron | 46,400,000 TRX |

Selection reported by TRM, as of Oct 30, 00:30 UTC. These are crypto-asset units, not dollars, and not a complete inventory. USDT is separated by network. Subsequent attacker holdings can change through conversions.

[TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history)

## Can you withdraw from Binance? What the update says

In its **October 30 statement at 08:47 UTC**, Binance said withdrawals remained paused and deposits were unaffected. The company said it was progressing toward its expected 45-hour timeline for resuming withdrawals. That was its stated expectation at the time, rather than a live countdown or confirmation of reopening. [Binance’s operational update](https://x.com/binance/status/2116089661408108712).

This matters because the initial statement announced a precautionary suspension of both deposits and withdrawals. The platform’s latest notice is the useful reference for which operations are available, rather than a screenshot from the first hours.

## Frozen, recovered and covered have different consequences

Seeing the numbers together makes it easy to add them up or assume the company has already recovered half the money. The announcements describe different stages. An asset can be frozen while its return remains pending; company funds can cover a loss even if the stolen asset never comes back.

### What each figure means

**Impact: $6.3B. Affected assets.** Binance’s initial estimate describes the incident’s impact before recovery and coverage are settled. It is not the final loss borne by customers. [Binance · initial statement](https://x.com/binance/status/2115993361517891592)

**Frozen: ≈$3B. Blocked assets.** Binance said its partners had frozen around $3 billion. Preventing assets from moving is a containment step; the statement does not say that the full amount has already been returned. [Binance · Oct 30, 08:47 UTC](https://x.com/binance/status/2116089661408108712)

**Coverage: $6.34B+. Company funds reserved.** Binance says it reserved over $6.34 billion to cover the incident. It already holds $5 billion in the affected tokens and is buying the remainder. This reserve excludes frozen assets. This is the company’s statement, pending the public verification it promises. [Binance · Oct 30, 10:55 UTC](https://x.com/binance/status/2116121748555153621)

### The scale compared with Bybit

| Incident | Estimated amount (USD billions) | Source |

| --- | ---: | --- |

| Binance · 29 oct 2026 | 6.36 | [TRM Labs](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) |

| Bybit · 21 feb 2025 | 1.50 | [FBI](https://www.ic3.gov/PSA/2025/PSA250226) |

TRM’s estimate is about 4.2 times the Bybit amount: 6.36 ÷ 1.5 = 4.24. This compares estimated incident values, rather than security or final customer losses.

Impact, freezes and coverage overlap. Do not add them together.

### Binance says it reserved over $6.34 billion

In a later message, on **October 30 at 10:55 UTC**, Binance said it had begun recovering assets for users and reserved over $6.34 billion of company funds to cover the incident. According to the company, $5 billion is already held in the same tokens that were affected; it is buying the remainder through market and OTC transactions.

Binance specifies that **this reserve excludes frozen or protected assets**, which remain subject to recovery and verification. It is not saying it recovered $6.34 billion from the attacker. The company promises public verification through its proof of reserves. [Coverage and recovery update](https://x.com/binance/status/2116121748555153621).

TRM Labs estimated **$6.36 billion** in transfers from Binance wallets to attacker-controlled addresses. Its snapshot, as of October 30 at 00:30 UTC, counted around $2.7 billion frozen. Binance’s later figures come from another source and observation time. They are not additional amounts to add together. [TRM Labs’ analysis](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history).

Bybit provides a sense of scale: the FBI put that February 2025 theft at approximately $1.5 billion. TRM’s Binance estimate is about **4.2 times larger**. That ratio compares estimated values from two attacks; it does not measure the platforms’ relative security or the final cost to customers. [FBI notice on Bybit](https://www.ic3.gov/PSA/2025/PSA250226).

## How the attacker got in: the laptop hypothesis expanded

Binance’s first explanation pointed to a compromised DevOps engineer’s laptop, which may have enabled access to a service container and unauthorized withdrawals. The company said it had found no evidence of a private-key leak. Hours later, it disclosed **additional breach points** and kept the investigation open. Describing this as a settled case involving “just one laptop” would miss that update. [Initial statement](https://x.com/binance/status/2115993361517891592) · [Investigation update](https://x.com/binance/status/2116089661408108712).

TRM’s analysis points to access to infrastructure that signs transactions for internet-connected wallets. It identified an EIP-7702 delegation on Ethereum and ordinary signed transfers on other chains. The mechanism lets an account authorize code execution; its use here does not establish an Ethereum consensus failure. Binance’s technical report is still needed to establish the root cause. [TRM](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history) · [EIP-7702 specification](https://eips.ethereum.org/EIPS/eip-7702).

TRM attributes the attack with high confidence to **TraderTraitor**, a North Korea-linked group. That is the firm’s assessment. The FBI notice linked above concerns the earlier Bybit attack; it is not an FBI confirmation about this incident.

## The debate over crypto’s freeze button

According to TRM, issuers including Tether, Circle, Ripple and World Liberty Financial blocked implicated stablecoins. Arbitrum used a different emergency mechanism to move assets on its network beyond the attacker’s reach. These are powers held by particular actors and systems. There is no universal button for freezing any BTC or ETH. [TRM’s account of the measures](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history).

That creates a tension. Blocking assets offers a way to contain theft. It also raises questions about who can order a freeze, which criteria apply and how a mistaken decision gets reviewed. The same mechanism that helps stop an attacker introduces a dependency for anyone holding those assets.

Bitquery’s investigation describes how some stablecoins were converted into other assets before freezes reached them. That race helps explain why tracing, freezing and recovering funds require different actions. [Bitquery’s investigation](https://bitquery.io/investigations/binance-hack).

## What remains to be verified

The next decisive information will be the documented root cause, the actual status of withdrawals and how much blocked money returns to legitimate control. Binance also committed to publishing updated proof of reserves after remediation. Until then, its promise to cover losses and money already recovered need to remain separately identified.

### Binance’s statement on coverage and recovery

[Binance · October 30, 2026, 10:55 UTC](https://x.com/binance/status/2116121748555153621). The company reports the start of recovery and its company-fund reserve, separately from frozen assets. The linked post is the original source of this update.

## Plan your next post in HeyMark.

Keep the idea, review the draft with your team, and see how it performed in the accounts you connected.

[Start free](https://app.heymark.ai) · [See how it works](https://heymark.ai/en/#product)

## Developer and agent resources

- [HeyMark MCP documentation](https://heymark.ai/en/mcp/)
- [llms.txt](https://heymark.ai/llms.txt)
- [Full site content for language models](https://heymark.ai/llms-full.txt)
- MCP protocol endpoint: `POST https://mcp.heymark.ai`
- OAuth protected-resource metadata: [/.well-known/oauth-protected-resource](https://mcp.heymark.ai/.well-known/oauth-protected-resource)
- MCP server card: [/server-card](https://mcp.heymark.ai/server-card)