Binance hack: frozen funds and five different price paths

Binance estimates that an attack affected around $6.3 billion in crypto assets. The company says it will cover all losses using SAFU and its own funds. The incident began on October 29, 2026; the investigation and containment continued on October 30. Binance’s initial statement.

One development explains much of this story: Binance says its partners froze around $3 billion. That prevents certain assets from moving while leaving their recovery unresolved. It also raises a question: how much control over your funds would you accept if that control could help stop a thief? Official October 30 update.

How BTC, ETH, BNB, SOL and XRP moved

We calculated 1,200 five-minute Binance Spot closes, 240 per asset, all quoted in USDT. We used the October 29 close at 20:00 UTC as a common baseline and October 30 at 15:00 UTC as the cutoff. The chart adds one preceding hour for context. These are changes measured within that window, rather than rolling 24-hour returns or an estimate of how much the hack caused. Binance API and candlestick definitions.

BNB finished with the largest decline of the five: −6.18% versus baseline. Bitcoin ended at −4.45%, Ether at −4.23%, Solana at −5.26% and XRP at −3.00%. BNB also recorded the deepest minimum close, −8.17%, at 00:30 UTC.

The path adds information a final number hides. BNB had the lowest change versus baseline in 171 of the 228 subsequent closes, or 75%. Another asset occupied that position in the remaining closes. Its largest gap below Bitcoin was 4.57 percentage points at 21:05 UTC. The original Binance statement linked here is timestamped 21:16 UTC; these are reference points in the sequence. Observed first statement, original version.

Five prices, one baseline

Baseline: Oct 29, 20:00 UTC · Cutoff: Oct 30, 15:00 UTC

BTC-4.45%ETH-4.23%BNB-6.18%SOL-5.26%XRP-3.00%

Changes at cutoff · Oct 30, 15:00 UTC

0%-2%-4%-6%-8%-10%

29 oct
19:0030 oct
00:0005:0010:0015:00
UTC

BNB: lowest change of the five versus baseline in 171 of 228 closes. Yellow = BNB; gray = another asset. Post-baseline closes only.

Fixed summary at cutoff. Minimum uses five-minute closes.

Asset	Minimum vs base	Cutoff vs base	Dip recovered
BTC80,848.64 → 77,251.95 USDT	-5.27%02:05 UTC · 30 oct	-4.45%	15.60%
ETH2,336.89 → 2,237.94 USDT	-6.52%02:05 UTC · 30 oct	-4.23%	35.06%
BNB744.89 → 698.83 USDT	-8.17%00:30 UTC · 30 oct	-6.18%	24.28%
SOL99.82 → 94.57 USDT	-6.76%00:30 UTC · 30 oct	-5.26%	22.22%
XRP1.2823 → 1.2438 USDT	-5.90%02:05 UTC · 30 oct	-3.00%	49.07%

Recovering 49% of a drop is different from gaining 49%. All five prices remained below baseline. The period before 20:00 is shaded.

HeyMark calculations using Binance Spot closes in USDT. This timeline does not establish how much of the change the hack caused. CSV · 1,200 closes · Method and provenance · Binance documentation

What it means that XRP recovered 49% of its dip

XRP’s baseline was 1.2823 USDT. Its lowest subsequent close was 1.2067; at the cutoff, it traded at 1.2438. It had recovered 49.07% of the decline between baseline and that minimum, while remaining 3.00% below baseline. Bitcoin had recovered 15.60% of its dip. These are proportions of declines recovered, rather than gains of 49% and 16%.

The calculation is (cutoff price − minimum close) / (baseline price − minimum close) × 100. The minimum uses five-minute closes, rather than the lowest trade within each candle. You can change the chart’s time, hide individual curves and download the 1,200 observations as CSV and the method with its sources.

Which assets left Binance

TRM’s breakdown puts around $3.79 billion on the Ethereum network. That total includes ETH and numerous tokens; it does not represent $3.79 billion exclusively in Ether. The firm attributes around $1.47 billion to Bitcoin, $628 million to Tron and $296 million to XRP Ledger. These are estimated transfer values, distinct from the price changes in the chart. TRM’s breakdown.

Can you withdraw from Binance? What the update says

In its October 30 statement at 08:47 UTC, Binance said withdrawals remained paused and deposits were unaffected. The company said it was progressing toward its expected 45-hour timeline for resuming withdrawals. That was its stated expectation at the time, rather than a live countdown or confirmation of reopening. Binance’s operational update.

This matters because the initial statement announced a precautionary suspension of both deposits and withdrawals. The platform’s latest notice is the useful reference for which operations are available, rather than a screenshot from the first hours.

Frozen, recovered and covered have different consequences

Seeing the numbers together makes it easy to add them up or assume the company has already recovered half the money. The announcements describe different stages. An asset can be frozen while its return remains pending; company funds can cover a loss even if the stolen asset never comes back.

Three figures, three meanings

$6.3B

Affected assets

Binance’s initial estimate describes the incident’s impact before recovery and coverage are settled. It is not the final loss borne by customers.

Binance · initial statement ↗

≈$3B

Blocked assets

Binance said its partners had frozen around $3 billion. Preventing assets from moving is a containment step; the statement does not say that the full amount has already been returned.

Binance · Oct 30, 08:47 UTC ↗

$6.34B+

Company funds reserved

Binance says it reserved over $6.34 billion to cover the incident. It already holds $5 billion in the affected tokens and is buying the remainder. This reserve excludes frozen assets. This is the company’s statement, pending the public verification it promises.

Binance · Oct 30, 10:55 UTC ↗

These concepts overlap. Do not add the amounts together.

Binance 29.10.20266.36

Bybit 21.02.20251.50

0

About 4.2 times the Bybit amount. These estimates concern different incidents; they do not measure security or final customer losses. TRM Labs · FBI

Binance says it reserved over $6.34 billion

In a later message, on October 30 at 10:55 UTC, Binance said it had begun recovering assets for users and reserved over $6.34 billion of company funds to cover the incident. According to the company, $5 billion is already held in the same tokens that were affected; it is buying the remainder through market and OTC transactions.

Binance specifies that this reserve excludes frozen or protected assets, which remain subject to recovery and verification. It is not saying it recovered $6.34 billion from the attacker. The company promises public verification through its proof of reserves. Coverage and recovery update.

TRM Labs estimated $6.36 billion in transfers from Binance wallets to attacker-controlled addresses. Its snapshot, as of October 30 at 00:30 UTC, counted around $2.7 billion frozen. Binance’s later figures come from another source and observation time. They are not additional amounts to add together. TRM Labs’ analysis.

Bybit provides a sense of scale: the FBI put that February 2025 theft at approximately $1.5 billion. TRM’s Binance estimate is about 4.2 times larger. That ratio compares estimated values from two attacks; it does not measure the platforms’ relative security or the final cost to customers. FBI notice on Bybit.

How the attacker got in: the laptop hypothesis expanded

Binance’s first explanation pointed to a compromised DevOps engineer’s laptop, which may have enabled access to a service container and unauthorized withdrawals. The company said it had found no evidence of a private-key leak. Hours later, it disclosed additional breach points and kept the investigation open. Describing this as a settled case involving “just one laptop” would miss that update. Initial statement · Investigation update.

TRM’s analysis points to access to infrastructure that signs transactions for internet-connected wallets. It identified an EIP-7702 delegation on Ethereum and ordinary signed transfers on other chains. The mechanism lets an account authorize code execution; its use here does not establish an Ethereum consensus failure. Binance’s technical report is still needed to establish the root cause. TRM · EIP-7702 specification.

TRM attributes the attack with high confidence to TraderTraitor, a North Korea-linked group. That is the firm’s assessment. The FBI notice linked above concerns the earlier Bybit attack; it is not an FBI confirmation about this incident.

The debate over crypto’s freeze button

According to TRM, issuers including Tether, Circle, Ripple and World Liberty Financial blocked implicated stablecoins. Arbitrum used a different emergency mechanism to move assets on its network beyond the attacker’s reach. These are powers held by particular actors and systems. There is no universal button for freezing any BTC or ETH. TRM’s account of the measures.

That creates a tension. Blocking assets offers a way to contain theft. It also raises questions about who can order a freeze, which criteria apply and how a mistaken decision gets reviewed. The same mechanism that helps stop an attacker introduces a dependency for anyone holding those assets.

Bitquery’s investigation describes how some stablecoins were converted into other assets before freezes reached them. That race helps explain why tracing, freezing and recovering funds require different actions. Bitquery’s investigation.

What remains to be verified

The next decisive information will be the documented root cause, the actual status of withdrawals and how much blocked money returns to legitimate control. Binance also committed to publishing updated proof of reserves after remediation. Until then, its promise to cover losses and money already recovered need to remain separately identified.

Binance’s statement on coverage and recovery

Binance · October 30, 2026, 10:55 UTC. The company reports the start of recovery and its company-fund reserve, separately from frozen assets. The linked post is the original source of this update.