Binance Piracy: $6.3 billion involved, losses still to be specified

Binance announced a cyberattack on Thursday, October 29, 2026, with a "total impact" of approximately $6.3 billion. Nice-Matin, Challenges and RTBF report the same incident and the immobilization of several billions of assets. If this estimate is confirmed, it would be the largest theft of identified cryptocurrency. However, it does not constitute a definitive balance sheet of irrecoverable losses. [S1] [S4] [S6]

Billions concerned, but not all permanently lost

Binance indicates that approximately $3 billion has been frozen with partner support. TRM Labs, on the other hand, reported cash outflows at $6.36 billion, valued at the time of transfers, and recorded approximately 2.7 billion fixed assets in its statement, which was stopped at 0030 UTC on 30 October. These counts are not exactly the same: they correspond to separate scopes and measurement times without a consolidated common balance sheet. [S1] [S8] [S10]

Three concepts must therefore remain separate: assets transferred by the attacker, frozen amounts and final losses. A freeze prevents certain movements, but does not prove that the money was returned. TRM Labs also describes conversions and borrowings to convert tokens that may be blocked into assets beyond the issuer's freezing power. Recovery remains uncertain. [S9] [S10]

Binance's initial communication blurred this distinction. Nice-Matin reports that the platform first assured that customers' funds were safe, before promising to cover all losses. Its founder, Changpeng Zhao, referred to losses of up to $1 billion. The scope of this estimate is not sufficiently specified to bring it directly closer to the 6.3 billion announced by the company. [S1]

For customers, access to assets remains decisive

Early announcements indicated that deposits and withdrawals were suspended. The follow-up to Cointelegraph brings an update: deposits work normally, according to Binance, while withdrawals remain interrupted. In a point published on 30 October at 0837 UTC, the platform maintains a recovery target within 45 hours. This is a forecast of the company, not a reopening found. [S1] [S8]

Richard Teng, Co-Director General of Binance, states that the losses will be covered by the SAFU Emergency Fund and the company's resources. For a customer, this financial promise does not immediately resolve the impossibility of withdrawing his assets. The announcements consulted do not detail the individual modalities of compensation or a specific procedure for challenging blockages. [S8]

An investigation that goes beyond the hypothesis of a compromised computer

The initial Binance investigation favoured the compromise of the laptop by an engineer in charge of the IT infrastructure. This access would have resulted in internal service and unauthorized withdrawals. The platform then announced that it had discovered further points of compromise. Reducing the attack to a single computer would therefore be premature. [S8] [S9]

Richard Teng states that the investigation did not assign responsibility to any individual and that the attack was not the result of a mere isolated action. Binance also claims that it found no evidence of leaking private keys from the wallets. TRM Labs favours a compromise of the infrastructure allowing transactions: a system can, according to this analysis, sign fraudulent transfers without the keys necessarily being stolen. These conclusions remain provisional. [S8] [S10]

TRM Labs attributes the attack to the North Korea-linked TraderTraitor group, with a degree of confidence presented as high. Fortune points out, however, that Binance did not designate a person responsible and that no definitive evidence of North Korean involvement was then established. Bybit hacking in February 2025, cited as a precedent, is a separate event, not additional information about Binance's losses. [S9] [S10]

Protecting funds without removing control

Tether and Circle announced that they had immobilized approximately $1.6 billion in USDT and $800 million in USDC in their first communications, respectively. Circle indicates that it has acted in coordination with the authorities. These interventions illustrate concrete protection: intermediaries can prevent the circulation of part of the stolen assets. They also show that these chips remain subject to blocking power exercised by their transmitters. [S1] [S8]

The suspension of withdrawals raises another question of control: Binance invokes the security of its service, while users can temporarily no longer withdraw their funds from it. To assess this restriction, its duration, scope and recovery conditions are decisive. At this stage, the sources provide an objective of recovery and a promise to cover losses, but not yet a balance sheet of refunds to measure the effects for each customer. [S8] [S10]