Statements

Stablecoins make up 94% of the frozen funds, almost entirely on Ethereum and Tron. Arbitrum and Optimism are the only blockchains where everything stolen has been secured, in both cases by the network's own governance. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because native assets have no issuer that can freeze them.

The Arbitrum Security Council took emergency action to move assets out of the attacker's reach, and on October 31 Optimism's governance appears to have done the same, moving 44 million OP (around $5 million) out of the attacker's address.

Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.

Elliptic has verified $2.85 billion of frozen or seized funds, 44% of the theft, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that cannot be frozen, and moving funds between blockchains, using automated scripts that run around the clock.

Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".

Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.

Binance is aiming to resume withdrawals within 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng [said]

The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Something tells me that the timing of the Claude Code supply chain attack is not a coincidence

Was there actually a hack into binance systems, or was it just some insider or credential leak?

USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP, including their bridged and wrapped versions, stay at LTV 0 on Aave V3 and at a collateral factor of 0 on Aave V4, on every market where they are listed. On Aave V3 this also applies to E-Mode. These are the assets held across the exploiter’s address cluster .

The second batch reduced borrow caps and draw caps on the largest borrow paths to about 2% above the amount borrowed just before the exploit. This removes about $3.7B of unused borrow capacity on Aave V3 and $130M on Aave V4, which would otherwise have become available all at once when markets reopen. Every reserve can still return to its pre-exploit borrow size. The GHO borrow cap reductions on Aave V3 Core and Prime were queued with the GHO Stewards.

Ripple "promptly" froze roughly $200 million in associated funds, co-CEO Yi He [said]

Binance said it has reserved over $6.34 billion in company funds to offset losses it suffered in a recent breach.

Blockaid's transaction security engine classified the type-4 transaction that delegated Binance 14 as malicious on sight, with the reason that an EOA was being upgraded through EIP-7702 to an untrusted address.

Blockaid’s detection flagged the drain under two minutes after the sweep and before any public report

The delegation itself was visible onchain for three minutes and 24 seconds before the sweep

The operator address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , was funded through three Tornado Cash withdrawals starting October 28.

Tether and Circle froze about $1.8B in the main collection address within 40 minutes, and with later freezes by other issuers and the Arbitrum Security Council, Binance puts the verified total frozen at about $3B.

About $6.3B was stolen from Binance’s hot wallets on October 29, 2026, by Binance’s own estimate, across Ethereum, Arbitrum, Avalanche, Optimism, Bitcoin, Tron, and other chains, the largest crypto theft on record.

Binance ranks as the largest cryptocurrency exchange by reserves with $134 billion in total assets.

I disagree. Assuming the start of the timer is when they first encountered Binance systems they moved very quickly to make the transfers. It suggests to me either some or all of this was automated or they had prepared in advance with some inside knowledge of Binance architecture.

“The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says.

“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says.

“We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED.