Binance says the estimated impact of a record cryptocurrency hack has reached about $6.3 billion, while investigators and blockchain companies have identified or frozen a growing share of the assets. The exchange is working with law enforcement, reviewing several possible entry points and preparing to restore withdrawals after a security overhaul.\n\n## What happened and how the response unfolded\n\nThe incident began with suspicious transfers from a Binance-linked Ethereum wallet. Blockchain researchers reported that assets were moved to a newly created address through a contract call allegedly funded by Tornado Cash. Binance initially investigated a possible compromise involving a DevOps engineer’s laptop and an internal service container, but later said the breach was more complex and had exposed additional points of entry.\n\nAccording to Cointelegraph, Binance has found no evidence that a wallet private key was leaked. Instead, security specialists cited the possible misuse or compromise of transaction-signing infrastructure. Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation to obtain execution authority over a hot wallet, and that the delegation bypassed the exchange’s usual approval controls.\n\nEIP-7702 is an Ethereum mechanism that can give externally owned accounts temporary smart-contract capabilities. Blockaid chief executive Ido Ben-Natan said the feature may have allowed the attacker to carry out the operation in one sweep, although the funds could also have been stolen through other methods. Binance said the attacker used a “self-destruct mechanism” to remove tools and traces, making the investigation more difficult.\n\nThe exchange has paused withdrawals while it completes security checks and updates its withdrawal service and related addresses. Deposits were described as operating normally, and Binance said it was targeting a return of withdrawals within roughly 40 hours to 48 hours. Teng also said the company planned to publish an initial reserves snapshot before a full proof-of-reserves report by Monday.\n\n## Frozen assets, replacement funds and law-enforcement work\n\nBinance said the verified value of frozen assets had reached $3 billion, up from earlier figures of $2.54 billion. The total could rise as investigators trace assets across blockchains and work with token issuers, exchanges, analytics firms and law-enforcement agencies. The Arbitrum Security Council, for example, froze $30.5 million connected to the exploit, consisting of 74.6 million ARB tokens and 8,425 Ether.\n\nSeveral stablecoin issuers and other projects have also blocked assets associated with the attack. The affected tokens include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP and ARB. Ripple said it was freezing RLUSD linked to the incident. World Liberty Financial froze $27 million in USD1 and $2 million in WLFI, while First Digital confirmed that it had frozen stolen FDUSD.\n\nBinance said it had reserved more than $6.34 billion in company funds to cover losses. Of that amount, $5 billion was already held in the same tokens involved in the theft. Co-CEO Yi He said the exchange was buying matching altcoins through over-the-counter transactions and open-market purchases to address any shortfalls. Some purchases could take longer because of limited liquidity and OTC settlement procedures.\n\nThe exchange said its SAFU fund and company holdings also include significant amounts of Bitcoin and Ether. It has not disclosed the wallet addresses holding the matching assets, citing security concerns. Binance said it submits weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority under a requirement that existed before the hack.\n\nBinance is cooperating with the FBI and other parties to seek recovery of the stolen funds. Chainalysis said thousands of transfers in a short period suggested that the attackers might be automating the movement and redistribution of assets. The analytics firm described repeated circulation among addresses as an unusual laundering pattern.\n\n## Suspected attacker and wider crypto-market effects\n\nSeveral security and blockchain-intelligence firms have linked the attack with high confidence to TraderTraitor, a North Korean-linked group. Chainalysis, TRM Labs and Blockaid cited similarities with earlier incidents and the sophistication of the onchain activity. Onchain investigator ZachXBT said funds from the Binance incident and an earlier Bitget exploit were commingled in one address, indicating that the same actor may have been responsible.\n\nThe disruption also affected decentralized-finance protocols. Aave temporarily froze new deposits and borrowing across its V3 and V4 markets after the exploiter deposited 60 million USDT and borrowed 19,762 WETH, worth about $44.6 million at the time. Withdrawals, repayments and liquidations remained available, and Aave later restored deposits and borrowing after saying its contracts were unaffected and positions remained overcollateralized.\n\nThe event raised broader questions about centralized-exchange security and the role of decentralized exchanges. Standard Chartered’s global head of digital-assets research said the breach could encourage more trading through DEXs, while CoinGecko data cited by Cointelegraph showed the top-10 spot DEX-to-CEX ratio at 23.5% in the second quarter of 2026, up 2.1 percentage points from the first quarter.\n\nCrypto market makers Wintermute and GSR disclosed exposure to Binance but said they did not expect major business disruption. GSR said its exposure was below 5% of net equity, while Wintermute reported exposure below 20%; neither gave a dollar figure or confirmed losses.\n\n## Current market picture\n\nMoneyiar market data at 12:38 p.m. and 12:39 p.m. on November 1, 2026, showed BNB at $710.8219612197, up 0.87% over 24 hours but down 3.77% over seven days. Horizen (ZEN) was $5.3338488484, down 0.02% in 24 hours and 5.36% over seven days. Ailey (ALE) traded at $0.2659004228, up 0.01% over 24 hours and down 0.27% over seven days. Billions Network (BILL) was $0.0139971939, down 0.59% over 24 hours but up 10.04% over seven days.\n\nThe figures illustrate that BNB had recovered on a one-day basis in the supplied snapshot, despite remaining lower over the week. They are Moneyiar data for the stated times and are separate from the earlier market figures reported during the initial hack coverage, when Bitcoin, BNB and Ether were all falling.
