Binance Reports $6.3 Billion Loss and Allocates $6.34 Billion for Compensation
Key Facts
Binance said its hot wallets were hacked at around 20:05 UTC on October 29, resulting in the loss of an estimated $6.3 billion in tokenized assets. In an update issued on October 30, the company said it had allocated more than $6.34 billion to cover the losses. It said $5 billion of those funds are held in the same affected tokenized assets, equivalent to about 80% of the affected amount. It also said it had worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze the assets. About $3 billion had been frozen on-chain as of the update.
Binance said its initial investigation indicated that a compromised laptop may have been involved, but a subsequent investigation uncovered additional points of compromise. It added that, at that point, it had found no evidence that wallet private keys had been leaked. The company did not specify the full sequence of the attack in its update, and said the investigation was ongoing. The Associated Press, citing TRM Labs, estimated that the attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks, with most transfers occurring over about 20 minutes. The agency said the attack’s characteristics matched those of previous operations linked to North Korea, while its report attributed the February 2025 Bybit hack, which resulted in losses of $1.5 billion, to North Korea and the TraderTraitor group, citing the FBI.
The incident also affected decentralized lending markets. A wallet in the attacker group deposited 60 million USDT into the Aave V3 Ethereum Core market between 20:58 and 21:01 UTC on October 29, and borrowed 19,762 WETH, valued at about $44.6 million. Aave’s risk report said this occurred about 40 minutes before the first freeze. The report said the attacker’s only position on Aave across networks and versions consists of $59.9 million in USDT collateral against $43.8 million in debt. It described the position as overcollateralized and still subject to normal liquidation. The report added that the position does not put Aave suppliers at risk.
Aave froze 175 reserves in V3 across 16 networks and 117 reserves in V4 across four networks. It kept the Horizon market for tokenized real-world assets open because its collateral is permissioned and cannot be used by the attacker, according to the risk report. The freeze allowed users to repay and withdraw, and liquidations continued, but it prevented the opening of new supply or borrow positions and the addition of collateral. As a result, repaying debt was the only way to raise the position’s health factor during the freeze. Aave published a plan to reopen reserves in four waves, starting with the unfreezing of V3 reserves while temporarily keeping the LTV value at zero; the plan also includes reopening V4 reserves while keeping the collateral factor at zero for assets on the specified watchlist.
Cryptocurrencies and sector-linked stocks fell on October 30. A Reuters report said bitcoin hit a six-week low and was down 3% at $76,469.82, while ether fell more than 3% to $2,185.83. According to Aave’s risk report, ETH and BTC were down about 4% from the time funds were withdrawn by 00:55 UTC on October 30. AAVE and LINK fell about 9% each, UNI about 8% and ARB about 6%, according to the same report. Reuters also reported that Coinbase shares fell 4.8% and Strategy shares about 6% in extended U.S. trading.
The Associated Press said Circle had frozen assets worth more than $800 million linked to the incident in coordination with law enforcement, and that Tether had frozen the equivalent of more than $1.5 billion. In its update published on October 30, Binance said it aimed to begin resuming withdrawals in about 34 hours, in stages and after completing security checks. It added that it planned to conduct an initial proof-of-reserves snapshot within 12 hours, with the result expected to be ready by November 2, 2026. These are target timelines the company announced for restoring service and publishing reserve data. U.S. President Donald Trump said, according to the Associated Press, that U.S. officials were investigating the hack. Asked about possible North Korean involvement, he said: "We’re looking into that."