EL7.AI
CryptoMedium•30 October 2026•
4 min read

Binance Hacker Holds $3.23 Billion in Assets That Cannot Be Frozen

Key Facts

1Elliptic estimated the value of assets stolen from Binance on October 29, 2026, at $6.43 billion, compared with Binance’s estimate of an impact of about $6.3 billion.
2Elliptic confirmed that $2.84 billion, or 44% of the theft’s value, had been frozen as of October 30, 2026; Binance estimated the frozen amount at about $3 billion.
3Elliptic estimated that about $3.23 billion in assets that cannot be frozen remained under the attacker’s control as of October 30, 2026.
4Binance allocated more than $6.34 billion to cover the losses, including $5 billion in the affected assets themselves, according to its October 30, 2026, announcement.

The attacker who targeted Binance’s hot wallets remained in control of an estimated $3.23 billion in crypto assets that cannot be frozen by a centralized entity, according to an Elliptic update on October 30, 2026. The company’s analysis valued the stolen assets at $6.43 billion, while Binance said the hack’s impact was about $6.3 billion. Elliptic confirmed that $2.84 billion had been frozen, equal to 44% of the theft’s value by its estimate, while Binance said about $3 billion had been frozen. The breach occurred at about 20:05 UTC on October 29, according to Binance, when its hot wallets were compromised. The figures highlight a race to freeze assets whose issuers can intervene, while funds move into assets that no centralized issuer has the authority to halt.

Elliptic said the assets that remained under the attacker’s control were spread across dozens of addresses and included 519,104 ETH worth $1.15 billion, 18,270 BTC worth $1.39 billion, as well as 233 million XRP and about 575 million TRX. These are estimates of balances that a centralized issuer cannot freeze, not the total funds unrecovered by any means. Among assets that can be frozen, the stolen USDT reached the attacker’s main wallet on the Ethereum network at 20:24 UTC on October 29. Tether froze the wallet 37 minutes after it arrived, and Circle froze $823 million in USDC in the same wallet three minutes later. The moves show how issuers could intervene in balances within their control, while other assets remained outside that mechanism.

Four assets accounted for 74% of the theft, according to Elliptic: USDT on Ethereum, BTC, USDC and USDT on Tron. A single transaction moved $2.53 billion at 20:24 UTC, equal to two-thirds of Ethereum losses. After some stablecoins were frozen, a second attacker wallet deposited 59.9 million USDT as collateral on Aave and borrowed 19,762 ETH. Elliptic said the loan remained outstanding and close to liquidation, while Aave froze the relevant markets. This route differs from moving funds between chains: Elliptic documented borrowing against collateral and did not specify that the purpose was to move the funds.

Binance said it would cover the losses from its SAFU fund and company funds, and had allocated more than $6.34 billion for that purpose. The company said $5 billion of the amount was held in the affected assets themselves, including USDC, USDT, BTC, ETH and BNB, covering about 80% of the affected amount by its estimate. The exchange temporarily suspended withdrawals to conduct security reviews, implement remedial measures and verify the integrity of affected systems, while saying deposits and other unaffected services continued to operate. Binance’s announced compensation reserve therefore differs from the funds Elliptic said had been frozen by entities able to halt some assets. Binance said its investigation was ongoing and that, as of the update, it had found no evidence of a leak of the wallets’ private keys.

The incident also affected trading, with Bitcoin falling to a six-week low, down 3% to $76,469.82, while Ether fell more than 3% to $2,185.83, according to Reuters. In extended U.S. trading, Coinbase shares fell 4.8% and Strategy shares about 6%. Reuters quoted an analyst at HashKey as saying that any disruption to Binance deposits and withdrawals could affect market makers’ ability to move capital between trading platforms. That puts the withdrawal suspension at the center of market monitoring of the incident, alongside direct losses and the movement of assets between wallets. By comparison, Bybit suffered a hack in February 2025 that resulted in losses of $1.5 billion, while analytics firms described the Binance breach as the largest recorded in cryptocurrency thefts.

Elliptic said transfers between blockchains began on October 30, and the rate at which TRX left the addresses it tracks more than doubled during the evening. The report estimated that between $20 million and $36 million in TRX had left those addresses by the evening of October 30. The company expects the assets to pass through wallets, bridges, mixers and swaps before attempts to convert them to cash through over-the-counter brokers and trading platforms. Elliptic cited the Bybit hack, saying laundering linked to it took months and that it expects a similar path here. Binance said it aimed to begin resuming withdrawals within about 34 hours of its announcement on October 30, subject to completing security checks, and expected to publish further technical findings about 48 hours later after verification.