Binance hack affects $6.3 billion; Tron flows include $628 million

Key Facts

Binance said its hot wallets were hacked at about 20:05 UTC on October 29, estimating asset losses at about $6.3 billion. TRM Labs estimated that $6.36 billion was moved from the platform’s wallets to attacker addresses across 10 blockchains. The difference in estimates reflects differences in how parties calculated the value of assets linked to the incident. An Associated Press report described the incident as a candidate for the largest recorded cryptocurrency heist and reported that Binance said it would cover the losses and work to recover assets for users.

On the Tron network, TRM tracked flows of 612.7 million USDT and 46.4 million TRX, worth about $628 million at the time of the theft. Elliptic said a balance of 638 million TRX was split among 5 new addresses on the morning of October 30. TRX from two of those addresses moved to a single wallet, which began converting it to USDT and sending it through swap services and bridges. These movements show part of the assets linked to the attacker passing through more than one address and service. The tracking data alone do not prove that the transfers were intended to avoid freezing or that they caused TRX’s price movement.

EL7 closing data show TRX at $0.3272 on October 30, before it closed at $0.3178 on October 31. In the broader cryptocurrency market, an Associated Press report said Bitcoin fell 3.2% to below $79,000 on the evening of October 29, when reports of the hack emerged. Tether said it had frozen the equivalent of more than $1.5 billion in currency linked to a potential hack of Binance. Binance also said it had coordinated with blockchain partners to freeze about $3 billion on-chain.

Binance said about $5 billion of the allocated funds were in the same assets that were stolen, and that it would buy the remaining assets through the market and over-the-counter trading. In its third update on October 31, it said the share of losses covered had risen to 90% from about 80% in the previous update. It added that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully covered by reserves at 100%. Tokens outside the list of the top 10 assets make up the remaining 10%, and Binance said their lower liquidity could extend the time needed to buy the required quantities. The platform said it was targeting a gradual resumption of withdrawals on Sunday, November 1, 2026, and would publish a detailed technical report after reviewing the incident.

On the source of the incident, Binance said its preliminary investigation indicated the possible involvement of a DevOps engineer’s laptop. The company said it had found no evidence that private wallet keys had been leaked. It added that it would publish a detailed technical review after completing the investigation and verifying the facts. Until then, Binance said it would continue buying the remaining assets through market and over-the-counter channels until coverage reached 100% for all tokens. The announced date for withdrawals to resume remains Sunday, November 1, 2026.