October 31, 2026
Binance Sets Aside $6.34 Billion: What the Exchange Has Said, and What It Hasn’t
Two days after the largest theft in crypto history, Binance has moved from “a potential security issue” to a number. The exchange puts the…
By Provenance
1 min read
Two days after the largest theft in crypto history, Binance has moved from "a potential security issue" to a number. The exchange puts the impact at about $6.3 billion and says it has set aside more than $6.34 billion to cover losses. According to CoinDesk, about $5 billion of that is already held in the affected cryptocurrencies, and Binance is buying the remainder through markets and private trades.
The headline reassurance is real but narrow. It means Binance intends to make customers whole from its own resources. It does not mean the problem is contained. Withdrawals remain suspended while security checks continue. Binance plans to publish updated proof-of-reserves results on Monday, November 2, which will be the first independent-style test of whether the reserve matches the pledge.
On cause, Binance's story has shifted. Its initial explanation pointed to a compromised engineer's laptop. A Friday update said investigators found additional entry points. Binance says it has found no evidence that wallet private keys leaked. That sits uneasily with the early on-chain reading that the attacker abused an EIP-7702 delegation with a compromised key. The two are not necessarily in conflict, since a compromised workstation can reach signing infrastructure without exposing a key, but the mechanism is not yet public.
The recovery picture is partial. Elliptic has verified $2.85 billion in frozen or seized funds, about 44% of the theft, and 94% of that is stablecoins. Binance cites about $3 billion frozen as of Saturday morning in Asia. The gap is small and likely reflects timing. What remains is the harder part: Elliptic estimates the attacker still controls about $3.21 billion in assets that no issuer can freeze, such as ETH, BTC, XRP and TRX.
Attribution is firming but not final. TRM Labs links the attack "with high confidence" to the North Korean group TraderTraitor. Elliptic calls it likely. No government has confirmed it, and Binance has not named an attacker.
For users, the practical questions are timing and scope: when withdrawals resume, in what order, and whether the November 2 reserve figures hold up. For the industry, the lesson echoes Bybit in 2025. The attack surface was the people and systems around the wallets, not the cryptography.