Binance Hack, Day Three: Exchange Takes 'Full Responsibility' as Withdrawals Set to Return

On the evening of Friday 30 October 2026, the two chief executives of Binance put their names to a promise. A notice titled "Security Incident Update #2", signed "Yi and Richard, Co-CEOs of Binance", said the world's largest cryptocurrency exchange had already covered about 80% of the $6.3 billion taken from it the day before, in the same coins, and that it aimed to start reopening withdrawals within about 34 hours. "We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected," it said.

The same day, the American agencies that chase stolen money went on the record. The FBI said it was "aware of the incident", and the US Secret Service said its investigators were "working around the clock" alongside federal prosecutors. No government has said who did it.

The theft began at about 20:05 UTC on Thursday 29 October, when Binance's hot wallets were emptied across 10 blockchains. The first day of the story traced it to an engineer's hacked laptop; the second brought "additional points of breach", $6.34 billion set aside to repay customers, and three tracking firms pointing at North Korea. Both are in the earlier CMZ reports.

The countdown to Sunday

Binance customers hold a claim on their coins, as a brokerage customer does on shares. The hot wallets that were emptied are the exchange's internet-connected accounts for paying out withdrawals, the cash drawer of the shop. Binance says it has refilled most of the drawer coin for coin. Of the more than $6.34 billion it has set aside, $5 billion is held "in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB". "This means that we have already covered approximately 80% of the impacted amount," the notice said. The other 20% is being bought "through market and OTC channels", meaning large private trades arranged away from the public order book, like a block trade between brokers.

Withdrawals are still frozen; deposits have worked throughout. The notice said "the tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach." Counted from 19:33 UTC, when the notice went up on Binance's website, that points to about 05:30 UTC on Sunday 1 November. Binance has not said which coins or networks come back first.

The second promise is a Proof of Reserves: a public check that an exchange holds at least as many coins as it owes its customers, like an auditor counting a bank's vault against its book of deposits. Binance said it would "run an initial Proof Of Reserves snapshot in 12 hours", which means about 07:30 UTC on Saturday 31 October, "and have the result ready by Monday 2026-11-02". Binance's checks come with a Merkle tree, a sealed list of every balance that lets each customer confirm their own account was counted without seeing anyone else's.

What Binance now says about the attack

In a video posted at 14:32 UTC on Friday, co-chief executive Richard Teng added three details. "This was not carried out by one person," he said. "The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate." It is the burglar who takes the CCTV tapes, and his own tools, on the way out.

The third detail concerns EIP-7702, a feature of the Ethereum blockchain that lets an ordinary wallet hand its powers to a program, much like signing a power of attorney. Teng said the attacker used it "to obtain on-chain execution approval over a hot wallet", and added: "That delegation did not pass through our normal approval controls." The power of attorney was granted without the sign-offs Binance normally requires before anything can move money. That, he said, is why withdrawals are paused: the company has to "investigate, rebuild, and retest the entire infrastructure system."

The signed notice repeats that Binance has "found no evidence that wallet private keys were leaked", the master passwords that control the wallets, and says "further technical findings" will follow "within about 48 hours", which would be around Sunday evening UTC.

Co-founder and co-chief executive Yi He spoke in a Chinese-language video at 15:23 UTC. The only English version is a translation by a community member, @wolfyxbt, which she reposted with a heart; it is not her own text. In that translation she says it was "a highly sophisticated, multi-layered attack", and: "Of course, we fell short in many ways. We should have invested more in security, earlier, and set stricter standards."

Washington on the record

The FBI told the trade publication Cybersecurity Dive that it was "engaged with relevant public and private partners to understand the scope of the activity". Tom Lynch, a spokesperson for the Secret Service's Washington Field Office, said its investigators were working with partners "to identify, freeze, trace, and recover" the stolen money, and with federal prosecutors "to identify the cyber criminals responsible and bring them to justice." Bloomberg reported the same statements.

Neither agency named a suspect. The tracing firms already have: TRM Labs attributes the theft "with high confidence" to TraderTraitor, a North Korean state hacking unit, and Elliptic and Chainalysis also point to North Korea. After the $1.5 billion theft from the exchange Bybit on 21 February 2025, the FBI named TraderTraitor five days later.

Asked in the Oval Office on Friday whether North Korea was behind it, President Donald Trump said: "We don't know. We're looking at that," according to Anadolu Agency and The Hill. Michael Selig, chairman of the Commodity Futures Trading Commission (CFTC), the US regulator for futures markets, told CNBC that "The real issue here is that these are unregulated offshore exchanges". He said the theft proves the case for a CFTC proposal from 5 October that would let offshore exchanges register in the US, voluntarily.

Where the money is

Elliptic said that at 19:30 UTC on Friday, at current prices, the attacker "controls around $3.23 billion of assets that cannot be frozen by an issuer", including 519,104 ether and 18,270 bitcoin. Digital dollars such as USDT and USDC, known as stablecoins, are issued by companies (Tether and Circle) that can freeze them. Binance says "Approximately $3 billion has been frozen on-chain to date." Bitcoin and ether have no issuer. They can only be followed. Elliptic's free blocklist of attacker addresses, which exchanges use to refuse the money, has grown to more than 1,000 entries.

Chainalysis said it was "observing laundering patterns we have not seen before" and that "Thousands of transactions in a short period suggest that the attackers are using automation." At 01:22 UTC on Saturday the tracking account Onchain Lens reported 120 million TRX, the coin of the Tron blockchain, worth about $38.78 million, being split again and again across new wallets. "They have not even started using mixers properly yet," it added.

Two small pieces of the loot show which coins can be clawed back. At 10:42 UTC on Friday, the governing body of Synthetix, a trading protocol, said it had recovered the SNX tokens stolen from Binance, about 8.4 million SNX worth about $1.55 million. The crypto news site PANews reported that it used its control over the contract that records SNX balances. The tokens "will be sent back to Binance on request."

NEWT, the token of the Newton Foundation, has no such control. At 12:58 UTC the foundation said the attacker, "apparently in error", had sent about 8 million NEWT and 17 other tokens, worth roughly $3.5 million, straight to the NEWT token contract, the code that runs the token. That contract has no owner and cannot be changed. "These tokens are now permanently locked. They are out of the attacker's control and can never be sold into the market." It is cash posted into a sealed letterbox that nobody holds a key to. The loss falls on Binance, which is covering customers anyway.

If TRM's attribution holds, 2026 is North Korea's biggest year. TRM counts about $12.8 billion stolen by North Korea-backed hackers across 100 incidents since 2017, $7.4 billion of it in 2026, and 85% of all crypto hack value worldwide this year, up from 7% in 2020. Chainalysis, counting from 2021, puts this year's share at nearly 89%.