Binance Hack, Day Two: $6.34 Billion Set Aside, North Korea Blamed, and a Spat With Elon Musk

A day after the biggest crypto theft on record, Binance, the world's largest cryptocurrency exchange, says it has the money to make every customer whole and has started doing it. On Friday 30 October 2026 it said it had set aside more than $6.34 billion of its own funds, that $5 billion of that was already held in the exact coins the thieves took, and that it was buying the rest on the open market.

The day also changed the story of how the theft happened. Binance's first explanation, a single engineer's hacked laptop, gave way to "additional points of breach". Three blockchain tracking firms pointed at North Korea. And Binance's founder, Changpeng Zhao, known as CZ, ended up asking Elon Musk in public to stop making jokes about it.

The first day of the story, from the first missing coins to Binance's $6.3 billion estimate, is in the earlier CMZ report on the hack.

Paying customers back in the same coins

Customers who kept coins on Binance hold a claim on those coins, the way a brokerage customer holds a claim on shares in an account. When the thieves emptied Binance's hot wallets (the internet-connected accounts an exchange uses to pay out withdrawals, like the cash drawer in a shop), the exchange was left holding fewer coins than it owed.

Binance's answer, posted at 10:55 UTC, was to refill the drawer coin for coin. "Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted," it said. For the rest it is "buying token assets through market channels and OTC channels", meaning large private trades arranged off the public order book. It warned this "can take longer because some tokens may have low liquidity". Its co-founder Yi He said the exchange was buying "all the stolen altcoins in fully matching amounts". Binance said the figures leave out the roughly $3 billion that has been frozen, and that it will publish a fresh proof of reserves, a public check that its holdings match what customers are owed.

Customers still cannot take money out. Deposits work. Yi He said at 04:17 UTC that Binance expected to "begin resume withdrawal services in the next 48 hours", and at 08:47 the exchange said it was on track to reopen withdrawals "in 45 hours". Both point to the early hours of Sunday 1 November, UTC.

Where the money will come from was the subject of a separate exchange on X. CZ, who no longer runs Binance but is its largest shareholder, wrote: "Rough math: $6.x b hack, $3b frozen, $1.x b SAFU fund. Gap is about $2b". SAFU is Binance's emergency fund for customers. Yi He told him the company's revenue for the year "is sufficient to cover the losses".

The story of how it happened changed

At 02:25 UTC Binance said the attack "may involve a compromised DevOps engineer's laptop" and that it had found "no evidence of any wallet private key leak". By 04:36 it said the incident "stems from multiple factors". At 08:47 it went further: "our subsequent investigation has uncovered additional points of breach. This was a complex attack."

A Binance staff account wrote that the attack was not one hacked computer moving the money, nor "a single person's 'one-click operation'", and that "the investigation has not attributed responsibility to any individual; the company will bear responsibility."

The fullest outside account came from TRM Labs, a blockchain analysis firm. It found the thieves could sign transactions on 10 different blockchains, each a separate network with its own coins. About $3.79 billion was taken on Ethereum, about $1.47 billion in bitcoin, $628 million on Tron and $296 million on the XRP Ledger, with smaller sums on Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. That settles a question left open on day one: the bitcoin and Tron withdrawals were part of the attack.

©CMZ chart. Data: TRM Labs

TRM's timeline also moves the start earlier. The first coins left five Binance wallets on the XRP Ledger at 20:05 UTC on 29 October, about 15 minutes before the Ethereum transaction that was first reported. The thieves had prepared for at least 36 hours, drawing money through Tornado Cash, a service that hides where coins come from, from 28 October.

One point does not fit. Binance said on Friday that "the outflows ceased when we paused withdrawal service earlier." Binance first said withdrawals were paused at 22:15 UTC. TRM's records show further Ethereum sweeps at 22:39 and 23:56, and transfers on Avalanche and Polygon at about 23:05. Those later sweeps came from a wallet already handed to the attacker's program, so both statements can be true at once, but Binance has not explained the gap.

North Korea, again

No government has named the thieves. The companies that trace crypto have. TRM Labs said it attributes the attack to TraderTraitor, a North Korean state hacking unit, and that "We make this judgment with high confidence." Elliptic, another tracing firm, said it had attributed the theft to North Korea, adding that "No government or law enforcement agency has confirmed attribution." Chainalysis's chief executive Jonathan Levin also pointed to TraderTraitor, according to Cointelegraph.

The investigator ZachXBT found that money from Binance and money from the $387.5 million theft at the exchange Bitget in September had been mixed at the same address after passing through THORChain, a service that swaps coins between blockchains. The FBI blamed TraderTraitor for the $1.5 billion Bybit theft in 2025, and Bitget's theft was linked to the same group. Elliptic added a caution: the shared address "proves that the two thefts share a laundering network, but not necessarily that they were carried out by the same hacker."

Reuters reported, citing a person familiar with the situation, that Binance is working with the FBI and the US Secret Service. Binance itself has said only that it is working with "law enforcement". Neither agency has commented.

CZ asks Elon Musk to stop

On 28 October, the day before the theft, CZ had posted a warning: "Do NOT click links in emails. Do NOT download attachments." After the theft, Elon Musk, the owner of X, quote-posted a report of the hack with "Everyday is Zeroday", replied to that old warning with laughing and fire emoji, and answered another user's "bruh" at CZ with a grimacing one.

CZ replied at 08:20 UTC on Friday that "The hack is more complex than that, but all hacks generally have a compromised device (or algorithm) at some point." An hour later he wrote: "Elon, have a lot of respect for you, but bad time to troll. Please stop. Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support." CZ says those SpaceX shares came from Binance's $500 million investment in Musk's 2022 purchase of Twitter.

Yi He then answered CZ in public: "Reporting to the major shareholder: Our company's revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on." CZ replied with a laughing emoji that he had only been showing Musk "some funds that he might know, so that he can be less worried." By midday UTC, Musk had not answered.

What is still unknown

How the thieves got signing power on 10 blockchains at once. Whether any of the frozen $3 billion comes back to Binance, and when. Whether withdrawals reopen on time on Sunday. Who the attackers are, in the view of any government. Binance has promised a full report on the root cause.