Glowing trails of gold coins branching across a dark map, with some of the trails stopped by walls of ice
Original AI-generated illustration.

After the Freezes, Binance Still Has a $3.3 Billion Hole to Fill

NodeWitness Team 7 min read

The record theft from Binance has split into two piles. One is frozen and waiting on lawyers. The other, mostly bitcoin and ether, sits in wallets the attacker controls, and that is the part Binance will have to pay for itself.

Binance puts the total impact of its October 29 hack at around $6.3 billion and says about $3 billion has been frozen on-chain with the help of blockchain partners [1]. The exchange has pledged to cover the rest from its SAFU fund and company funds [1].

Outside counts land close by. Chainalysis puts the theft at $5.912 billion at the time of the transfers, and TRM Labs at about $6.36 billion across ten blockchains [2][3]. Our earlier piece traced how the money left. This one follows what happens to it next.

The frozen half

Stablecoins were the easiest part of the haul to stop, because their issuers can blacklist addresses in their own contracts. TRM counts about $2.67 billion frozen by Tether, Circle, Ripple and World Liberty Financial [2]. First Digital froze the stolen FDUSD, and the list of locked assets also includes USDT0, XUSD, WBETH and tokenized gold in XAUT and PAXG [3].

Arbitrum's Security Council moved 8,425 ETH and 74.6 million ARB into an intermediary frozen wallet that only the council or an Arbitrum DAO vote can release [3].

Getting that money back is a separate step. "A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord, TRM's global head of policy and a former federal prosecutor, told CNBC [4]. Law enforcement usually obtains a court order or seizure warrant before working with issuers to release or reissue the assets to their rightful owners, he said [4]. In other words, Binance's $3 billion is safe from the attacker, and it will reach the exchange's books on a court's timetable.

The other half

The money nobody can freeze is what matters for Binance's balance sheet. TRM puts it at more than 420,000 ETH and 18,270 BTC, about $2.4 billion [2].

The bitcoin is easy to watch. The attacker ran the 18,270.2 BTC through a peel chain, carving off 1,000 BTC at a time into fresh addresses [5][6]. We followed every output on mempool.space. The chain ends in 19 addresses, seventeen holding exactly 1,000 BTC, one with 832.5 BTC and one with 437.7 BTC, adding up to the original 18,270.2 BTC [5].

When we checked on October 30, none of the 19 had spent a coin, matching what CoinDesk saw a few hours earlier [5][6]. Binance's bitcoin cold wallet, as attributed by chain trackers, still held its 248,597.6 BTC [7].

The largest ether wallet is parked too. The address that received 195,460 ETH forwarded after the first sweep held 197,460 ETH on October 30 and had never sent a transaction [8]. Part of the attacker's ETH came from dumping USDT on market makers before the freezes, at a discount of more than 10% [2]. More came from a 19,762 WETH loan against 60 million USDT on Aave, which then froze 175 reserves on V3 across 16 networks and 117 on V4 [9].

Laundering and attribution

Laundering has already started at the edges. On-chain investigator ZachXBT found funds from this hack and from the earlier Bitget exploit commingled in a single address after arriving through THORChain, a cross-chain swap service, and said this points to the same actor [3].

TRM and Chainalysis attribute the Binance attack to North Korea's TraderTraitor, the group the FBI blamed for the 2025 Bybit hack [2][3][10]. That is the analytics firms' assessment. Binance has not named a culprit and says it is working with law enforcement to identify those responsible [11].

Can Binance absorb it

Binance says it will cover every loss and that user funds are safe [1]. Sean Farrell, head of digital asset strategy at Fundstrat, told CNBC the hack "does not currently appear to create meaningful solvency risk for Binance" [4]. He estimates about $3.3 billion remains unfrozen and puts SAFU at roughly $1.2 billion, enough for about a third of that, with company funds covering the rest if the frozen stablecoins eventually come back [4].

The reserves tell a tighter story for one asset. CoinDesk found that Binance 14, the drained Ethereum hot wallet, appeared in the exchange's October 1 proof of reserves, when Binance held exactly enough ETH to cover customers [12]. Losing about 204,500 ETH would leave ether backing near 94% until Binance replaces it [12].

The market and the counterparties

Bitcoin fell on Binance from about $80,850 before the attack to a low of $76,500 in the early hours of October 30, and was trading near $78,580 when this piece was written [13]. Ether fell nearly 7% and BNB, Binance's own token, nearly 9% over the same stretch [13]. The bitcoin Fear and Greed Index dropped from 51 to 30 in a day, its lowest reading since August [3][14].

Market makers Wintermute and GSR disclosed Binance exposure below 20% and 5% of net equity respectively, and said they expect no operational disruption [3].

What customers are waiting for

For Binance's users, the numbers boil down to a wait. As of October 30, withdrawals were paused while the exchange rebuilt its withdrawal service and related address controls, with a target to resume within 48 hours, and deposits were working normally [15]. FinanceFeeds noted that no regulator or government agency had commented publicly by its last update [15]. Binance has promised a full post-mortem and an updated proof of reserves once remediation is complete [1].

The 19 bitcoin wallets carry their own lesson. Anyone can see them, and no exchange, issuer or court can move a single coin out of them without the keys. For someone who holds bitcoin in a wallet of their own, that same rule is the protection.

The next test comes with Binance's November 1 reserve snapshot, which will show whether the missing ether has been replaced [12].

Sources

Source type in brackets. All times UTC. Accessed October 30, 2026.

  1. Binance, Security Incident Update, October 29, 2026. (Primary, company)
  2. TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, figures as of 00:30 UTC on October 30, 2026. Attribution is TRM's assessment. (Secondary, on-chain analysis)
  3. Cointelegraph, Felix Ng and Bryan O'Shea, Live updates: Binance $6.3B hack linked to North Korea's TraderTraitor, entries through 05:01 UTC on October 30, 2026. Chainalysis estimate, ZachXBT, First Digital, Arbitrum, Wintermute and GSR, list of frozen assets. (Secondary, press)
  4. CNBC, Jenny Lee, Binance's $6.3 billion hack: What we know and what comes next, October 30, 2026. (Secondary, press)
  5. mempool.space, our own trace from bc1q0mtc…2mnm to 19 funded addresses, including bc1qrg02…6zyt (832.5 BTC) and bc1qxg0l…s9ra (437.7 BTC). Total 18,270.2 BTC, no outputs spent as of 06:40 UTC on October 30. (Primary, on-chain)
  6. CoinDesk, Binance hacker took over 18,270 bitcoin that no one can freeze, October 30, 2026. The 19 wallets unmoved as of 04:23 UTC. (Secondary, press)
  7. mempool.space, address 34xp4vRoCGJym3xR7yCVPFHoCNxv4Twseo, attributed to Binance by chain trackers. Balance 248,597.6 BTC, last movement October 25, checked at 06:10 UTC on October 30. (Primary, on-chain; third-party attribution)
  8. Etherscan, address 0x8532…43D4. Balance of 197,460 ETH and nonce 0 read via RPC at 06:38 UTC on October 30. (Primary, on-chain)
  9. LlamaRisk, Binance Hot Wallet Exploit: Aave's Response, Aave governance forum, October 30, 2026. (Primary, protocol)
  10. FBI, North Korea Responsible for $1.5 Billion Bybit Hack, February 26, 2025. (Primary, government)
  11. BBC, Osmond Chia, Crypto giant Binance hit by hack suspected to be largest in history, October 30, 2026. (Secondary, press)
  12. CoinDesk, Binance says customer money is safe after huge hack drains key reserve wallets, October 30, 2026. (Secondary, press)
  13. Binance, hourly BTC/USDT, ETH/USDT and BNB/USDT candles from its public API from 20:00 UTC on October 29. BTC from $80,848.64 to a low of $76,500.11 and $78,582 at 06:40 UTC; ETH from $2,336.90 to $2,174.08; BNB from $744.90 to $680. (Primary, market)
  14. Alternative.me, Fear and Greed Index, 51 on October 29 and 30 on October 30, 2026. (Secondary, market data)
  15. FinanceFeeds, Binance Withdrawals to Resume Within 48 Hours, Deposits Back to Normal, October 30, 2026. (Secondary, press)

More in Price and market

See all 19 articles in Price and market →

Last updated: October 30, 2026