Last night, I finished the article about the Binance hack with five unanswered questions. Twenty-four hours later, almost all of them have been answered, and the most important one—whether your money is safe—has received an official answer from the company. But one important piece of evidence is still missing, and I’ll show you what it is.
Reporting conducted on the afternoon of 30/10/2026, with data up to around 4:30 p.m. Brasília time. The story is still developing, and the figures may still change.
Quick update
• Binance confirmed the size of the theft: about US$6.3 billion, the biggest crypto hack in history in dollar terms.
• The company says the stolen money was its own, from the hot wallet, and not customers’. It set aside more than US$6.34 billion from its own cash to cover everything.
• About US$3 billion has already been frozen by stablecoin issuers and partners.
• Withdrawals remain paused. Binance’s forecast is to reopen by Sunday (11/1).
• The full proof of reserves comes out on Monday (11/2). That’s what will confirm whether the promise holds up.
What changed in 24 hours
In yesterday’s article, I listed what we still didn’t know: the real amount, how the attacker got in, when withdrawals would resume, how much of the frozen funds would be recovered, and whether the coverage promised by CZ would become an official commitment. The table below shows what it was yesterday and what it is today.
Yesterday’s five questions and today’s answers.
How much left and from where
Binance estimated the total impact at about US$6.3 billion. TRM Labs, a company that tracks blockchain transactions, arrived at US$6.36 billion, counting the value of each coin at the time it left. The money came out of 10 different networks, most of it in about 20 minutes, starting at 5:05 p.m. on Thursday (Brasília time).
Based on the figures released so far, there were about US$3.79 billion in Ethereum, US$1.47 billion in Bitcoin, US$628 million on the Tron network and US$296 million in XRP, plus smaller amounts on other networks. For comparison: the Bybit hack in February 2025 was about US$1.5 billion. This one is more than four times larger.
Decrypt headline (our translation and highlight). Source: Decrypt, 10/30/2026.
How the hacker got in
Richard Teng, Binance co-CEO, explained it in two moments. In the early hours, he said the initial investigation pointed to the compromised laptop of an engineer on the infrastructure team. That access led the attacker to an internal system from which unauthorized withdrawals were made. He also said there is no evidence of any private wallet key being leaked.
Post by Richard Teng on X (translated, highlighted excerpts). Source: Richard Teng on X, 10/30/2026.
By late morning, Teng added that the investigation found other points of intrusion and that the attack was not carried out by just one person. The attacker used a new Ethereum feature called EIP-7702, which allows a wallet to delegate control to a contract. In practice, he managed to control the hot wallet without going through the normal approval controls. According to specialized media, there were 50 delegation attempts and one worked.
There’s more: according to TRM Labs, the attacker rehearsed the theft about 6 hours earlier, using small amounts in three new wallets, and funded the operation with money routed through Tornado Cash, a service that scrambles transactions. The tools used in the attack had a self-destruct mechanism that erased traces, which makes the investigation harder.
A simple comparison: the thief didn’t steal the vault key. He convinced the vault that he was authorized to open it.
Who is behind it
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a branch of North Korea’s Lazarus Group, with high confidence. Investigator ZachXBT said the same: it’s probably Lazarus. It’s the same group identified by the FBI in the Bybit hack, and the way the attack was prepared is similar.
But note: this is still not official. No government has confirmed authorship, and Binance did not name anyone. The company said it is working with authorities and tracing firms, and the press reported that the FBI is helping recover part of the funds.
What was frozen and what the hacker is doing
Binance says about US$3 billion has been frozen. Most of it came from stablecoin issuers: Tether froze more than US$1.56 billion in USDT and Circle about US$800 million in USDC. Arbitrum, World Liberty (USD1), Ripple (RLUSD), and First Digital (FDUSD) also froze amounts tied to the attack.
Post by CZ thanking Tether and Circle for the freeze (translated, highlighted excerpts). Source: CZ on X, 10/29/2026.
The limit is still the same as yesterday: Bitcoin and Ether can’t be frozen. That’s why the attacker is rushing. He swapped about US$325 million in USDT for ETH, accepting a loss of more than 10%, borrowed about 19,760 ETH on Aave using USDT as collateral, and moved more than US$1 billion in ETH to new wallets. Chainalysis sees an automated laundering pattern, with thousands of transactions in a short time. According to TRM, the attacker still holds more than 420,000 ETH and about 18,000 BTC, beyond the reach of freezing.
Aave briefly froze its markets as a precaution and has already lifted everything. Aave’s contracts were not affected.
What Binance promised
This is the biggest change since yesterday. Yesterday, what existed was CZ’s expectation, as a shareholder, that Binance would cover the loss. Today there is an official commitment. In a video posted on X, Richard Teng said Binance is committed to covering all losses from the hack with the company’s own resources.
Transcript of Richard Teng’s video (translated and highlighted excerpt). Source: Richard Teng on X, 10/30/2026.
• Coverage: more than US$6.34 billion set aside. Of that, US$5 billion is already in the same currencies that were stolen, such as USDC, USDT, BTC, ETH and BNB. The rest is being bought in the market and over the counter (OTC). The SAFU fund is also part of the coverage.
• Customer funds: according to Binance, they were never touched. Most are kept in cold wallets and only move to the hot wallet when someone requests a withdrawal.
• Deposits: working normally.
• Withdrawals: paused while Binance rebuilds and tests the system. The goal is to reopen by Sunday (11/1).
• Proof of reserves: a preview before then and the full report by Monday (11/2).
Teng explained why the company can handle a loss of this size: much of what Binance earns in fees is held in crypto, and it was not sold. CZ added that the exchange naturally accumulates the coins it lists, because users pay fees in them.
The point that still needs to be proven
Here I want to be honest with you. Binance says the stolen money was its own, not customers’. But CoinDesk analyzed the public reserve data and found that the affected wallets appeared in the list of wallets backing customer balances.
That doesn’t mean someone lied. It could just be how Binance organizes its wallets. But it shows why Monday’s proof of reserves is the most important data point of the week. If it shows that everything belonging to customers is still backed one-to-one or more, then the promise is confirmed with numbers, not just words.
CZ’s comparison
CZ, who no longer runs Binance but remains a shareholder, published a comparison worth understanding. In dollar terms, this is the biggest hack in history. In bitcoin terms, no: Mt. Gox lost 650,000 BTC, more than 5% of all bitcoin that existed. And at Mt. Gox and FTX, almost all customers lost money. Here, the platform says it will cover everything itself.
Post by CZ on X (translated, highlighted excerpts). Source: CZ on X, 10/30/2026.
The line that stuck was this: “It hurts, but we’ll survive.”
The market 24 hours later
Bitcoin was near US$80,800 before the attack. In the hour candle of the hack, it fell as much as 3.2%, and kept sliding: around 4:30 p.m. today it was near US$76,580, about 5% below where it was before the attack. Ether is near US$2,232 and BNB, Binance’s own token, near US$698, down about 6% in 24 hours.
Original Bitcoin chart, 1-hour candles, BloFin data, Brasília time.
According to CoinGlass, about US$1.53 billion in positions were liquidated in 24 hours, and 84% were bets on the upside. Nearly half of the liquidations happened inside Binance itself. The fear and greed index fell to 30, in fear territory.
Interestingly, Bitcoin fell less than many people expected for a hack this size. It stopped near the 200-day average, in the US$76,000 range, which is a level many analysts watch.
My opinion
Compared with last night, I’m calmer, but not 100%. What makes me calmer: Binance replaced expectation with an official commitment, said how much it set aside, in which currencies, and gave dates for withdrawals and for proof of reserves. A company hiding a problem usually doesn’t set a date to be checked.
What keeps me from saying everything is solved: a promise is not proof. Withdrawals still haven’t resumed and proof of reserves still hasn’t been released. And the point raised by CoinDesk needs to be answered with numbers. Until Sunday and Monday, I’m keeping an eye on it without panic and without euphoria.
And the usual lesson is even clearer: any exchange, no matter how big, can be attacked. An exchange is for trading. A cold wallet, where only you have the key, is for storing what you plan to hold for years. This is not investment advice, it’s risk management.
What to do now
• Don’t panic. Selling in a rush means selling near the bottom.
• Don’t try to force a withdrawal or open a support ticket for no reason. Wait for Binance’s official notice.
• If you use leverage, review your margin. Those traders lost the most in this drop.
• On Monday, check Binance’s proof of reserves.
• Think about how much you really need to keep on the exchange. Decide calmly, not out of fear.
Watch out for scams
Every big news story becomes bait. Fake “hack refund” links, fake “Binance support” on WhatsApp or Telegram, and messages asking to “unlock your withdrawal” will start appearing. Binance never asks for a password, 2FA code, or recovery phrase. And, according to the company itself, you don’t need to do anything to be covered. If someone asks for anything, it’s a scam.
What we still don’t know
• Whether withdrawals really resume by Sunday.
• What Monday’s proof of reserves will show.
• The full sequence of the attack, which will only come with the technical report promised by Binance.
• How much of the US$3 billion frozen will be returned, and how quickly.
• Whether the Lazarus Group attribution will be officially confirmed.
I did a live stream about this topic today on my channel, and I’ll bring the next update as soon as withdrawals resume. I learn, I teach, you really benefit.
And tell me in the comments: when withdrawals resume, will you take your money out of Binance, leave it as is, or withdraw only part of it? If this text helped you, follow the profile to keep up with the updates.
Sources: Binance, Richard Teng and CZ on X, CoinDesk, Decrypt, Cointelegraph, TRM Labs, Chainalysis, ZachXBT, CoinGlass and BloFin (prices). Reporting as of 10/30/2026. This text is informational and is not investment advice.