Binance reported unauthorized withdrawals and put its preliminary loss estimate at $6.3 billion. Around $3 billion has been frozen on-chain, and the investigation is ongoing.
TL;DR
Some of the assets have been frozen. For the market, the key developments now are the resumption of withdrawals and further movements of the attacker’s coins.
Binance Hack: $6.01B Stolen, $2.80B Frozen
According to Arkham, $6.01 billion was withdrawn from Binance wallets across nine blockchains between 20:10 and 23:05 UTC on October 29. Of that amount, $2.80 billion has been frozen. These figures differ from Binance’s preliminary estimate, so combining them into a single calculation of the remaining losses would be incorrect.
Binance’s preliminary findings suggest the attacker may have accessed an internal service through a compromised DevOps engineer’s laptop. The exchange has so far found no evidence of a private key leak. Binance has pledged to cover the losses using SAFU and company funds and to publish an updated Proof of Reserves once remediation is complete.
Binance Hack Transaction Patterns
Julio Moreno’s analysis compares the October 29 transfers with large Binance withdrawals over the previous three months. On Bitcoin, the coins were split across new addresses in successive batches of 1,000 BTC. On Ethereum, a batch withdrawal of roughly 167,000 ETH stands out, while on USDT, the notable transfer was 1.615 billion tokens sent to a new address.
The comparison shows that these transactions differ from Binance’s usual large withdrawals in their structure, recipients, and transfer sizes, supporting the conclusion that the movements were abnormal.
Protect capital first. Capture upside second - start 7 days free. Built for long-term investors who want performance, not stress.
FAQ
Have the frozen funds already been returned to Binance? No. Freezing restricts further movement of the assets. Their return requires separate confirmation.
Have the withdrawn coins already been sold? No, these transfers do not establish that. Moving coins to a new address does not by itself mean they have been sold, so the full amount withdrawn cannot be treated as supply already sold into the market.
Conclusions
Binance has pledged to cover all losses, but the investigation and service restoration are still underway. According to the latest update, deposits are operating normally, while withdrawals remain suspended; the exchange expects to resume them within 48 hours. I am watching for the actual resumption of withdrawals, updated reserves, and movements of the stolen assets. Further swaps or sales of coins still accessible to the attacker could put additional pressure on the market.
Live Charts
Explore the metrics behind this brief with live, auto-updating charts:
Exchange Netflow - Net BTC moving to and from exchanges across positive and negative flow regimes.
Coinbase Premium Index - Coinbase vs global market premium as a proxy for US spot demand pressure.
Fear & Greed Index - Composite market sentiment for risk appetite and sentiment extremes.