Six point three billion dollars is Binance's own estimate of what left the exchange, and the crypto market answered with a 3.7% slide on Friday, October 30.
Bitcoin hovered around $77,000, Ether near $2,220, and BNB close to $700. By the company's own figure this is the largest exchange theft on record. The price action reads like a market still working out how much of the damage is real and how much can be recovered.
Where prices landed
The selling was broad. According to Cointelegraph's market report, BNB fell more than 8% over 24 hours to about $693, Bitcoin shed 4.8% to roughly $77,131, and Ether lost 5.7%. Tickers on the same pages showed smaller moves over a shorter window: Solana near $95.80, XRP at $1.24, Dogecoin around $0.075.
DeFi took harder hits than the majors. Aave's token dropped 11.3% to $118.54, and Uniswap's UNI fell 10.4% to $6.48. Aave also froze new deposits and borrowing on its community-operated V3 and V4 markets, which it framed as a precaution and not a response to any flaw. Its position is that the underlying contracts are intact; existing users retain the ability to pull funds out and pay down loans.
Sentiment followed. The Bitcoin Fear and Greed Index slid to 30, which puts it in "fear" territory and marks its weakest reading since August 14. That is not panic, though it is something close to a sulk.
One oddity from the tape: THORChain's RUNE jumped 13% on the news. Hacks that push stolen funds across chains tend to produce odd winners. Two readings are available, laundering flows or plain speculation, and nobody has said which it is.
What Binance says it has covered
The exchange's message has been consistent: users will be made whole. Binance said it has earmarked more than $6.34 billion of company money for the shortfall. Of that, $5 billion already sits in the same tokens that were taken. The remainder is being bought on exchanges and over the counter, and Binance warned that thin liquidity and OTC settlement times could slow some of those purchases.
Co-CEO Yi He said the exchange is buying altcoins in amounts that match what was stolen while it prepares an updated proof of reserves. She also pointed out that Binance's SAFU fund and corporate holdings include large amounts of Bitcoin and Ether. A spokesperson told Cointelegraph the $5 billion is held in Binance's custody but declined to share wallet addresses for security reasons, and the company hasn't said when it acquired those assets.
That last gap matters, because a reserve claim that cannot be checked remains a promise until someone can verify it. The updated proof of reserves, whenever it lands, is the document to read.
Then there is the frozen money. Roughly $3 billion has been locked by industry partners, up from an initial $2.54 billion. The list in Cointelegraph's live tracker is mostly stablecoins and tokenized assets: USDT, USDC, Ripple's RLUSD, World Liberty's USD1, StraitsX USD, Wrapped Beacon ETH, Tether Gold, Pax Gold, Pax Dollar and ARB. Issuers can freeze those. Nobody can freeze Bitcoin, which is one reason this is a stablecoin-heavy story.
Operationally, deposits are running normally. Withdrawals were halted during security checks, and Binance has said they should resume within 48 hours. About $6 billion flowed out of the exchange in the past day, per DefiLlama, against $134 billion in total assets, so on paper the run risk looks manageable.
Who did it, and how
Cybersecurity analysts suspect North Korea's TraderTraitor group. This is attribution by analysts and not a government finding, and it should be treated as such for now.
The method is murkier. Binance first pointed to a possibly compromised engineer's laptop. It has since said investigators found "additional points of breach," a polite way of conceding that the first answer was too small. The company says it is still gathering facts alongside law enforcement.
There is also an Ethereum angle, and it admits of two readings. Blockaid CEO Ido Ben-Natan told Cointelegraph that attackers could have drained the funds without the EIP-7702 upgrade, but that it may have let them slip past security checks and move everything in one sweep instead of many transactions. He said compromised signing systems most likely enabled the theft. Ambire CEO Ivo Georgiev agreed other routes were possible and added a warning: engineers who regain control of their systems can forget to revoke malicious EIP-7702 delegations. A cleanup that leaves the back door ajar is an unpleasant prospect.
The laundering has already started
Chainalysis says its investigators are seeing "never-seen-before laundering patterns" in the stolen funds. The volume, thousands of transactions in a short window, points to automation. Funds circulate among a set of addresses, and in some cases land back in a wallet that already appeared earlier in the chain. The firm's read is that the aim is to bury the trail in noise.
If that holds, the frozen $3 billion is probably the best recovery Binance gets, and the rest becomes a chase.
The FBI and the long game
In a post on X, Binance described a joint effort with law enforcement to claw back the frozen funds, and a source told Cointelegraph the FBI is involved. The FBI cooperation hasn't been confirmed by the bureau, which had not replied to a request for comment at publication. Binance didn't name the agencies it is working with.
There is precedent for patience paying off. In February 2022 the US Justice Department announced the seizure of 94,000 BTC, worth $3.6 billion then, tied to the 2016 Bitfinex hack. Against that, six years is a long wait, and that case involved coins that stayed put. These funds are moving by the thousand transactions.
One regulatory detail is worth filing away. Binance says that every week it files a report on its corporate funds with the Financial Services Regulatory Authority in Abu Dhabi, an obligation that existed before the hack. At least one supervisor, then, has had a view of the books.
What to watch next
Three things will settle whether Friday's 3.7% drop is a one-day flinch or something longer.
First, the withdrawal restart. If it happens on schedule and the queue clears without drama, the run-risk argument fades quickly. A delay would change the tone.
Second, the updated proof of reserves. Binance has promised it once the replacement token purchases are done. Those OTC trades in thin markets could also move prices of the affected altcoins, a risk the exchange has partly flagged itself.
Third, the investigation. The breach-point count has already grown once. If a third or fourth shows up, expect other exchanges to start auditing their own signing infrastructure, and expect the EIP-7702 debate to get louder. Nobody has said yet whether the attackers still have access.