Binance's $1B SAFU Fund Faces a $6.3B Hack: How Much Must the Exchange Pay?
Share
Key Takeaways
Binance’s $6.3 billion security breach left approximately $3.1 billion in attacker-controlled wallets, according to early onchain tracing.
Investigators identified 18,270 BTC and more than 490,000 ETH in the attackers’ holdings, much of it remaining untouched after the theft.
Stablecoin issuers froze billions in stolen assets, but Bitcoin and Ether remain harder to immobilize without cooperation from exchanges.
Halloween arrived with a nightmare for Binance. Billions of dollars in cryptocurrency disappeared from the exchange’s wallets on Oct. 29, leaving investigators chasing funds across multiple blockchains.
But the most unsettling finding is not how quickly the money vanished. Much of it has barely moved since.
According to blockchain intelligence firm Bitquery, approximately $3.1 billion remained in attacker-controlled wallets as of 03:54 UTC on Oct. 30, with no identified transfers to exchanges, mixers or cross-chain bridges.
Nine chains impacted in under four hours. | Source: Bitquery
Meanwhile, Binance says approximately $3 billion in affected assets has been frozen. The exchange estimates the total impact at $6.3 billion and has pledged to cover losses using its SAFU emergency fund and company resources.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
Bitcoin accounts for one of the largest portions of the stolen assets still visible onchain.
Investigators traced approximately 18,270 BTC, worth around $1.4 billion at the time, into 19 addresses.
Seventeen wallets held exactly 1,000 BTC each, while two contained smaller balances. None had spent their Bitcoin as of early Friday, according to blockchain records.
Its transactions can be tracked publicly, but preventing further movement generally requires cooperation from exchanges, custodians, or other services where the attacker eventually attempts to trade or withdraw funds.
The inactivity creates an unusual situation: investigators can see much of the stolen Bitcoin, but visibility alone does not provide control over it.
Stolen ETH Holdings Grow to 490,361 as Hacker Swaps Stablecoins
Ethereum tells a different story. Bitquery estimates the attacker initially stole approximately 200,630 ETH but subsequently accumulated 490,361 ETH, around 2.4 times the original amount.
The increase came largely from converting stolen stablecoins and other tokens into Ether.
Some transactions involved decentralized trading infrastructure, including Uniswap, 1inch Fusion, and UniswapX. The attacker also reportedly used Aave to borrow ETH against stolen stablecoin collateral.
Six major Ethereum wallets had not sent any outgoing transactions as of Bitquery’s reporting cutoff. Two others remained active, converting additional tokens into ETH.
The holdings therefore reflect both Ether stolen directly and assets purchased with proceeds from the attack, not additional ETH taken directly from Binance.
$2.7B Frozen, but $729M in USDT Escaped First
Stablecoin issuers were able to intervene more directly.
Tether, Circle, and several other token issuers froze affected assets, while Arbitrum’s Security Council restricted additional funds.
TRM Labs estimated that approximately $2.7 billion was immobilized through these measures. Binance subsequently reported around $3 billion frozen.
An overview of the October 29, 2026 Binance hack in TRM. | Source: TRM Labs
However, investigators found that approximately $729 million in stolen USDT had already been exchanged for ETH and TRX before freezes took effect.
Bitquery reported that six of Tether’s 11 wallet freezes targeted addresses that had already been emptied.
The figures reveal the central challenge in responding to large crypto thefts: issuers may have the power to block tokens, but attackers can exploit the delay between detection and intervention.
Frozen assets are also not necessarily recovered assets. Returning them requires further technical, legal, or operational steps.
Can Binance Recover Its Halloween Ghost Wallets?
TRM Labs attributed the attack to North Korea’s TraderTraitor group with high confidence. Binance’s preliminary investigation instead focused on the possible entry point, a compromised engineer’s laptop that allegedly enabled unauthorized withdrawal instructions.
The exchange reported no evidence of leaked wallet private keys.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
The attacker also left substantial balances on other networks, including approximately 233.5 million XRP and 970,549 SOL, which Bitquery found untouched at its reporting cutoff.
The next test will be whether investigators can prevent those assets from entering trading venues or identify opportunities to recover them.
For now, billions in stolen cryptocurrency remain visible but largely inaccessible to their rightful owner.
Binance’s Halloween nightmare is not simply the money that disappeared. It is the money everyone can still see, but cannot yet retrieve.
internal-linking title=”Top Trending Crypto Articles” url1=”https://www.ccn.com/crypto-exchanges/” text1=”Check Out Our Recommended Exchanges Here” label1=”Best Exchanges” url2=”https://www.ccn.com/how-to-buy-crypto-with-credit-card/” text2=”How To Buy Crypto with a Credit Card Now” label2=”Buy Crypto Fast” url3=”https://www.ccn.com/crypto-gambling/” text3=”See Our Picks for the Best Crypto Gambling Sites” label3=”Safe Crypto Gambling”]
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
