Binance theft incident tracking

Crypto KOL Kuai Dong (entered the industry in 2016) stated that on-chain tracker ZachXBT speculated that the party responsible for the attack on Binance and the theft of $5.875 billion is the Lazarus Group, which is under the Reconnaissance General Bureau of the Korean People's Army.Kuai Dong also listed past theft results related to this organization, including approximately $300 million from Japan's DMM exchange, about $230 million from India's WazirX exchange, around $1.5 billion from Bybit, approximately $292 million from the on-chain protocol Kelp DAO, and about $380 million from Bitget.He also mentioned that Binance has recovered about half of the assets, but the recovery of Bitcoin, Ethereum, and others is more challenging, and stated that the hackers' ultimate goal is to funnel the assets into North Korea. ZachXBT responded in related discussions that this incident is likely related to the North Korean Lazarus Group. Public information shows that around October 30, there was a massive outflow of assets from Binance's hot wallets, with cross-chain statistics estimating between $5.5 billion to $6.2 billion. Zhao Changpeng stated that it indeed looked like they were hacked and mentioned that the actual net loss might be slightly above $1 billion, but they would cover the full amount.

According to the real-time display of "Customer Assets" on the Binance official homepage, the total assets of Binance customers are approximately $129.404 billion. Additionally, according to the information on the official page of Binance's proof of reserves, as of October 1, 2026, the reserve ratio of major assets is not less than 100%.Among them, the BTC reserve ratio is 100.35%, with a net account balance of 688,572.68 BTC and an on-chain wallet balance of 691,003.593 BTC; the ETH reserve ratio is 100.00%, with a net account balance of 3,799,136.43 ETH and an on-chain wallet balance of 3,799,139.752 ETH. The USDT reserve ratio is 103.88%, with a net account balance of approximately 32.028 billion and an on-chain wallet balance of approximately 33.271 billion; the USDC reserve ratio is 108.26%, with a net account balance of approximately 7.178 billion and an on-chain wallet balance of approximately 7.771 billion. The reserve ratios for BNB, SOL, and XRP are 100.47%, 100.00%, and 100.77%, respectively.Based on the current price, the total net balance is approximately $133.6 billion, and the total on-chain wallet balance is approximately $135.8 billion. Binance explains that the proof of reserves covers the custodial user assets, and the excess portion does not represent the total amount of the company's own assets; the "Customer Assets" on the official homepage is another display metric and is not the same summary table as the proof of reserves snapshot disclosed by asset type.

Binance released preliminary investigation results on its official X account, stating that the security incident may involve the laptop of a DevOps engineer being compromised. The attacker used this to access the service container and submitted unauthorized withdrawal transactions. Binance stated that there is currently no evidence of wallet private key leakage and will publish a detailed technical review after the investigation is complete and the facts are fully verified.Binance estimated the total impact of the incident to be approximately $6.3 billion. The platform has frozen related assets in collaboration with blockchain partners, with about $3 billion currently frozen on-chain. Binance stated that it will cover all losses through the SAFU fund and company funds, ensuring user fund safety, and will release updated proof of reserves after the resolution is complete.As an immediate measure, Binance has suspended deposits and withdrawals until security checks are completed, revoked the authorization of affected addresses, and has contacted law enforcement and blockchain intelligence partners to track and recover funds. Binance stated that the team is working with law enforcement partners to confirm the identities of the relevant individuals and reminds users to obtain updates only through official channels.

The founder of Liebit Mining Pool, Jiang Zhuoer, posted on platform X stating that Binance's potential losses account for a limited proportion of user assets and are not expected to trigger a large-scale withdrawal wave.He compared this situation to the Bybit theft incident in February 2025. At that time, Bybit was hacked for approximately $1.46 billion, which accounted for 9.01% of its roughly $16.2 billion in user assets. If Binance's gross outflow this time is $5.64 billion, of which $3 billion has been frozen, the remaining amount is about $2.64 billion, accounting for 1.6% of its approximately $165.12 billion in user assets.Jiang Zhuoer also mentioned that the gross outflow may include internal fund transfers within the platform and normal user withdrawals, and not all of it should be considered stolen funds. Binance has the capacity to absorb the related losses.

According to Onchain Lens monitoring, the Binance hacker has begun selling STRK, increasing market selling pressure.The total unrealized profit of two Hyperliquid traders' STRK short positions is 4.46 million dollars, with one having an unrealized profit of 1.61 million dollars and the other having an unrealized profit of 2.85 million dollars.

The cryptocurrency KOL Seven research stated that currently, the majority of the major funds and main margin accounts of market makers and quantitative institutions in the cryptocurrency market are on Binance. Many institutions are engaged in cross-exchange arbitrage or hedging, and the suspension of withdrawals by Binance could lead to a sudden halt in their capital chain.Seven research mentioned that if the market continues to fluctuate violently, relevant institutions will be unable to withdraw funds from Binance to supplement margins elsewhere. To prevent liquidation, they will be forced to close positions on other exchanges and on-chain, forcibly pulling cash back. They also indicated that this is why the stolen assets were Ethereum-based, resulting in Solana and a bunch of altcoins dropping on the same day.

Steve Gregory, the CEO of Binance.US, stated that the funds of Binance.US users are completely independent and not affected by this incident. He also emphasized that Binance.US and Binance are entirely separate entities, and there are no shared asset custody arrangements between the two.

According to Lookonchain monitoring, after the Binance attacker completed the sale of all 217.5 million ENA (worth 33.93 million USD), another trader began to go long on ENA.A newly created wallet address (0xedc0) deposited 2 million USDC into Hyperliquid and opened a long position of 22.78 million ENA with 3x leverage, worth approximately 4.09 million USD.

On October 30, the official X account of the cryptocurrency exchange Binance stated that Binance will bear all losses. As a precautionary measure, the platform has temporarily suspended all deposits and withdrawals while the team conducts security checks, freezes relevant funds, and collaborates with law enforcement.Binance stated that the team is continuously advancing the handling work, and a complete review will be published after the investigation is completed. Users are advised to obtain information only through official Binance channels. Earlier that same day, Binance mentioned that it was investigating potential security issues and updated that the total amount of verified frozen assets is approximately 3 billion USD. The team is still tracking and freezing more assets in collaboration with law enforcement, issuers, on-chain intelligence agencies, and industry partners.