Introduction
Short answer: on 29 October 2026, attackers drained Binance hot wallets across roughly 10 to 11 blockchains. Binance says the total impact is around $6.3 billion, which makes it the biggest crypto theft on record. About $3 billion has been frozen, mostly stablecoins, and Binance says it will cover customer losses from $6.34 billion it has reserved. Blockchain-analytics firms link the attack to North Korea, but no government has confirmed that.
Why should a bookkeeping and finance operations firm write about this? Not because FinanceBridge is a crypto expert. It is not. We do not trace, freeze or recover crypto, and nothing here is investment, tax or legal advice. We are writing about it because the story is a very loud lesson on things finance teams deal with every month: who can approve a payment, how quickly you notice something wrong, how much money sits with one provider, and whether you can prove a loss with paper.
How this article is organised: the first half is the practical part for businesses and accounting firms (control lessons, accounting treatment, tax by country, scams). The second half is a deeper dive into the Binance numbers: how big the loss is, who is suspected, what is frozen, whether the money can come back, and how Binance may absorb the loss. You can stop after the first half and still have the useful part.
Important: this story is still moving. Everything below is "as reported on 30 October 2026". Numbers, attribution and withdrawal dates may change. We will mark where something is a company statement, an analyst's view, or still unconfirmed.
Table of Contents
- What Happened, in Simple Words
- Five Control Lessons for Any Finance Team
- How Theft Is Treated in the Books
- How Tax Treats Theft Losses by Country
- A Warning About Recovery Scams
- What It Means for Customers and Businesses
- Deep Dive: The Binance Research (Numbers, Recovery and Reserves)
- How Big Is the Number? Why Sources Differ
- How Did the Attack Work?
- Who Is Suspected, and What Is Not Confirmed
- What Is Frozen, and Who Is Helping
- Can the Money Come Back?
- Our View: How Much Is Likely to Come Back?
- Can Binance Actually Afford It? What Is Public and What Is Not
- How Binance Will Likely Bear the Loss: Step by Step
- FAQ
- Conclusion
What Happened, in Simple Words
Binance is the world's largest crypto exchange. Like every exchange, it keeps some customer coins in "hot wallets". A hot wallet is connected to the internet so it can send withdrawals quickly. The safer option is a "cold wallet", which is kept offline.
On 29 October 2026, attackers got Binance's hot-wallet system to send out coins they should never have sent. Binance confirmed the loss on its own social media channels, putting the "estimated total impact" at around $6.3 billion. The story was also reported by Reuters, Bloomberg, CNN, CNBC and NBC News, and the loss was tracked on the blockchain by independent firms.
A rough timeline, as reported by TRM Labs and Elliptic (times in UTC, India time is 5 hours 30 minutes ahead):
- 28 October: the attacker's wallet received small amounts from a mixing service. This looks like preparation.
- 29 October, around 20:05 to 20:25: coins left Binance wallets on several blockchains, including XRP, Solana, Bitcoin, Tron and Ethereum.
- About 21:00: Tether and Circle, the companies behind the USDT and USDC stablecoins, froze large amounts. This was roughly 37 minutes after the main transfer, according to the analysis.
- Late on 29 October: a second wave hit Binance wallets on Avalanche and Polygon.
- 30 October, after midnight: Binance said it would cover all losses and paused deposits and withdrawals. Later it said its investigation had found "additional points of breach".
Five Control Lessons for Any Finance Team
You do not need to own any crypto to learn from this. These are the same controls we use when we help set up books, payments and approvals.
1. Treat laptops and logins as finance controls. Binance's first explanation points to one compromised engineer's laptop. In your business, ask who can approve or release payments from a laptop or phone, and what protects that device. Our guide to internal controls and fraud prevention for small business covers the basics.
2. Split the power to approve. No single person or system should be able to create, approve and send a payment. TRM's advice to treasury teams includes separating signing systems by tier and having a tested plan to cancel permissions quickly. The everyday version is a maker-checker rule on vendor payments. See our post on accounts payable and vendor fraud.
3. Reconcile often, not only at month end. Reports say the attacker kept sweeping new deposits for hours after the first transfer. A month-end check would find out weeks later. Daily or weekly bank and wallet checks with alerts on unexpected outflows shorten the time to notice. Start with our bank reconciliation best practices and the month-end bookkeeping checklist.
4. Do not keep everything in one place. Even the largest exchange got hit. If your company holds crypto, or large balances with any single bank, payment processor or platform, write down how much is held there and why, and set a limit. Concentration risk is a finance decision, not only an IT one.
5. Keep records you can prove a loss with. Save wallet addresses, transaction IDs, exchange statements, cost records and platform emails. Every tax rule in the tax table further below comes back to documentation. If you ever have to make a loss claim, or answer an auditor, good records are the difference between a claim and a guess.
One more habit worth copying is how to read breaking news numbers. When Binance, TRM, Elliptic and Chainalysis gave different totals, none of them was necessarily wrong. They used different dates and counting methods. When you report a number in your own business, say where it came from and as of when.
How Theft Is Treated in the Books
This section is general information. Treatment depends on the type of business, how the crypto is classified, the country, and the facts. Please talk to your auditor.
US GAAP. Under ASU 2023-08, in-scope crypto assets are measured at fair value, and changes in value go through net income each period. It applies to fiscal years starting after 15 December 2024. If crypto is stolen, the asset is removed from the books and a loss is recorded in the period of the theft, with disclosures. Possible recoveries, such as frozen funds, insurance or a platform's reimbursement promise, are generally treated as gain contingencies. They are normally not recorded until realised, and they are not netted off against the loss.
IFRS. The IFRS Interpretations Committee's June 2019 decision says crypto is not cash and not a financial asset. It is usually an intangible asset under IAS 38, or inventory under IAS 2 if held for sale in the ordinary course of business. EY's summary explains the details. Stolen holdings are removed from the books. A reimbursement is recorded as a separate asset only when it is virtually certain.
If you are a customer of the hacked platform. If the platform credits your balance in full, you may have had a delay and not a loss. The accounting question then becomes whether the asset is accessible, how it is classified, and what should be disclosed about the concentration risk. Cases like this are why year-end disclosures about subsequent events need planning early.
How Tax Treats Theft Losses by Country
Same theft, different answers. This is general information only, not tax advice.
| Country | General position | Source |
|---|---|---|
| United States | Personal casualty and theft losses were limited by the 2017 tax law, but IRS Chief Counsel Advice 202511015 said theft losses from transactions entered into for profit can still be deductible under section 165(c)(2). Timing rules can defer the deduction while there is a reasonable prospect of recovery. | National Taxpayer Advocate, CoinLedger |
| United Kingdom | HMRC says theft is not a disposal, so a victim cannot claim a Capital Gains Tax or Corporation Tax loss on that basis. A negligible value claim is a separate route only where the asset has become worthless. | HMRC CRYPTO41550, CRYPTO22500 |
| Canada | No crypto-specific CRA guidance on stolen crypto. A capital loss may be possible with strong documentation, but a platform's refund promise can delay any claim. | Koinly, KoinX |
| India | Section 115BBH taxes gains on virtual digital assets at a flat 30% and allows no set-off of VDA losses. There is no CBDT circular on hacked VDAs. Practitioners generally say theft is likely not a taxable transfer, but no deductible loss arises either. | Treelife, Quicko, KoinX on WazirX |
The common thread in every country is proof. Tax offices ask for ownership, cost, the date and fact of the theft, and evidence that there is no reasonable prospect of recovery. A platform promising to refund you usually delays or removes the claim.
A Warning About Recovery Scams
After large hacks, scammers often contact victims offering to "recover" lost crypto for an upfront fee. Be careful. Law enforcement and forensic firms work through official channels, and no private service can guarantee a recovery. FinanceBridge does not offer crypto tracing or recovery.
What It Means for Customers and Businesses
- Binance's pledge. Binance says it has reserved over $6.34 billion to cover losses. Its SAFU emergency fund is reported at roughly $1 billion in Bitcoin, so most of the cover must come from company funds. Fundstrat's Farrell said it does not currently appear to be a solvency event for Binance.
- Withdrawals. They were paused at the time of writing. Binance said it was on track to resume in about 45 hours and co-founder Yi He told Bloomberg to expect them by Sunday, 1 November. These are targets, not confirmed restarts.
- Markets. Bitcoin fell to a six-week low of about $76,368 and leveraged positions worth roughly $1.5 to 1.6 billion were liquidated, according to CoinDesk and CNBC.
- India. CoinDCX put its futures market into reduce-only mode, citing developments at a global liquidity provider. In the same report, a crypto news site's own index showed USDT trading at a record premium in India. That index is the outlet's own measure and is not independently confirmed.
For a business, the message is simple. If your company holds crypto on Binance, you may have suffered delay, not loss, if Binance keeps its pledge. But your finance team still has questions to answer: can you access the asset, how should it be shown in the accounts, and how much exposure to one platform did you carry?
Deep Dive: The Binance Research (Numbers, Recovery and Reserves)
The sections below go deeper into the incident itself. They are longer and more detailed, and some parts are our own estimates built from incomplete public data. We label every estimate clearly, so you can separate confirmed facts from our reading.
How Big Is the Number? Why Sources Differ
Everyone agrees it is about $6 billion or more. The small differences are normal in a fast-moving incident. Different firms count different blockchains and value the coins at different moments.
| Source | Estimate |
|---|---|
| Binance | around $6.3 billion |
| TRM Labs | about $6.36 billion at the time of theft |
| Elliptic | $6.43 billion across 11 blockchains |
| Chainalysis | about $5.91 billion at the time of theft (a revised estimate) |
This is a useful reporting lesson in itself. When four credible sources give four numbers, the honest way to report is to name the source, name the date and say how it was counted. Finance teams do the same thing when two reports disagree: you do not pick the number you like, you explain the basis.
To put the size in context, the earlier record was the roughly $1.5 billion Bybit hack in February 2025. This one is about four times larger.
How Did the Attack Work?
Binance's early explanation is that a compromised engineer's laptop let an attacker reach a service container and submit withdrawals that nobody had approved. Binance has not yet published a full post-mortem, so this may change.
The on-chain evidence from TRM Labs fits that picture. TRM's conclusion, in its words, is that the attacker gained the ability to make Binance's hot-wallet signing system sign transactions of the attacker's choosing across chains.
In plain terms, nobody "broke" the math of cryptography. The weak spot was the people and systems around the wallets. Elliptic makes the same point when it compares this case with Bybit: the infrastructure and people were compromised, not the cryptography.
This matters for every business. You can have strong locks and still lose everything if one person's laptop can quietly approve payments.
There is also one technical detail worth knowing. On Ethereum, the attacker reportedly used a feature called EIP-7702, which lets a wallet hand its behaviour over to a smart contract. That turned a Binance wallet into a "sweeper" the attacker controlled, and it kept sweeping new deposits for hours afterwards. There is a second opinion too. Former Mt. Gox CEO Mark Karpeles told Reuters attackers "probably accessed private keys" for some wallets. That is his opinion and it conflicts with Binance's statement, so we treat it as unconfirmed.
Who Is Suspected, and What Is Not Confirmed
Here it is important to separate what is claimed from what is proven.
- TRM Labs attributes the attack to TraderTraitor, which it describes as a North Korean hacking unit, with high confidence.
- Elliptic says the attack is "likely" linked to North Korea, but also lists reasons for caution. For example, only a small amount of Binance funds overlapped with funds from the September 2026 Bitget hack, and a shared laundering network does not prove a shared hacker.
- Chainalysis also points to TraderTraitor, citing links to an earlier hack, as reported by Cointelegraph.
- Binance has said its investigation has not attributed responsibility to any individual.
- The US government had made no public attribution as of 30 October 2026. For comparison, the FBI named TraderTraitor for the Bybit hack within five days in 2025.
- North Korea routinely denies such allegations.
So the fair way to say it is: "Three blockchain-analytics firms link the attack to North Korea. No government has confirmed it." Writing "North Korea stole $6.3 billion" as a fact would go further than the evidence.
What Is Frozen, and Who Is Helping
Stablecoins such as USDT and USDC are issued by companies that can freeze them. That is why most of the frozen money is stablecoins. According to TRM Labs' early count and Elliptic's verification, freezes included:
- Tether: roughly 1.77 billion USDT.
- Circle: about 825 million USDC, frozen "in coordination with law enforcement".
- Ripple: about 40.5 million RLUSD.
- World Liberty Financial, with custodian BitGo: about 27.8 million USD1.
- Arbitrum Security Council: about 8,426 ETH and 74.6 million ARB moved out of the attacker's reach.
Binance's co-CEO Richard Teng said roughly $3 billion was frozen so far. Elliptic could verify a lower figure of about $2.84 billion, or 44%, at the time of its update. About 94% of what is frozen is stablecoins.
Who is working on recovery?
- Law enforcement: Binance says it is working with law enforcement but has not named agencies. Reuters, citing a person familiar with the matter, reports the FBI and the US Secret Service are involved. Neither has confirmed this publicly. We found no report of Europol, Interpol or Indian agencies being involved.
- Blockchain-analytics firms: TRM Labs, Chainalysis and Elliptic are tracking the funds and sharing wallet addresses so that exchanges can freeze money if it arrives.
- Independent investigators: ZachXBT was first to point out the overlap with the Bitget hack.
- Regulators: Abu Dhabi's financial regulator, which licensed Binance's main operation, said it is engaging closely with Binance. We found no statement from Indian authorities.
No lawsuit against the attackers had been reported as of 30 October 2026. For reference, Bybit filed a US civil case against North Korea and the Lazarus Group more than a year after its hack.
Can the Money Come Back?
Two pools of money, two very different stories.
1. The frozen stablecoins, about $3 billion. This is the realistic recovery. The issuer controls the token, so in principle the frozen coins can be reissued or returned through legal steps. Fundstrat's Sean Farrell called stablecoins the most recoverable asset class in crypto for this reason. Nothing has been confirmed as returned to Binance yet.
2. The coins nobody can freeze, roughly $2.4 to $3.3 billion. This is ETH, BTC, XRP and similar assets. According to TRM and Elliptic, the attacker still held these at the time of writing. Past North Korea-linked heists show how hard it is to get these back:
| Incident | What came back |
|---|---|
| Bybit, Feb 2025, about $1.5B | Bybit's own court complaint says about 90.2% became untraceable and only about 5.3% (around $75.5 million) was frozen or recovered |
| Ronin, Mar 2022, about $620M | A low single-digit percentage came back over the following years |
| Poly Network, Aug 2021, about $610M | Almost all returned, but the hacker chose to give it back, which is rare |
| Bitfinex, 2016 | Large recovery, but it took about six years and the launderers were individuals within reach of US law enforcement |
The research behind this article estimates total recovery for the Binance case at roughly 45 to 50%, mostly the frozen stablecoins plus a small share of the rest. That is an analytical estimate based on past cases, not a forecast by any of the firms named here, and not a promise. The key point for customers is that their outcome depends on Binance's own balance sheet, not on how much is recovered.
Our View: How Much Is Likely to Come Back?
This is our opinion, built from the past cases above and from what has been reported so far. It is not a forecast from TRM, Elliptic, Chainalysis or Binance, and it is not a promise. Nobody can know the final number today.
Likely: most of the frozen stablecoins (about $3 billion, close to half of the total). This is the same pattern that made this hack different from Bybit. At Bybit, only a small share was frozen early, and about 5.3% was frozen or recovered in the end. Here, Tether and Circle froze large amounts within about an hour, while the attacker still held more than $2.6 billion in stablecoins, according to Elliptic. Because the issuer controls these tokens, getting them back to Binance is mainly a legal and process question, not a technical one. The catch is time. It will probably take weeks or months of legal steps, not days, and nothing has been officially returned yet.
Unlikely: most of the ETH, BTC and XRP (roughly $2.4 to $3.3 billion). No issuer can freeze these. If the attackers really are state-linked, the history is not encouraging. Ronin saw only a small single-digit percentage return over years, and Bybit's own court filing says about 90% became untraceable. Poly Network and Bitfinex are the big recovery stories people quote, but they do not fit here: in one the hacker chose to return the money, and in the other the launderers were ordinary individuals within reach of US law enforcement.
A small upside to watch. Elliptic reported that about $445 million in XRP, SOL and NEAR had not moved at the time of its update, and that laundering this time looked slower and different from Bybit. Every attempt to cash out at a regulated exchange is a chance for a freeze. So a few percent more than the Bybit result is possible, but we would not plan on a large number.
Putting it together. If the frozen stablecoins are eventually returned and only a small share of the rest is recovered, the total could end up somewhere around 45 to 50%. A worse case is that legal delays or disputes hold up part of the frozen money. A better case is that more freezes happen as the attacker tries to cash out. We think "about half, not all" is the honest range to expect.
What this means for customers. Their outcome does not depend on this number. Binance has said it will cover customer losses from its own $6.34 billion reserve, so recovery mainly decides how much Binance itself loses.
What would change our view: an official attribution and seizure notice from a government, news that Tether or Circle has reissued frozen coins to Binance, large unmoved coins getting frozen at exchanges, or a full post-mortem from Binance showing the cause was different from what is reported today.
Can Binance Actually Afford It? What Is Public and What Is Not
Binance says it will pay back customers from its own money. The fair question is: how much money does Binance actually have? The honest answer is that nobody outside the company can say for sure, and that is important for anyone relying on the pledge.
What Binance has said (as reported on 30 October 2026):
- It has reserved over $6.34 billion of company funds to cover the loss. Binance said about $5 billion of this was already held in the same tokens that were stolen, with the rest being bought on the open market and through over-the-counter desks. This is Binance's own statement, and we have not seen it independently verified.
- Its SAFU emergency fund is reported at roughly $1 billion, held in Bitcoin (Binance's website listed about 15,000 BTC, around $1.18 billion at the time). That covers well under a third of the loss, so the rest has to come from the company's balance sheet.
What is not public:
- Binance is a private company. It has said in the past that, as a private company, it does not share financial information publicly. In 2023, Fortune reported that Binance had not disclosed its revenue for several years, and its own estimate of revenue was only an estimate. Binance replied that it does not share financial information publicly, and that those estimates were not correct.
- In 2022, Reuters analysed filings and found that Binance did not disclose its revenue, profit or cash reserves. Binance called parts of that analysis false.
- Binance's earlier proof-of-reserves report covered only Bitcoin, and the auditor said it was not an assurance engagement. Critics said such a report shows holdings, not the company's overall financial health.
Those sources are from 2022 and 2023, so they show how transparent Binance has been in the past. They are not a picture of its finances today. We could not find a current, audited statement showing Binance's own net worth.
Do not mix up two different numbers. Binance's customers' coins are one thing. Binance's 2025 annual report put assets under custody at about $162.8 billion, but those are mostly customer assets, not the company's own money. The company's own capital, the money that would actually pay for a $6.3 billion hole, is a much smaller figure and is not published.
A rough back-of-the-envelope estimate
Binance does not publish its numbers, but a few public pieces let us build a rough picture. This is our own illustration with wide ranges. It is not Binance's data and it is not a forecast.
1. Binance's own coin, BNB. BNB is the token Binance launched in 2017. CoinGecko showed a price of about $693 and a market cap of about $91 billion, with roughly 131.5 million BNB in circulation, around 30 October 2026. Binance has never published how much BNB it holds. Outside estimates exist. A forensic analysis by Gray Wolf Analytics and Forbes, reported by BeInCrypto in June 2024, says Binance retains about 46.2 million BNB from the founding team's allocation, and that founder Changpeng Zhao controls about 94 million BNB, roughly 64% of the supply at that time. These are estimates built on assumptions, and part of it is described as an allegation. If Binance held about 46 million BNB, that would be worth roughly $32 billion at today's price, on paper.
2. Why a company's own coin is weak backing. Paper value is not cash. Binance cannot sell tens of millions of BNB without pushing the price down, and BNB tends to fall in exactly the moments when Binance needs money. It dropped about 5% on the day of the hack. A reserve made of your own coin is like a business counting its own shares as cash. It helps, but we would not treat it as a real surplus.
3. Revenue and profit. There is no credible public profit figure. Estimates for revenue differ a lot. According to the summary on investingintheweb, Forbes estimated about $16 to $17 billion a year for 2024 and 2025 in March 2026. A few days later, Zhao publicly disputed that and said annual revenue is closer to $5 billion. For comparison, listed rival Coinbase reported $7.2 billion revenue and $1.3 billion net income for 2025, a profit margin of about 18%.
4. A simple illustration. Suppose, only as an example, Binance earned a similar 18% margin. On $5 billion of revenue, profit would be about $0.9 billion a year. On $16.5 billion, about $3 billion a year. Now the loss: if the roughly $3 billion that Binance says is frozen comes back, the unrecovered part is about $3.3 billion. That would be about one to four years of profit under this example. Binance's real margin could be higher or lower, so please treat this as a way to think about scale, not an answer.
| Piece | Rough figure | How reliable |
|---|---|---|
| Total impact | about $6.3 billion | Binance statement, matched by analytics firms |
| Frozen so far | about $3 billion | Binance statement, lower figure verified by Elliptic |
| Possible unrecovered loss | about $3.3 billion | Our arithmetic, depends on frozen funds being returned |
| Reserved by Binance | $6.34 billion | Binance statement, not independently verified |
| SAFU fund | about $1 billion in BTC | Binance website, as reported |
| Binance's own BNB | about 46 million BNB, about $32 billion on paper | Outside estimate, 2024, unconfirmed |
| Yearly revenue | $5 billion to $16.5 billion | Two public estimates that disagree |
| Yearly profit | unknown | No credible public figure |
5. What the proof-of-reserves reports suggest about "surplus". Binance's reserve reports for August and September 2026, as summarised in this overview, showed reserve ratios of about 100.25% for Bitcoin and Ether and about 103.62% for USDT on about 32.3 billion USDT of user balances. Our arithmetic: a 3.62% cushion on that USDT is roughly $1.2 billion, and the Bitcoin and Ether cushions are much smaller, roughly $150 million combined at recent prices. The same overview notes that Binance changed its method in January 2026 to include its own assets, and that these reports are not a full audit. They also came before this hack, which removed a lot of what was in those wallets. So there is no large visible "surplus" in these reports. The cushion above customer balances looks thin, which is why the company's other money, its profits and any outside investment, matters. One reported example is a minority investment of about $2 billion from Abu Dhabi's MGX in 2025, mentioned in Wikipedia's Binance entry, which also notes the investors' details are not fully clear.
Our reading. Looking at all of this, we think Binance can probably absorb a loss of around $3 billion over time if the frozen money comes back, but a full $6.3 billion with no recovery would be much harder to cover without selling a lot of BNB or other assets. That is a judgment from incomplete public data. It could be wrong in either direction, and only audited statements could settle it.
What this means. An analyst at Fundstrat said it does not currently appear to be a solvency event for Binance. That is an opinion, and a reasonable one given that about half the loss is frozen. But "reserved" is a statement, not an audit. For a customer or a business with exposure, the useful things to watch are:
- Whether withdrawals actually restart on the promised date and stay open.
- Whether Binance publishes a fresh, independent proof of reserves that covers all assets, not just Bitcoin.
- Whether the frozen stablecoins are returned to Binance.
The same lesson applies to your own business. A promise from a supplier or a platform is worth what its documented balance sheet is worth. When a counterparty will not show its numbers, that is a risk to write down in your own records.
How Binance Will Likely Bear the Loss: Step by Step
So far we have looked at the pieces one by one: what is frozen, what is reserved, what Binance might earn. Now let us put them in order. When a company takes a big loss, the cost is usually absorbed in layers, from the cheapest source to the most painful. Binance has not published its plan, so the order below is our reading of what Binance has said and what is public, not a confirmed plan.
| Layer | What it is | What is known | Status |
|---|---|---|---|
| 1. Recovery | Frozen stablecoins returned, plus any later seizures | About $3 billion frozen, nothing officially returned yet | Hoped for, not confirmed |
| 2. SAFU fund | Binance's emergency fund | About $1 billion in Bitcoin, as reported | Stated by Binance |
| 3. Company reserve | Binance's own funds set aside | $6.34 billion reserved, about $5 billion of it already in the same tokens that were taken | Stated by Binance, not verified |
| 4. Future profits | Money the business earns over the coming months and years | Unknown, only wide revenue estimates exist | Cannot be checked |
| 5. Selling assets | Selling BNB or other holdings if cash is short | Possible, but selling its own coin can push the price down | Not announced |
| 6. Outside capital | New investment or loans | Binance took a reported $2 billion minority investment in 2025, nothing new reported | Not announced |
How the layers fit together.
- The $6.34 billion figure is not a separate pile on top of everything else. As we read Binance's statement, it is the amount the company has set aside to make customers whole, and it already counts money Binance is buying back on the market and through over-the-counter desks.
- If the frozen $3 billion returns, the real cost to Binance falls to roughly $3.3 billion, which is the number we used in the estimate above. If it does not, Binance has to find that money from layers 2 to 6.
- No insurance payout has been reported. Crypto exchanges generally rely on their own funds, which is why the SAFU fund exists.
The timing matters as much as the amount. Customers see this as a withdrawal question: when can I take my money out? The company sees it as a cash-flow question: how fast can it rebuild the balances it promised? Binance can credit customers quickly by buying the missing coins now and waiting for recoveries later. That keeps customers whole, but it means Binance carries the loss on its own balance sheet in the meantime. Whether that is comfortable depends on cash that outsiders cannot see.
How this looks from an accountant's seat. For Binance, this is a large loss, with a possible recovery recorded only when it becomes realised, as the accounting section earlier in this article explains. For a customer, it is a counterparty exposure. These are two different sets of books looking at the same event, which is a good reminder that one incident can land very differently depending on which side of the ledger you sit on.
What to watch to see how it is going:
- Withdrawals restart on time and stay open.
- Frozen coins are officially released or reissued to Binance.
- Binance publishes a fresh, independent proof of reserves that covers all assets.
- Any sale of large BNB holdings, any new investor, or any new funding announcement.
If these four go the right way, the loss gets absorbed quietly. If they do not, we will see it in delays and in the company's choices, not in statements.
FAQ
How much did Binance lose in the October 2026 hack?
Binance says the estimated total impact is around $6.3 billion. TRM Labs reports about $6.36 billion, Elliptic $6.43 billion and Chainalysis about $5.91 billion. The gap comes from different valuation times and different blockchains being counted. All numbers are as reported on 30 October 2026.
Who is behind the Binance hack?
TRM Labs, Chainalysis and Elliptic link it to North Korea-linked hackers. This is their assessment. As of 30 October 2026, no government has confirmed it, and Binance has said its investigation has not attributed responsibility to any individual.
Will Binance customers lose money?
Binance has pledged to cover all losses from a $6.34 billion reserve. This is a pledge, and withdrawals were paused at the time of writing, with a target restart around 1 November 2026. Customers face delay and counterparty risk, and the outcome depends on Binance honouring its commitment.
Can the stolen crypto be recovered?
Some can. About $3 billion, almost all stablecoins, is frozen. Coins like ETH, BTC and XRP cannot be frozen by an issuer, and past North Korea-linked hacks recovered very little of those. For example, Bybit's own court filing says only about 5.3% of its stolen assets were frozen or recovered.
Is stolen crypto tax-deductible?
It depends on the country. The US may allow a theft loss in narrow cases for crypto held for profit, with timing rules. The UK says theft is not a disposal. India allows no loss relief on virtual digital assets. Ask a qualified tax adviser about your own situation.
Does FinanceBridge help recover stolen crypto?
No. FinanceBridge is a bookkeeping and finance operations service. It does not trace, freeze or recover crypto, and it does not give investment or legal advice.
Conclusion
The Binance hack is a crypto story on the surface, but underneath it is a finance-controls story. A single compromised system was reportedly enough to move billions, the money was moved faster than most people could react, and the questions afterwards are the ones every finance team knows: who approved it, how fast did we notice, how much was in one place, and can we prove what happened?
You can answer those questions for your own business today, without any crypto at all. If you would like help setting up approval rules, a regular reconciliation routine or a clean audit trail in your books, get in touch for a free consultation. We will tell you honestly what we can and cannot help with.
This article is general information, not investment, tax, accounting or legal advice. Facts are as reported on 30 October 2026 and may change as the investigation continues.
Sources
The incident
- TRM Labs: North Korea steals USD 6.36 billion from Binance
- Elliptic: Binance, the largest hack in history
- NBC News: Binance hack, Tether and Circle freeze stablecoins
- Cointelegraph: live updates, Binance hack linked to TraderTraitor
- Forbes: Binance's $6.3 billion hack started with one engineer's laptop
- CoinDesk: markets, Binance hack sends Bitcoin and Ether tumbling
- CNBC: billions in crypto frozen, here's what happens next
- Crypto Times: live updates, more breach points, FBI and Secret Service report, India premium index
- ITP: $6.34bn reserved to cover losses
Binance's finances and transparency
- CoinGecko: BNB price, market cap and supply
- BeInCrypto (Jun 2024): CZ's BNB holdings estimate
- Investingintheweb: Binance statistics, revenue estimates and proof of reserves
- Wikipedia: Binance
- Fortune (Aug 2023): Binance's revenues and transparency
- Reuters via Malay Mail (Dec 2022): Binance's books are a black box
- Blockworks: Binance proof of reserves and critics
- Cryptoticker: SAFU fund and biggest hacks
Past hacks and recovery
- Cointelegraph: Bybit, US court and funds trace
- Newscord: Bybit sues North Korea and Lazarus Group
- Gulf News: Bybit loses $1.5 billion
- Cointelegraph: Ronin recovery
- DeepStrike: biggest crypto hacks of all time
- CoinDesk: Bitfinex seizure
Accounting
- AICPA & CIMA: ASU 2023-08
- IFRS Foundation: IFRIC Update, June 2019
- EY: holdings of cryptocurrencies
- Uniqus: ASU 2023-08
Tax
- National Taxpayer Advocate: IRS Chief Counsel Advice on theft loss deductions
- CoinLedger: reporting stolen or lost crypto
- HMRC Cryptoassets Manual CRYPTO41550 and CRYPTO22500
- Koinly: Canada crypto tax guide and KoinX: stolen crypto in Canada
- Treelife: taxation of virtual digital assets, Quicko and KoinX: WazirX hack and tax