--- title: "Binance Lost $6B in Hours, and Says About $3B of It Is Already Frozen" published: 2026-10-31T06:40:16.634472+00:00 type: breaking_brief scope: cex canonical: https://www.moonwire.org/insights/binance-lost-6b-in-hours-and-says-about-3b-of-it-is-already-2026-10-30.html tags: [binance, hack, security, stablecoins, exchanges] --- # Binance Lost $6B in Hours, and Says About $3B of It Is Already Frozen > What Nansen called the biggest exchange hack on record quickly became a test of crypto's centralized brakes. Stablecoin issuers and an L2 security council froze a large share of the haul, and the open question shifted to Binance's own account of how the attacker got in. ## Key takeaways - [Nansen](/s/YxVcFpnGSc2bWw6S-_o91A?p=a7054b72a757) reported about $6 billion left [Binance](/s/PSsMcsq7TZW4oRuw5T8r6A?p=a7054b72a757) wallets across five ecosystems in a few hours, and Binance says about $3 billion of it is frozen [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757). - Nansen's chart attributes 1.2B [USDT](/s/9oXno4eKSc2mImkBLcFVLg?p=a7054b72a757) and 824M [USDC](/s/4ziuhqf3Tc-nGVOlSZwc0g?p=a7054b72a757) of the frozen funds to Tether and Circle, and the Arbitrum Security Council froze about $30.5 million [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757)[[8]](/s/KeRJRILSQDuL2zL-QicWsw?p=a7054b72a757). - Binance said it reserved over $6.34 billion to cover the incident, $5 billion of it in the exact tokens affected [[11]](/s/8uQvPw3ZSMa9tYoAeumgFQ?p=a7054b72a757). - [Ansem](/s/8CAv65T8QEGZ5UCdrtGE8Q?p=a7054b72a757) called Binance's single-laptop explanation implausible, and [Whale Alert](/s/XupC7b76Q8mKUN8AfHsE4A?p=a7054b72a757) relayed analysts questioning it [[2]](/s/SU_FTbjgRU2Yqlm0qSDFsw?p=a7054b72a757)[[3]](/s/EMErc5MJQC2EHlgEcUKrJg?p=a7054b72a757). - [CZ](/s/D9cQMahdQfy-JU_hpEnUMA?p=a7054b72a757) said the hack's impact on the [Bitcoin](/s/dprQn6-YSUqZakJvP-syVQ?p=a7054b72a757) price was small, while [Coin Bureau](/s/gW3t6pXYTIec3Hdd4gJvPg?p=a7054b72a757) had Bitcoin losing its $80,000 floor [[7]](/s/5bHj_3uzRseZE--azMUwkQ?p=a7054b72a757)[[15]](/s/h5cua5o_SQWypNVXZrt4BA?p=a7054b72a757). The biggest exchange hack on record quickly became a test of crypto's centralized brakes: [Binance](/s/PSsMcsq7TZW4oRuw5T8r6A?p=a7054b72a757) says about $3 billion of the roughly $6 billion taken is frozen, much of it in [stablecoins](https://www.moonwire.org/insights/glossary/stablecoin.md), and the pushback cited here was aimed at Binance's account of the breach rather than at the size of the loss [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757)[[2]](/s/SU_FTbjgRU2Yqlm0qSDFsw?p=a7054b72a757)[[3]](/s/EMErc5MJQC2EHlgEcUKrJg?p=a7054b72a757). ## What left [Nansen](/s/YxVcFpnGSc2bWw6S-_o91A?p=a7054b72a757) reported that about $6 billion left Binance wallets on [Ethereum](/s/MMSdHldPQYu_teda6f8wnw?p=a7054b72a757) and other EVM chains, [Bitcoin](/s/dprQn6-YSUqZakJvP-syVQ?p=a7054b72a757), TRON, XRP and Solana in a few hours [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757). [Coin Bureau](/s/gW3t6pXYTIec3Hdd4gJvPg?p=a7054b72a757) dated the outflows to 29 October and described the Ethereum hot wallet labelled Binance 14 being emptied in a single transaction worth around $2.5 billion [[4]](/s/FL46OBn4T0y_pkRkWfUSYA?p=a7054b72a757). [Glassnode](/s/Q0rKPXiSQ2KqVV9d6gS6ig?p=a7054b72a757) put the theft above the combined value of the next nine largest crypto hacks [[5]](/s/SE-uuENwTVyx0D0ciY8Q6g?p=a7054b72a757). Estimates of the total differed by source: $6.01 billion in an Arkham figure relayed by [Whale Alert](/s/XupC7b76Q8mKUN8AfHsE4A?p=a7054b72a757) [[6]](/s/M7gjpN1HQ-K-FwvVYhKstQ?p=a7054b72a757), and $6.3 billion in [CZ](/s/D9cQMahdQfy-JU_hpEnUMA?p=a7054b72a757)'s own post [[7]](/s/5bHj_3uzRseZE--azMUwkQ?p=a7054b72a757). ## What was frozen, and what was not Per Nansen, Binance says about $3 billion is frozen, including about $2.3 billion in [USDT](/s/9oXno4eKSc2mImkBLcFVLg?p=a7054b72a757) and [USDC](/s/4ziuhqf3Tc-nGVOlSZwc0g?p=a7054b72a757), and Nansen's flow chart attributes 1.2B USDT and 824M USDC of the frozen funds to Tether and Circle [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757). The Arbitrum Security Council froze about $30.5 million tied to the [exploit](https://www.moonwire.org/insights/glossary/crypto-exploit.md) [[8]](/s/KeRJRILSQDuL2zL-QicWsw?p=a7054b72a757). A post from Anthony Scaramucci that CZ shared put it as roughly half the assets already frozen, with deposits continuing and withdrawals paused for a security overhaul [[9]](/s/Qt-CLMqOS9a2IOQH2PB07Q?p=a7054b72a757). The rest moved. Nansen traced flows to a central Binance Exploiter address that deposited USDT into Aave and borrowed ETH, and its chart showed a Bitcoin hub holding 18,270 BTC with no outflows yet [[1]](/s/Kj6guJklRvGo88EVkPvYHw?p=a7054b72a757). CredibleCrypto said the hacker sold about 8M [CRV](/s/M-Ujl9MASyykt5sx6eDq4Q?p=a7054b72a757) tokens and over half a million [CVX](/s/px3MeHShQj2OT8HwaqeJxQ?p=a7054b72a757) [[10]](/s/lWe4l2OLRj6VVJFYjBMajg?p=a7054b72a757). [Whale](https://www.moonwire.org/insights/glossary/crypto-whale.md) Alert relayed an unverified report that the attacker moved about $158 million of stolen altcoins into ETH [[3]](/s/EMErc5MJQC2EHlgEcUKrJg?p=a7054b72a757). Binance said it has reserved over $6.34 billion of company funds to cover the incident, $5 billion of it already held in the exact tokens affected [[11]](/s/8uQvPw3ZSMa9tYoAeumgFQ?p=a7054b72a757). [Michael Saylor](/s/_TR8sX9YT3KFIkBenyG5CQ?p=a7054b72a757) wrote, "I expect it to deliver" [[12]](/s/Ww20ELyvSKypckHQ9YM5XA?p=a7054b72a757). CZ shared a teacher's view that decentralized networks stayed idle while centralized actors intervened, calling it a "Fair view" [[13]](/s/mA_10bE-TUe3ZAKS595vVg?p=a7054b72a757). ## The other side Binance disclosed that a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawals, and said no private-key leakage was detected [[14]](/s/HumAXFbsQZ-ca2luHptz2A?p=a7054b72a757). [Ansem](/s/8CAv65T8QEGZ5UCdrtGE8Q?p=a7054b72a757) called the idea of one laptop enabling a six-billion-dollar theft implausible [[2]](/s/SU_FTbjgRU2Yqlm0qSDFsw?p=a7054b72a757), and Whale Alert relayed that analysts were questioning Binance's explanation of the compromise [[3]](/s/EMErc5MJQC2EHlgEcUKrJg?p=a7054b72a757). Coin Bureau said investigators were pointing at North Korea [[15]](/s/h5cua5o_SQWypNVXZrt4BA?p=a7054b72a757). The price read split too. CZ said the impact on the Bitcoin price was small and that Mt. Gox was larger in BTC terms, at 650,000 BTC [[7]](/s/5bHj_3uzRseZE--azMUwkQ?p=a7054b72a757). Coin Bureau's account had Bitcoin losing the $80,000 floor it had been clinging to [[15]](/s/h5cua5o_SQWypNVXZrt4BA?p=a7054b72a757). --- *MoonWire surfaces and summarizes public crypto news.* **General information only — not financial advice.** MoonWire Ltd. is not licensed by ASIC and holds no AFSL. This content does not consider your objectives, financial situation, or needs, and is not a recommendation to buy, sell, or hold any asset. *This analysis is generated by artificial intelligence and may be inaccurate, incomplete, or fabricated. Independently verify before acting.* © 2026 MoonWire Ltd. · [Terms](https://www.moonwire.org/legal/TOS) · [Risk Disclosure](https://www.moonwire.org/legal/RISK_DISCLOSURE) · [Privacy Policy](https://www.moonwire.org/legal/PRIVACY_POLICY)