Binance Loses About $6.3 Billion: What Was Breached and Who Covers the Loss [Japanese Reactions & Analysis]

Crypto asset exchange Binance has lost crypto worth about $6.3 billion, by the company’s own estimate. Blockchain analytics firms point to possible manipulation of the system that signs outgoing transfers, and to the involvement of a North Korea–linked group. Binance says it will cover the loss with its own funds and plans to publish proof-of-reserves results, which show whether customer assets are backed, by November 2.

Table of Contents

Key Points

・In the early hours of October 30 (Japan time), crypto assets worth about $6.3 billion, by the company’s estimate, were drained from a Binance hot wallet used for transfers. At the time of the announcements, Binance’s global platform had halted withdrawals, and its Japanese unit had halted crypto withdrawals.

・Binance found additional points of compromise beyond the engineer’s device it first suspected, and is investigating the full intrusion path. Private analytics firms point to possible manipulation of the signing system and to involvement by a North Korea–linked group.

・Binance says it has set aside more than $6.3 billion in company funds to cover the loss and plans to publish proof-of-reserves results by November 2. Spot spreads briefly widened, and the lending protocol Aave temporarily paused new deposits and borrowing.

News: About $6.3 Billion Drained, Withdrawals Halted on the Global Platform

In an official announcement, Binance said several crypto assets worth about $6.3 billion, by the company’s estimate, had been taken without authorization from a hot wallet (an internet-connected wallet used for transfers). The outflow occurred at 20:05 UTC on October 29 (5:05 a.m. on October 30, Japan time).

Binance halted withdrawals on its main global platform, which is separate from the services of its Japanese unit. Deposits and unaffected services remained online. The company set a target of beginning a phased resumption of withdrawals within about 34 hours, after security checks. No subsequent announcement that withdrawals have begun resuming has been confirmed.

Binance said it will absorb the loss and has set aside more than $6.34 billion in company funds for compensation. This includes about $5 billion in the same tokens that were stolen, and the company is buying the remaining tokens of those types. Separately, Binance said about $3 billion in assets has been frozen.

The company said it would take a reserves snapshot (a record of holdings at a single point in time) within 12 hours of the announcement and publish the results by November 2. It also plans to release additional technical findings on the breach within about 48 hours of the announcement.

Binance Japan announced on PR TIMES (Japanese) at 6 p.m. on October 30 that Japanese customers’ assets are held in cold wallets (wallets kept offline), separate from the affected hot wallet, and that an inspection had confirmed they were safe. Trading, crypto deposits, and yen deposits and withdrawals continue as usual; only crypto withdrawals were halted as a precaution. The unit said it expected to resume them within 48 hours, but its follow-up notice (Japanese) does not announce a resumption.

The Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM) said in a statement that it is aware of the October 30 incident and is monitoring the situation in close contact with Binance.

GMO Breach Let Attackers Trade in Customers’ FX Accounts and Use the Damage for Extortion, With Japanese Reactions

Background: From Intrusion to Unauthorized Transfers, as Explained by Binance and Analytics Firms

The scope of the intrusion and the misuse of “legitimate” signatures

Binance initially said it suspected the compromise of a device used by one of its engineers. In its update, it said it had also found a separate point of compromise. Where the attackers got in, and in what order the intrusion spread, is still under investigation. The company says it has so far found no evidence that private keys—the keys used to sign transfer instructions and move assets—were leaked.

What analytics firms highlight from on-chain records is that the transfers carried valid signatures. At exchanges, internal systems generally approve users’ withdrawal requests, sign them, and send them out. From the outside, the stolen-fund transfers looked like ordinary withdrawals. Binance has not disclosed how its signing system is designed.

Blockchain analytics firm TRM Labs concludes that the hot wallet signing system was likely manipulated, citing, among other things, clusters of correctly signed transfers on multiple chains (networks that share a transaction ledger) within a short time window. Elliptic points to the same possibility, noting that the transfers carried valid signatures, that permissions were delegated on Ethereum (handing control of a wallet to another program), and that transfers on other chains looked normal.

If attackers can manipulate the signing system, they can create transfers that are hard to tell apart from legitimate ones without ever extracting the keys. On this point, Binance’s statement that there is no evidence of key leakage and the analytics firms’ findings are consistent.

Analysis of possible North Korean involvement

TRM Labs assesses with high confidence that the attack was carried out by TraderTraitor, a group described as a North Korean hacking unit. It cites on-chain and off-chain intelligence, as well as similarities in preparation methods and signing characteristics to past North Korea–linked incidents.

Elliptic found that part of the stolen funds had been mixed with proceeds from an incident at the exchange Bitget, in which North Korean involvement is suspected, and treats this as one clue. It also notes, however, that small amounts of commingling can occur simply because the same money launderers were used. Chainalysis has observed similar commingling and presents its own attribution assessment.

These are all assessments by private analytics firms. No formal attribution of this incident by any government or law enforcement agency has been confirmed.

Background: Can Binance Cover the Loss, and What Happened in the Markets?

Compensation funds and what proof of reserves can show

Of the more than $6.34 billion Binance says it has set aside, about $5 billion is in the same tokens that were stolen, and the company is buying the rest. Binance’s SAFU fund, created to protect users, holds about $1 billion, according to the company. Because the loss far exceeds that, Binance says it will combine the fund with other resources.

According to Reuters, co-founder Yi He said the loss can be covered by annual revenue, and that Binance does not need to sell its SpaceX shares. Revenue, however, is a figure before costs; how much capacity Binance has to absorb the loss can only be judged alongside profit and cash on hand.

The proof of reserves (PoR) results due by November 2 will help show whether, at the time of the snapshot, the exchange held assets matching what customers had deposited. PoR does not reveal the company’s total liabilities, its readily liquid assets, or its day-to-day funding position.

Where the funds went and the market spillover

According to Elliptic, the stolen funds have since been swapped into other crypto assets, moved across chains, and used as collateral for borrowing. Some stablecoins (crypto assets pegged to the US dollar or other currencies) allow their issuers to block balances at specific addresses, so how much can be recovered depends on whether the assets are freezable. Binance says about $3 billion has been frozen, but freezing only immobilizes funds; it is a separate step from returning them to their owners or from the company’s compensation.

According to Reuters, a representative of market maker GSR said spot crypto spreads (the gap between bid and ask prices) widened on the morning of October 30, Asian time, and later narrowed. In the same report, Hong Kong’s HashKey voiced concern about the impact on fund transfers between exchanges, and 1Token noted that funds locked up and unable to be withdrawn could leave traders short of margin on other venues, potentially triggering liquidations.

Some stolen funds also reached the lending protocol Aave. LlamaRisk, which handles risk management for Aave, reported on the governance forum that 60 million USDT (a dollar-pegged stablecoin) was deposited as collateral and about $44.6 million worth of WETH (a token form of Ether that is easier to trade) was borrowed.

Aave temporarily paused new deposits and borrowing across a wide range of markets, while keeping withdrawals, repayments, and liquidations running. The report says the collateral exceeds the borrowed amount and that depositors were not put at risk. As user withdrawals then pushed up utilization (the share of deposited assets that is lent out) in major markets, Aave took steps to ease upward pressure on borrowing rates and said it would lift restrictions in stages. No loss to Aave itself has been reported.

Analysis: Could This Happen at Other Exchanges or at Banks?

People, contractors, and approval workflows as the entry point

In the 2024 DMM Bitcoin incident, Japan’s National Police Agency (Japanese) said an employee of contractor Ginco had been compromised and that attackers accessed communications by impersonating that person. It concluded that a legitimate transaction request made by a DMM employee had been tampered with. The case shows that contractors and approval workflows, not just the exchange itself, can become entry points.

Bybit, which suffered a large outflow in February 2025, said the incident involved a cold wallet and that the transfer display and signing path were at issue. Even offline storage can be targeted through the display and signing path used for each transfer.

Banks are not exempt. In the 2016 Bangladesh Bank incident, the bank’s IT environment was compromised and the credentials of the system used to create transfer instructions were misused. Swift, which operates the messaging network for international interbank transfers, said the core of its network was not compromised.

The methods and scale of risk differ from case to case, but in all three, the entry point was not the strength of the cryptography or the core of the network, but the people, devices, contractors, and approval procedures around them. In Binance’s case, a point of compromise separate from the engineer’s device was also found, and it is not yet clear where the entry point was or how pre-transfer defenses worked at each stage.

Defenses before a transfer, and routes to stop or reverse one afterward

Both banks and exchanges have defenses that stop anomalies before money moves. For interbank transfers, tools such as Swift’s Payment Controls detect unusual payment instructions under rules set by the bank and stop them before they are sent. Exchanges commonly split transfer approval among multiple parties, cap the amount that can be sent at once, and monitor for unusual transfers. In both cases, how these work depends on whether they are deployed and how they are configured.

The bigger difference appears after a transfer. Interbank transfers have Stop and Recall, a mechanism for requesting that a sent payment be stopped and returned. Whether the money actually comes back depends on the receiving bank, but there is a bank to ask.

With crypto assets, apart from certain assets that issuers can freeze, once a transfer is final the only party you can ask for a refund is the recipient (Bitcoin.org FAQ). For funds swapped into assets that cannot be frozen, tracing the money remains the main tool.

The promise to cover losses, and the financial strength behind it

Japan’s rules require crypto asset exchange operators to keep customer assets separate from their own and, in principle, to store them offline (FSA material, Japanese). In this case, the Japanese unit said customer assets were held in cold wallets separate from the affected hot wallet. This framework, however, is designed to reduce custody risk; it does not promise to prevent breaches or to compensate losses in full.

On the global platform, where the outflow occurred, the basis for covering users’ losses is the company’s own commitment. Proof of reserves can show that customer deposits are backed, but the US Public Company Accounting Oversight Board (PCAOB)’s investor protection office has cautioned that third-party reserve reports are not the same as a financial statement audit. Whether deposits are backed and whether the company can keep paying out while absorbing the loss need to be checked separately.

If compensation funds fall short and Binance sells holdings to fill the gap, that adds selling pressure to the market. If it needs to borrow externally, concerns about its credit could spread depending on the terms. Even if compensation proceeds, a rush of withdrawals once they resume would add strain to its funding. A policy paper by the IMF and FSB also identifies channels through which shocks can spread to the wider financial system, including holdings, lending links, and asset sales.

Japanese Reactions to the Binance Hack

The following four posts from X are a small sample, not a measure of public opinion in Japan. Three come from individual users and one shares news coverage. Figures and claims in the posts, including loss estimates and attributions, are the posters’ own.

いち (@ichi_eigo), October 29, 2026:

バイナンス創業者が個人のセキュリティ対策を訴えてると思ったら、バイナンスがハッキング。。

リアルに被害を抑えるため、クレカ支出を含む資産管理を毎日やらないと怖すぎますね。https://t.co/Nj0L9OSyqu https://t.co/d6oYUT2Sit
— いち (@ichi_eigo) 2026年10月29日

Binance’s founder urges personal security, then Binance gets hacked… To really limit damage, it’s too scary not to manage assets daily, credit card spending included. (translated)

れあ (@ayakabea), October 30, 2026:

暗号資産史上最大のハッキング
56億ドルも、、、
まじで怖すぎる https://t.co/MIeNUKSEaN
— れあ｜美容・株・時々グルメ🍊🇯🇵 (@ayakabea) 2026年10月30日

The biggest hack in crypto history. $5.6 billion… Seriously, way too scary. (translated)

SOU (@SOU_BTC), October 29, 2026:

なあみんな。個人情報流出、怖いよな。

でも俺たち仮想通貨民は、突然北朝鮮に9,000億円盗まれたりしてるからさ。

おれたちのことを見て、安心してくれよな。 https://t.co/ookqTV3MGb
— SOU⚡️投資ニュース / 米国株・日本株・仮想通貨・AI (@SOU_BTC) 2026年10月29日

Hey all. Personal data leaks are scary, right? But we crypto folks get ¥900 billion suddenly stolen by North Korea. Look at us and relax. (translated)

日比野常法 (@hibino_news), October 30, 2026:

■#バイナンスの63億ドル規模の #ハッキング事件が機関投資家の資金流出を引き起こし、スタンダードチャータード銀行はさらなる打撃を警告している。 2026/10/30
【衝撃】バイナンスから約9,500億円（63億ドル）流出。中央集権型取引所（CEX）の資金移動が急加速しています。
— 日比野常法 (@hibino_news) 2026年10月30日

Binance’s $6.3B hack triggered institutional outflows; Standard Chartered warns of more damage. 2026/10/30 [Shock] ~¥950B ($6.3B) drained from Binance; centralized-exchange (CEX) fund flows rapidly accelerating. (translated)

Conclusion: With the Entry Point Still Unclear, Will the Promise to Cover Losses Be Kept?

What has been confirmed, and what remains to be checked

About $6.3 billion, by the company’s estimate, was drained from a Binance hot wallet used for transfers, halting withdrawals on the global platform and crypto withdrawals at the Japanese unit. Analytics firms point to possible manipulation of the very system that produces legitimate signatures.

Past cases show that the risk of people, devices, contractors, and approval workflows becoming entry points is shared by exchanges and banks alike. Both have defenses that stop transfers before they go out; the bigger difference lies in the routes for stopping or reversing a transfer afterward. Because those routes are limited for crypto assets, whether assets can be frozen and how well funds can be traced will shape how much is recovered.

In the markets, spreads briefly widened and Aave temporarily paused new deposits and borrowing. Further spillover will depend on how funds move once withdrawals resume and on how compensation progresses. The next points to watch are the proof-of-reserves results due by November 2, the acquisition of the remaining tokens, and how payouts proceed after withdrawals reopen.

If the entry point lies with people and approval procedures, and the routes for reversing a transfer are limited, what should users rely on to judge the safety of assets they leave on an exchange?

See you in the next article.

Frequently Asked Questions

How much was stolen from Binance?

By the company’s estimate, crypto assets worth about $6.3 billion were drained from a hot wallet at 20:05 UTC on October 29 (5:05 a.m. on October 30, Japan time).

Were private keys stolen?

Binance says it has so far found no evidence that private keys were leaked. Analytics firms TRM Labs and Elliptic say the signing system itself was likely manipulated, which would allow transfers with valid signatures without extracting the keys.

Is North Korea behind the attack?

TRM Labs attributes it with high confidence to TraderTraitor, a group described as North Korean, and Elliptic and Chainalysis also present their own assessments. These are private-sector analyses; no formal attribution by a government or law enforcement agency has been confirmed.

Are customers of Binance Japan affected?

Binance Japan says Japanese customer assets are held in cold wallets separate from the affected hot wallet and were confirmed safe. Only crypto withdrawals were halted as a precaution, and no resumption had been announced in its follow-up notice.

Who will cover the loss?

Binance says it will absorb the loss itself and has set aside more than $6.34 billion, including about $5 billion in the same tokens that were stolen. Proof-of-reserves results are due by November 2, but they do not show the company’s overall liabilities or funding position.

How did Japanese social media react to the Binance hack?

The four X posts featured here, which are not a measure of public opinion, include unease about personal asset security, shock at the scale of the hack, a sarcastic comparison with personal data leaks, and shared news coverage about institutional outflows.

Watch on YouTube

We publish explainer videos and Shorts summarizing our articles. If you’d like to catch up through video, visit our channel.

Sekahan on YouTube

We publish video summaries of articles like this one, along with short clips built around Japanese reactions.

Subscribe: Sekahan Japan Reacts