The Binance security incident is still unfolding, and the numbers attached to it come mostly from company and executive statements that have not been independently verified. On Oct. 30, Binance reported a security incident, and according to a CoinGabbar report that collects the statements, the exchange puts about $6.3 billion in assets as involved, with about $3 billion frozen on-chain. Deposits and withdrawals are paused.
What Binance and others have said
Binance said an engineer’s laptop may have been breached; the word “may” matters, because the cause has not been confirmed. Yi He, a Binance executive, said user funds are safe and that Binance will cover losses, with a full report to follow. Binance co-founder Changpeng Zhao said the exchange “appears to have been hacked” but that user funds are safe.
Other exchanges moved to distance themselves. Bybit and Gate both said they were not affected, per the same report.
The numbers do not agree yet
The figures differ depending on who is counting. Shen Yu, co-founder of the custody firm Cobo, estimated abnormal transfers across Ethereum, TRON and Bitcoin peaked at about $5.8 billion, and noted that about $1.4 billion of bitcoin transfers were not confirmed as stolen. A separate market note from Saxo Markets said more than $2.5 billion in affected funds had been frozen, a lower figure than Binance’s $3 billion. Binance’s own investigation was still ongoing, so all of these may change.
The stablecoin issuers have also acted. The CEOs of Tether and Circle said they had frozen more than 1.567 billion USDT and more than 800 million USDC, respectively. Those are executive statements, not published transaction records.
How the Binance security incident may have worked
The mechanism described so far comes from the security firm Blockaid. As relayed in the report, a Binance hot wallet signed an EIP-7702 transaction that contained 50 authorization requests. Blockaid said attackers pointed 14 hot wallets to a malicious contract, and only one of the 50 authorizations matched, after which assets began moving out in batches.
EIP-7702 is an Ethereum feature that lets an ordinary wallet temporarily act like a smart contract. Derek Chiang, founder of ZeroDev, said the standard itself was not breached; an attacker would need private keys or a tricked signature. That fits with Binance’s laptop theory, but it is not proof of it.
Aave, a lending protocol, said its smart contracts are unaffected, though it froze its DAO-operated V3 and V4 markets as a precaution. LlamaRisk said an attacker’s loan of 19,762 WETH, about $44.6 million, remains fully collateralized.
Market reaction
The crypto market fell as the news spread. CoinGecko data cited in the report showed total market capitalization down 3.7% to $2.67 trillion at 4:00 a.m. UTC, bitcoin down 2.2% to $78,028.67, and ether down 3.1% to $2,231.77. The Fear and Greed Index dropped to 30 from 51. The report notes the drop coincided with the incident but does not prove the incident caused it.
The incident is a reminder that attacks on crypto firms often exploit people and credentials rather than code. A recent Korean bank case turned on cheap credential attacks, not clever exploits, and phishing-resistant sign-in such as passkeys addresses the same weak point for individual accounts.
Editor’s take
Treat the early numbers as ranges, not facts. The gap between $2.5 billion and $6.3 billion is the gap between what is frozen, what moved and what was actually lost, and Binance’s full report is the document that should separate them. Until it arrives, the careful reading is that this is a large security incident with unresolved scope, and that the promise to cover customer losses is a statement of intent, not yet a published accounting.
