Binance's $6.3 billion theft: After promising full compensation, what else do users need to verify?
Asset replenishment, withdrawal resumption, and signing control—each of these three matters requires its own evidence.
Binance disclosed the theft of approximately $6.3 billion in crypto assets and pledged to cover the losses. For users, whether assets have been replenished, whether withdrawals can be restored, and whether the signing system is secure require different pieces of evidence to answer. The 2019 Binance theft and the 2025 Bybit incident provide comparable case studies. GFM News reviewed company announcements, on-chain research, and regulatory documents to question which promises made during this crisis were based on evidence, which safeguards still need verification, and how accountability will be determined for major decisions.
(Image caption) The modern glass office building exterior of the global financial center signifies the institutional presence and global operational structure of a large-scale crypto asset platform.
Funding readiness still needs to be verified
Around 20:05 UTC on October 29, 2026, a large-scale unauthorized transfer of assets occurred in Binance's hot wallet. The company subsequently disclosed that the stolen token assets were valued at approximately $6.3 billion and pledged to cover the losses using the User Security Asset Fund (SAFU) and company funds.
Binance stated that it has reserved over $6.34 billion in company funds, of which approximately $5 billion is in tokens corresponding to the stolen tokens, with the remainder still being used for purchases. The company has also suspended withdrawals, planning to resume them in phases after completing security checks, and will provide updated proof-of-reserve results on November 2nd.
These are the company's published funding arrangements and operational goals. As of the date of this document, they cannot be rewritten to indicate that all assets have been replenished, withdrawals have been fully restored, or that the arrangements have been independently financially verified.
For users who leave assets on the platform, the commitment to cover losses is meaningful, but they still need to know how the assets are secured, how to support their account balance, and when they can be retrieved through normal procedures.
GFM News' previous research on Binance already touched upon management division of labor and global platform responsibility. This incident provides concrete examples to examine these issues: who manages the funds, who approves the restoration of services, and how are security control failures handled?
Freezing and replenishment should not be mixed.
TRM Labs' on-chain analysis estimated the outflow of assets at approximately $6.36 billion, involving ten blockchains. The main transactions were concentrated within about 20 minutes, but another wave of outflows followed, so the entire event cannot be summarized as a single operation completed by all ten chains at the same time.
Binance and TRM's estimates are close, but a precise comparison requires standardization of trading scope, asset identification, and valuation timeframes. Without complete transaction-by-transaction reconciliation data, it's premature to conclude that the difference between the two figures entirely stems from price fluctuations.
The amounts frozen also differ in their estimates. Binance announced that approximately $3 billion in assets had been frozen; TRM, based on observations as of 00:30 UTC on October 30th, estimated it at approximately $2.7 billion. Since the observation periods and coverage of the two are not entirely consistent, it cannot be directly concluded that either is incorrect, nor can they be added together.
Readers need to distinguish between four states: assets transferred away, assets frozen, assets recovered, and the company providing replacement assets. These figures describe different levels of control and financial outcomes.
Freezing assets can restrict their movement, but it does not mean that the assets have been returned to the platform, nor does it mean that they can be immediately used to process withdrawals. Whether the return requires the issuer's intervention, law enforcement procedures, or ownership confirmation still needs to be determined on a case-by-case basis.
Using its own assets to cover the shortfall is another arrangement. If the stolen assets are subsequently recovered, the accounting and disposal methods will need to be explained to avoid the same asset being included in the insurance coverage multiple times at different stages.
Currency matching is equally important. If users hold a certain amount of Bitcoin or Ethereum, the platform needs to have the ability to fulfill corresponding withdrawals; a comparable USD valuation does not necessarily mean that all corresponding tokens have been allocated. Therefore, remaining purchase progress, asset restrictions, and withdrawal requests should all be included in subsequent verification.
(Image caption) A file photo of the nCipher hardware security module, taken in 2008. These devices are used for key protection and cryptographic operations, providing a physical reference for understanding signature controls; the photo is not of a Binance device and does not represent the confirmed compromised system in this incident.
How signing ability was lost
Binance initially stated that a DevOps engineer's laptop may have been compromised, allowing attackers to access service containers and submit unauthorized withdrawal transactions. Subsequent investigations uncovered other points of intrusion, and the company stated that at the time, there was no evidence of wallet private key leakage.
The absence of private key leakage is insufficient to prove that signing privileges were not abused. Different forensic evidence is needed to determine whether an attacker copied the key, controlled the signing service, or obtained valid authorization through other means.
TRM points out that the operations on Ethereum involved EIP-7702 authorization and pre-prepared signatures, and transactions transferring funds to the attackers were also observed on other networks, leading to the conclusion that Binance's hot wallet signing infrastructure may have been compromised. This analysis is based on the research institution's investigation; the complete internal attack path still requires further system identification.
EIP-7702 allows accounts to authorize the execution of code on other addresses through signing authorization. The presence of this mechanism in the attack transaction does not alone prove a vulnerability in the Ethereum protocol, nor does it explain how the attacker initially obtained the authorization capability.
The fact that a transaction is accepted by the blockchain does not mean it complies with the platform's internal approval process. The investigation still needs to clarify how the attackers obtained the signing or authorization capabilities required to transfer assets, and why other platform controls failed to intercept it in a timely manner.
Technical reviews therefore need to go beyond the initial entry point of intrusion, explaining the isolation between employee devices and the production environment, the review methods for different authorizations, the interception conditions for abnormal withdrawals, and the decisions and actions taken after an alarm is issued.
This also relates to fairness to practitioners. Equipment intrusion may be a crucial factor, but placing all the blame on a single engineer before a full investigation is necessary would prematurely narrow the chain of control that needs to be examined.
(Image caption) A simplified technical diagram based on the official Ethereum EIP-7702 specification, illustrating the relationship between signing authorization, verification, storage of delegated pointers, and execution code. On-chain signature validity does not equate to compliance with the platform's internal approval procedures; this diagram is not a reconstruction of a Binance attack path.
How SAFU participates in supplementation
SAFU is a user protection fund established by Binance, but its name cannot replace verification of its current size, asset composition, and usage conditions.
On February 12, 2026, The Block reported that Binance announced the completion of its arrangement to convert its stablecoin reserves into Bitcoin, at which time it held 15,000 Bitcoins, valued at approximately $1.005 billion at the time of completion. This historical data cannot be directly used as the fund balance at the time of the October events.
Bitcoin prices, holdings, and fund usage may all be adjusted. Therefore, using the February dollar valuation to calculate the current coverage gap multiple will mix different time bases and cannot accurately reflect the current capacity to bear the risk.
What needs to be clarified this time is: how much SAFU and other company assets were actually used, whether there is any overlap in the accounting, and how much contingency buffer is still retained after replenishment. The relationship between the funds the company claims to have reserved and SAFU should also be clearly calculated and disclosed.
The scope of coverage directly impacts user rights. Whether the commitment to replenish stolen assets covers withdrawal delays, transaction losses, or other indirect impacts cannot be presumed but should be determined based on this arrangement and applicable terms.
For users, a usable guarantee also requires a clear application process, processing timeline, and dispute resolution method.
How to compare historical cases
In May 2019, Binance disclosed a stolen transaction involving 7,000 bitcoins. The company's announcement at the time stated that the transaction passed existing security checks and only triggered the alert after execution; the company announced that SAFU would cover the loss and suspended deposits and withdrawals for security review.
This case does not prove that the attack had the same cause, but it provides an important comparison: filling asset gaps and restoring control measures always need to be evaluated separately. While a company absorbing the losses can mitigate the direct asset impact on users, it cannot prove that the same risk has been eliminated.
The Bybit incident in February 2025 provides another point of reference. On February 26th of that year, the FBI confirmed that North Korea was responsible for the theft of approximately $1.5 billion in virtual assets, describing the malicious cyber activity as "TraderTraitor." This official conclusion pertains to the Bybit case and cannot be applied to the enforcement attribution in the current Binance incident.
Following the incident, Bybit announced the restoration of adequate reserves for the assets under review. Hacken's own public statement also records that a temporary reserve check was conducted on February 23, confirming that the reviewed reserve ratio was above 100%; the organization also clarified that its role was limited to reserve checks and that it did not provide security assessments for Bybit.
This limitation is crucial. Reserve checks provide information on a specific range of assets and liabilities, while security investigations require other procedures; adequate reserves in a report cannot be extended to a guarantee of system security.
Different events have different asset structures, withdrawal needs, and funding sources. While recovery speeds can be compared, they are insufficient to determine the merits of individual handling. A more valuable comparison is whether the company has provided sufficient information for external verification of the remedial results.
(Image caption) Night view of the FBI headquarters in Washington, D.C., official file photo. The FBI will release its findings in February 2025 regarding North Korea's involvement in the Bybit asset theft case; this case can be used for historical comparison, but cannot be directly used as the cause of law enforcement action in the current Binance incident.
How much can the reserve certificate answer?
Binance has proposed updating its Certificate of Reserve (CPR) to become an important document for checking asset protection, but the report title cannot replace reading the methodology and scope.
On March 8, 2023, the Office of Investor Initiatives of the Public Company Accounting Oversight Board (PCAOB) issued a notice stating that proof of reserves has inherent limitations and may not be able to answer whether assets have been borrowed, whether they remain available to users, and whether internal controls are effective. This document is a staff advisory from the office and is not a new rule issued by the PCAOB, nor is it a ruling specific to this case.
Readers need to understand which currencies and liabilities are included in the report, what the data base date is, whether there are any restrictions on assets, and what procedures the verifiers actually performed. A user confirming that their balance is included in a calculation is a different matter from the complete disclosure of all company liabilities.
The actual performance after withdrawals resume provides another type of evidence. Whether the platform gradually restores services according to the announcement, and whether requests for withdrawals that meet the normal conditions are processed, can all be observed.
However, a successful withdrawal only reflects the service capacity at a specific point in time and must be judged together with the balance sheet information. It cannot be used to prove that all security issues have been resolved.
Who should bear the responsibility for major decisions?
The joint announcement signed by He Yi and Richard Teng expresses the current management's commitment. The next step is to understand how this commitment is translated into major decisions and the allocation of responsibilities.
Who approved the suspension of withdrawals, who approved the use of funds, to whom the security team reports, what acceptance tests are required to restore service, and who decides the scope of external investigations are all governance questions that can be answered specifically.
These questions do not require companies to disclose sensitive details that may have assisted attackers, but they do help outsiders understand decision-making and oversight arrangements. The effectiveness of a dual-CEO structure should also be evaluated based on decision-making records and execution results.
Zhao Changpeng's public influence needs to be treated separately from his formal management authority. A founder's public expression of confidence does not directly prove that he approved a particular funding or security decision; determining actual control still requires authorization documents and traceable evidence of decision-making.
The online clash between Musk and Zhao Changpeng has increased public attention, but the available information is insufficient to establish a causal relationship between the comments, attacks, or capital outflows. While verbal exchanges can provide context for public opinion, they cannot replace investigations into assets, services, and responsibilities.
(Image caption) This 2017 file photo shows the transfer of Bitcoin from the Kraken exchange to the Ledger hardware wallet. It illustrates the asset transfer between an exchange account and an external wallet, echoing this article's focus on the actual execution of withdrawals; the image is not a Binance withdrawal record.
Institutional boundaries of freezing capabilities
TRM's observations as of 00:30 UTC on October 30 indicate that attackers still control approximately $2.4 billion in assets not subject to direct freezing by stablecoin issuers. This is a point-in-time estimate and should not be considered a continuous balance.
The lack of an issuer-based freezing mechanism does not mean that assets are out of all law enforcement and asset recovery channels. Further actions may still involve exchanges, asset seizure, obtaining keys, or other return procedures, and the outcome cannot be guaranteed in advance.
While some assets can be frozen, clear authorization and procedures are required. Who has the right to make a request, how to confirm ownership, how to handle accidental freezing, and how the rights holder can appeal all relate to ensuring fair enforcement.
This has direct research value for Web4 and RWA, which are the focus of GFM News. After assets are put on the blockchain, circulation functions, emergency controls, and rights relief should be designed together. We cannot wait until transactions are interrupted or assets are stolen before starting to look for the responsible party.
Trust repair depends on specific results
As of October 30, the available information is insufficient to prove Binance is insolvent, nor is it sufficient to declare the crisis resolved solely based on public commitments. The actual remedies implemented by the company should be accurately reported, and any unverified aspects should continue to be examined.
GFM News' assessment is that the platform can reduce the direct impact on users by absorbing the losses with company assets; whether trust can be restored depends on whether the asset replenishment is verifiable, whether withdrawals can be fulfilled, and whether the security failure is handled traceably.
Next, key points to observe include the company's committed reserve documentation, the progress of withdrawals at each stage, and technical reviews. Each document should be read according to its actual scope; completing one item does not replace the rest of the work.
For ordinary users, these systemic issues ultimately boil down to specific life arrangements: whether they can retrieve their funds when needed, who to appeal to when losses occur, and whether the platform's promises can be asserted as legitimate rights.
If global crypto platforms are to assume broader financial functions, these rights need to remain exercised even during crises.
Disclaimer
This article is based on publicly available information as of October 30, 2026, and is for news research and reference only. It does not constitute investment, transaction, legal, or tax advice. The matter is still under investigation, and the amount and service status may be updated. Readers should check the latest announcements and applicable terms.