At 20:05 UTC on Thursday 29 October, attackers began draining Binance's hot wallets. Inside about twenty minutes they had taken the bulk of roughly $6.3bn, across ten blockchains on TRM Labs' count and eleven on Elliptic's. It is the largest theft in the history of cryptocurrency, around four times the Bybit hack.
BNB Chain is on neither list. Binance's own BNB holdings were never touched.
BNB fell further than any major coin anyway.
This article is about why, because the answer explains what the token actually is. It also covers what Binance has done since, which is genuinely unusual, and the one question nobody is asking.
1. What was taken, and from where
The attackers did not steal private keys. According to TRM Labs and Elliptic, they compromised the systems that sign transactions. On Ethereum they used an EIP-7702 delegation with 50 pre-signed authorisations, and the wallet was emptied three and a half minutes later. The other chains went out through ordinary signed transfers.
The chains hit were Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon, with Elliptic adding NEAR. Binance first blamed a compromised engineer's laptop; within twelve hours that had become "additional points of breach", then "a more complex attack process". No root cause has been published.
On Saturday the FBI attributed the theft to TraderTraitor, a North Korean group, matching a high-confidence assessment from TRM. Binance itself has still not attributed it to anyone.
The relevant detail is what is missing from that list. BNB Chain was not drained, and Glassnode data reported by FinanceFeeds shows Binance's BNB balance was left untouched. Not one BNB was stolen.
2. BNB fell harder than anything else
BNB traded at $744.90 before the theft, which CoinGecko's hourly series corroborates at $744.12. It then fell further and faster than the assets that actually were stolen. The lowest print reported anywhere we can find is $680, about 8.7% down, but that figure traces to a single origin and hourly spot snapshots bottom higher, near $697. The 24 hour move is the better-sourced number.
In the 24 hours after the theft | Fall |
|---|---|
BNB | −6.2% |
Ether | −4.0% |
Bitcoin | −3.1% |
Those are CoinDesk's figures to 07:09 EDT on 30 October. BNB underperformed bitcoin by about three percentage points on a day when bitcoin holders had 18,270 coins stolen and BNB holders had none.
On the ApeX BNBUSDT contract the move was sharper still. The hourly bar beginning 20:00 UTC, the bar containing the theft, opened at 746.09 and printed a low of 669.35, a fall of 10.3%, on volume 5.8 times the median of the preceding ten hours. Perpetuals overshoot spot in a liquidation cascade and this one did. Market-wide liquidations reached about $1.57bn, a fourfold jump.
The derivatives market said the same thing in a different language. BNB funding on OKX flipped from +0.01% before the hack to −0.0266% at midnight and −0.0434% by 08:00 UTC, meaning shorts were paying longs to stay short. Bitcoin's funding stayed positive throughout. That divergence is about as clean a measure of asset-specific fear as the market produces.
3. What BNB was actually pricing
If no BNB was stolen and BNB Chain was untouched, the fall cannot be about lost coins. It is about what BNB is a claim on.
FinanceFeeds put it in one line that is worth keeping: "What traders are pricing is exchange risk, not stolen tokens."
Here is the scale of it. CoinGecko had BNB's market value at $92.72bn at a price of $705.10 on 31 October, which implies a circulating supply of about 131.5m BNB. Holding that supply constant, which is reasonable over three days given the quarterly burn completed on 19 October before the hack:
Price | Implied market value | Change | |
|---|---|---|---|
Before the theft | $744.90 | about $97.9bn | |
At the low | $680 | about $89.4bn | −$8.5bn |
Now | about $714 | about $93.9bn | −$4.1bn |
At the low, BNB holders had lost about $8.5bn of market value over a theft of $6.3bn. The token briefly priced the damage at roughly 1.35 times the size of the hole. It now prices it at about 0.65 times.
That arithmetic is ours, not a published figure, and we show the working so you can check it. The point does not depend on the decimal places. A token in which nothing was stolen lost more market value than was stolen, because what the market was repricing was the probability that Binance could not cover the loss.
There is a bull reading of the same fact, and it is fair. Rick Maeda of Laevitas called the drop "quite modest for possibly the largest exchange theft ever", pointing at Binance's roughly $144bn of assets under custody, against which $6.3bn is about 4.4%. That is Laevitas's estimate of customer assets; the $165bn cited later is Binance's reported reserves, a different measure.
4. Binance replaced the money. It did not recover it.
This is the distinction that most of the coverage has blurred, and several outlets have run headlines saying Binance "recovered" 95% of the funds. That is wrong, and Binance's own word is more careful. Teng said on Sunday: "We've now replenished approximately 95% of the impacted assets."
Replenished. Binance is buying or supplying the missing coins from its own balance sheet. The stolen funds are still gone.
Binance says the money came from three places: the Secure Asset Fund for Users, excess reserves from its Futures Insurance Fund, and the corporate treasury. It announced a reserve of more than $6.34bn on 30 October, and said about $5bn of that was already held in the exact tokens required.
SAFU is the only one of the three whose size is public. In February 2026 Binance converted it entirely into bitcoin, 15,000 BTC, about $1bn at the time, publishing the address and transaction. At the hack-day price that is roughly $1.17bn.
But Binance did not spend all of it. Co-chief executive Yi He said half of SAFU would be used, and an on-chain transfer of 7,499 BTC, about $581m, matches that. So the insurance fund covered roughly 9% of the loss, not 19%. Binance has committed to refilling it to about $1bn. The overwhelming majority of the replacement is ordinary company money, and Binance has published no breakdown of how much came from the treasury versus the futures fund.
Why that matters is clearer against what has happened to everyone else.
Event | Loss | What users got | How long | Mechanism |
|---|---|---|---|---|
Binance, 2026 | $6.3bn | 95% claimed | about 58 hours | Company absorbed it |
Bybit, 2025 | $1.46bn | 100% | about 72 hours | Borrowed, including 40,000 ETH from Bitget |
Bitfinex, 2016 | 119,756 BTC | 36% cut from every account, including untouched ones, then repaid in full | about 8 months | Loss socialised, then bought back |
WazirX, 2024 | about $235m | 85% of claim value | about 15 months | Court-sanctioned scheme |
Celsius, 2022 | about 65% cumulative, at prices fixed at $19,881 per bitcoin | about 18 months | Bankruptcy | |
FTX, 2022 | about 119% of allowed claims, at petition-date prices | about 2 years 3 months | Bankruptcy | |
Mt Gox, 2014 | 650,000 to 850,000 BTC | still running | about 12 years | Bankruptcy |
The Binance row is an outlier in kind, not just in speed. Every bankruptcy case meant courts, years, and claims frozen at the prices of the day the exchange failed, which is why Celsius creditors were paid on bitcoin valued at $19,881. Bitfinex took 36% from everyone, including accounts never breached, and took eight months to make them whole. Bybit was faster than Binance but at under a quarter of the size, and Bybit borrowed to do it.
If Binance's 95% holds, it is the best outcome users have had from a large exchange loss. The thing that makes it remarkable, self-funding at this scale, is also the thing nobody has verified. And it was slower than promised: Binance had told users to expect withdrawals within 45 hours, which would have been Saturday evening. Phase one opened about 58 hours in.
5. The $3bn question nobody is asking
Within an hour of the theft, stablecoin issuers began freezing the stolen funds. Tether blacklisted the main receiving address at 21:01 UTC, immobilising about $971m of USDT, and kept going: its own total reached more than $1.567bn. Circle froze about $823m of USDC three minutes later. Further freezes followed from Ripple, World Liberty Financial, First Digital and the Arbitrum security council.
How much is frozen depends who you ask. Binance says about $3bn. TRM says about $2.7bn. Elliptic, the only independent verification we found, puts it at $2.85bn, or 44% of the theft on its own figures, and almost all of it is stablecoins. Nothing taken in bitcoin, XRP or solana has been frozen, because no issuer has the power to do it. CZ credited the FBI, Secret Service and IRS with help on "tracking, freezing, etc.", and argued much of the credit for bitcoin not falling further belongs to them.
Frozen is not returned. CoinDesk canvassed lawyers and the answers were consistent: freezing is "only the first step", issuers can invalidate and reissue tokens but ownership has to be established, and court orders may be needed in several jurisdictions. No issuer has committed to returning anything to Binance. Meanwhile the attacker is working around the freezes, converting about $786m of stablecoins into ETH and TRX at a discount of more than 10% on at least one swap.
Now the part that is not being asked.
The $6.34bn Binance set aside excludes the frozen $3bn. That is explicit: a Binance spokesperson confirmed the $5bn core is held in the exact tokens required, and reporting on the reserve states the frozen funds are not counted in it.
So Binance has reserved more than 100% of the gross loss, while roughly $3bn sits frozen on-chain, outside that reserve.
So the net figure, if the frozen funds come back, is nearer $3.3bn than $6.3bn. That arithmetic is not new: 21Shares reaches the same number, and CertiK's estimate of the gap Binance must fill assumes it.
What nobody is asking is the question underneath it. If those funds are released after Binance has already made users whole from its own money, Binance keeps them. And if release requires proving ownership in court while those customers have already been compensated, who has standing to claim? AMBCrypto reports the $3bn will be pursued "through separate legal channels," which is the closest thing to a position anyone has stated. We have put the question to Binance and will update this article if it responds.
None of which is a criticism. Absorbing $3.3bn is still extraordinary. But it is a materially different number from the one in the headlines.
6. The number that should give you pause
The strongest version of the sceptical case does not come from a critic. It comes from Binance's own numbers.
Binance's proof of reserves as of 1 October showed customer balances of about $134bn against on-chain holdings of about $136bn. That is roughly $2bn of excess over what it owes its users. After SAFU and the frozen funds, the gap Binance has to fill from its own resources is about $2.1bn, on CertiK's estimate.
The surplus and the hole are approximately the same size.
There is a fair counter, which CertiK makes in the same breath: $2.1bn is about 1.3% of Binance's reported $165bn of reserves. The difference is the denominator, and only the excess over customer balances can absorb a loss without touching customer assets.
What else is unverified is worth listing, because the market is trading on it:
The 95% is entirely Binance's own statement, announced as 80%, then 90%, then 95%. CertiK says it needs more information to verify the $5bn on-chain, and Nansen could not verify the emergency fund beyond about $1.16bn.
The proof of reserves is a self-published snapshot of ten assets, taken at 00:00 UTC on 31 October, with no auditor named. A full cryptographic report is promised for either 2 or 3 November, depending which Binance statement you read.
It was taken after replenishment began, so no public figure exists for how large the hole ever was.
The wallets changed underneath it. At 06:53 UTC Sunday Binance added newly generated addresses to its proof-of-reserves list and said all withdrawals would run from them. Sensible after a signing compromise, but the snapshot and the live addresses are now different sets.
Most of the replacement money has not been traced on-chain. The SAFU leg was, within 48 hours, which is how we know only half of it was spent. The corporate treasury and futures fund portions, which are the bulk of it, have not been. That is the central verification gap and the one an analyst could close this week.
Binance is private, so none of this can be checked against audited accounts. Estimates of its annual revenue run from about $5bn, CZ's own figure, to $16bn or $17bn, an Artemis estimate quoted by Forbes. A threefold disagreement about the size of the company absorbing the loss is itself worth knowing.
What to watch this week
The full proof-of-reserves report, due Monday or Tuesday. Whether it is a cryptographic attestation or something an auditor signs will tell you a lot.
The rest of the withdrawals. Phase one opened at 06:00 UTC Sunday with bitcoin, and Binance added networks through the day on its own feed, BNB Smart Chain by 07:49 and Zcash, TON and Sui by 12:36. Binance later confirmed all 15 networks were live by 12:36. What is left is the long tail of smaller assets, the part of the replacement most likely to slip.
And how much leaves. Once the gates opened, net outflows ran between $1.0bn and $2.5bn depending on source and window, against platform assets near $156bn. That is the one verdict nobody can spin. Binance said at 16:12 UTC that after an initial spike, withdrawal volumes had declined and were stabilising.
Independent verification of the 95%, of which there is still none.
Whether the frozen funds move, and to whom. The regulatory response, thin so far for the largest theft in financial history. The CFTC's chair has floated voluntary federal registration for offshore exchanges, covering cybersecurity and custody, with comments open to 14 December. Asked about the hack on Saturday, President Trump said: "We're looking into it. I'm not worried."
BNB is about 4.6% below where it was before the theft, bitcoin about 3.7%. The gap between those two numbers is the market's running estimate of how much of this Binance still owns. In the first 24 hours it was about three percentage points. It is now about one.
Trade the markets in this article
An exchange token is a leveraged claim on that exchange, which is what the last three days demonstrated: BNB fell twice as far as bitcoin over an event in which no BNB was taken. Size it as counterparty risk, not a layer-one bet.
And the contract is not the spot price. The ApeX perpetual printed 669.35 in the hack hour while spot recorded about $680. In a fast cascade a perpetual can trade through spot either way: an opportunity with a resting order, a problem with a stop.
Race to the Top 50 is live
Trade your way up the leaderboard. A prize pool of up to 10,000 USDT, paid down to 50th place.
ApeX is running a trading competition until 5 November, 10:00 UTC, with a prize pool of up to 10,000 USDT paid down to 50th place on the leaderboard.
The pool unlocks in tiers on total campaign volume, so it stays locked below 30,000,000 USDT and reaches the full 10,000 USDT at 100,000,000 USDT. Your score is the sum of four parts: trading volume, realised profit percentage, net deposits and referrals. Qualifying requires registration through the campaign page, at least 100 USDT in your perpetual futures account, at least 10,000 USDT of eligible volume, and a Top 50 finish.
You can join from the campaign page, and the full rules and prize table are in the Race to the Top 50 announcement.
Trading perpetual contracts carries a high level of risk and can result in the loss of your entire position. Leverage increases both gains and losses. Nothing in this article is financial advice. Do your own research and never risk more than you can afford to lose.
If you need any help, feel free to reach out to our team on Discord.
Website: https://www.apex.exchange
Twitter: https://twitter.com/OfficialApeXdex
Telegram: https://t.me/ApeXdex
A fast-moving story, correct at the time of writing on 1 November 2026. The theft is reported at $6.3bn by Binance, $6.36bn by TRM Labs, $6.43bn by Elliptic and $6.4bn by Chainalysis; we use Binance's own figure. Frozen totals differ too: $3bn from Binance, $2.85bn independently verified by Elliptic, $2.7bn from TRM. BNB spot prices and market value are from third-party aggregators; the implied supply of about 131.5m, and therefore every market-value figure in section 3, is our own arithmetic, though it sits within 0.01% of CoinGecko's published supply and of BNB Chain's own post-burn figure. ApeX figures are perpetual contract prices, not spot, which is why the contract low sits below the spot low. The 95%, the 100% backing claim and the composition of the reserve are all Binance's own statements, none independently verified.
