Binance Works With FBI on $3B Frozen Hack Funds, Buys Back Stolen Altcoins

Update: October 30, 23:18 UTC

Binance is preparing to restore withdrawals in phases, with each stage dependent on security checks, according to Bitcoin.com News. The outlet said investigators have also expanded their review of the breach.

CryptoPotato reported that Binance has revoked the affected address authorizations and is working with law enforcement and blockchain firms to trace and recover assets.

Cointelegraph reported that the attackers raced to convert stolen stablecoins into crypto that issuers cannot freeze, while Tether and Circle moved to immobilize billions of dollars. CoinDesk said experts are divided over the asset freezes and warned that recovery is a separate matter.

Update: October 30, 20:20 UTC

President Trump said he will review the $6.3 billion Binance hack, according to Crypto Briefing, bringing the White House into the matter. Crypto Briefing said the involvement underscores the growing intersection of cybersecurity and national security concerns.

The snippet gives no detail on what form the review will take or which agencies will take part.

Update: October 30, 18:46 UTC

Blockaid's on-chain analysis found that all 50 authorization variations were bundled into a single transaction, and only the one matching the wallet's account counter took effect, according to AMBCrypto's report on the findings. That detail explains why one authorization landed while the other 49 did not.

Protos reported that the attack on Binance's Ethereum wallets used EIP-7702 against at least one address, while regular transfers drained other addresses. Bitcoinist reported that the permission let the attacker move funds without requesting individual transaction approvals.

Update: October 30, 18:16 UTC

Circle froze more than $800 million in USDC tied to the Binance breach, with Decrypt putting the figure at $823 million, according to Crypto Briefing and Decrypt. The article's earlier $3 billion frozen total did not name Circle as one of the parties involved.

The U.S. Secret Service is now working with Binance and the FBI as investigators trace the stolen funds, Decrypt reported.

Update: October 30, 16:43 UTC

Binance CEO Richard Teng said the attacker used a self-destruct mechanism alongside an EIP-7702 delegation that bypassed the exchange's normal approval controls, according to Decrypt. The Defiant also reported Teng's account of the delegation bypassing wallet controls.

Crypto-linked stocks fell Friday as the breach coincided with a broader tech selloff tied to AI spending concerns, Bitcoin.com News reported. Coinbase dropped more than 12% and Strategy fell 6%, even after both reported quarterly profits Thursday night.

CoinDesk reported that Binance uncovered a wider breach in the exploit, though the snippet gave no further detail on its scope.

Update: October 30, 16:20 UTC

The attackers held 18,270 BTC and more than 500,000 ETH early Friday, according to Cointelegraph's reading of on-chain data. The Bitcoin stash is larger than Coinbase's reported corporate holdings.

Binance co-CEO Yi He said the exchange's revenue can cover the hack losses without selling SpaceX shares, Crypto Briefing reported. That revises the earlier suggestion that the SpaceX-linked stake might be used.

Bitcoin fell below $77,000 in an Oct. 30 sell-off, with Binance market data showing $76,944 shortly after midnight UTC, according to crypto.news. The Defiant reported $1.34 billion in long liquidations as leveraged bullish positions were unwound.

Update: October 30, 15:49 UTC

Aave froze 292 reserves across its V3 and V4 markets on 16 networks in response to the Binance breach.

Binance may also use a $1 billion SpaceX-linked stake to cover hack losses, CZ said, according to Crypto Briefing.

Separately, there are calls for THORChain to intervene, because North Korean hackers have previously used it to move stolen funds.

Update: October 30, 15:44 UTC

Binance co-CEO Teng is targeting a Sunday restart of withdrawals, The Defiant reported. Teng also said the exchange plans to publish a full Proof of Reserves report by Monday.

Teng said Binance is rebuilding its withdrawal service after the breach, according to The Defiant. He also said the attackers destroyed tools and traces during the intrusion, which could complicate the investigation.

Original report: October 30, 15:20 UTC

$3 billion frozen. $6.34 billion set aside. Binance is working with the FBI and law enforcement to recover the frozen portion of the Oct. 29 theft. It has also started buying back stolen altcoins using Bitcoin and Ethereum, sourced through company reserves and OTC desks.

The exchange said it will include the assets in its next proof-of-reserves report.

The balance sheet: Binance says it reserved over $6.34 billion in company funds to cover losses. It already holds $5 billion in the affected tokens and is buying the remainder through market and OTC channels. Industry partners froze the roughly $3 billion now at the center of the law enforcement push.

The loss figure still depends on who is counting. Binance's first estimate was $6.3 billion. Later tallies put it at $6.4 billion across 10 blockchains. BitOK's transaction-by-transaction tracing shows $6.15 billion leaving in 31 minutes.

Binance's first account of the breach pointed to a possible compromised DevOps laptop, and our earlier coverage laid out the attacker's use of EIP-7702 delegation on Ethereum. The on-chain picture has sharpened since.

The Ethereum leg

The attacker deployed a sweeper contract and sent 50 EIP-7702 authorizations targeting the address labeled Binance 14, all signed with that wallet's key. TRM Labs counted the same 50 pre-signed authorizations. Nonce values varied because the hot wallet was in rapid use.

EIP-7702, live since the Pectra upgrade on May 7, 2025, lets a standard externally owned account temporarily borrow smart contract code. Once one authorization landed, the sweeper ran as Binance 14 and emptied its ETH and tokens. The first major transaction moved about 167,464 ETH plus roughly $1.6 billion in USDT and dozens of other tokens, per blockchain analysts.

Chainalysis said an operational wallet funded through Tornado Cash submitted the authorizations. Binance eventually removed the delegation from Binance 14.

Ethereum hot wallet loss: about $2.5 billion. About $2.4 billion removed from Binance Ethereum wallets has been frozen or blacklisted.

Not an Ethereum flaw

Delegation was not the common thread. Binance 16 sent funds out through a normal transaction. Base, Optimism, Arbitrum, Avalanche and Polygon saw ordinary transfers too. Across the other nine chains, Binance wallets moved funds via plain signed transfers.

TRM said that pattern points to compromise of Binance hot wallet signing infrastructure, not a flaw in Ethereum. Delegation was mostly a convenience: the attacker could already sign with the Binance 14 key. A legitimate feature became part of an attack once authorization controls fell.

Attribution and breach scope

TRM Labs and Chainalysis both attributed the theft to North Korea's TraderTraitor, the group behind the $1.5 billion Bybit hack in February 2025. Binance said its investigation began with a compromised engineer's laptop and has found "additional points of breach." It reported no evidence that wallet private keys leaked.

What it means

The freeze is the number to watch. Roughly $3 billion of a loss estimated as high as $6.4 billion is locked, which makes a large share potentially recoverable through the FBI effort.

Binance is not waiting on that outcome. The $6.34 billion reserve covers the full loss estimate, and the altcoin buybacks replace user-facing tokens now.

The proof-of-reserves commitment gives outsiders a check. The next report will show whether the $5 billion in held tokens plus market and OTC purchases add up. With a Bybit-scale actor named and "additional points of breach" still turning up, the open question is how far the signing infrastructure compromise extends.