Crypto exchange Binance hacked: Secret Service joins the $6.3bn hunt

What changed. US agencies stepped in, Binance said it has begun recovering assets, and its co-CEO gave a fuller account of how the attack worked.

Who is helping. The US Secret Service says it is working "around the clock" with private sector partners "to identify, freeze, trace, and recover funds". It is coordinating with the US Attorney's Office for the District of Columbia. It says the investigation is early. The FBI said it is aware of the incident and is working with public and private partners.

Money. Binance estimates the total impact at around $6.3bn. Its earlier announcement said about $3 billion was frozen on-chain. A later update said it has begun recovering affected assets for users and has reserved over $6.3bn to cover the incident. It added that frozen or protected assets are still being recovered and verified. We found no newer frozen total in the sources we opened.

How it happened, so far. Binance first said a compromised DevOps engineer's laptop may have given the attacker access to a service container, which was used to submit unauthorised withdrawals. It found no evidence that wallet private keys leaked. Teng later said the laptop was only part of the story. There were additional points of breach, more than one person was involved, and the attacker used a self-destruct mechanism that wiped tools and traces. He said the attacker used a feature called EIP-7702 to get approval to act over a hot wallet, and that this step did not pass Binance's normal approval controls. A hot wallet is one kept online for fast withdrawals. Teng said the vast majority of user assets sit in cold wallets and that Binance never uses customer funds.

Users. Withdrawals stay off until the rebuilt service passes what Teng called rigorous testing. He said Binance is on track to resume within 40 hours. We do not know when that clock started, so treat it as a target. Deposits are not affected. A full proof of reserves report is promised by Monday, with an initial view before. If you hold coins there, check your balances, history and security notifications in the official app and use an authenticator app or passkey rather than text messages. A normal-looking account does not prove nothing happened.

Who did it. Not confirmed. TRM Labs says it has high confidence that the North Korea-linked group TraderTraitor, also called Lazarus, is responsible. Chainalysis says it has a high degree of confidence and saw funds from this hack mix with funds from another exchange hack last month. North Korea has always denied such hacking. Binance did not answer the BBC on a link.

More context is in our investigation of the on-chain flows (freekonomist.com/investigations/binance-hack/) and on our Binance exchange page (freekonomist.com/exchanges/binance/).

حقائق مؤكدة

• Binance estimates the total impact at around $6.3B. The BBC says it is thought to be the largest hack of its kind in history.^[1][2]
• Binance said about $3 billion was frozen on-chain so far, that withdrawals are temporarily suspended while security checks are completed, and that deposits remain unaffected.^[1]
• Binance said it has begun recovering affected assets for users and has reserved over $6.3bn to cover the incident. It said frozen or protected assets remain subject to ongoing recovery and verification.^[2]
• The US Secret Service said it is working around the clock with private sector partners to identify, freeze, trace and recover the funds, and is coordinating with the US Attorney's Office for the District of Columbia. It said its investigation is in its early stages.^[2]
• The FBI said it is aware of the incident and is engaged with public and private partners to understand its scope.^[2]
• Binance's first finding was that a compromised DevOps engineer's laptop may have allowed access to a service container and unauthorised withdrawal transactions. It found no evidence of a wallet private key leak and will publish a technical post-mortem.^[1]
• Co-CEO Richard Teng said the attack was not carried out by one person, that further points of breach were found beyond the laptop, and that the attacker used a self-destruct mechanism that destroyed tooling and traces.^[2]
• Teng said the attacker used EIP-7702 to obtain on-chain execution approval over a hot wallet, and that the delegation did not pass Binance's normal approval controls.^[2]
• Binance said it will cover all losses from the SAFU fund and the company's funds, and that user funds are safe.^[1]
• Teng said Binance never uses customer funds, and that the vast majority of user assets sit in cold wallets and move to a hot wallet only when a user withdraws.^[2]
• Withdrawals stay off until the rebuilt service passes rigorous testing. Teng said Binance is on track to resume within 40 hours.^[2]
• Teng said Binance will share a full proof of reserves report by Monday, with an initial view before. Binance also said it will publish an updated proof of reserves once remediation is complete.^[1][2]
• TRM Labs said it has high confidence that North Korea-linked TraderTraitor (also known as Lazarus) is responsible, and Chainalysis said it has a high degree of confidence. Chainalysis said it saw stolen funds mix with funds from another exchange hack last month. North Korea has always denied such hacking, and Binance did not respond to the BBC on a link.^[2]
• Binance has not published a list of affected customer accounts. The BBC advises checking balances, transaction history and security notifications in the official app, and notes that no unusual activity does not guarantee funds were unaffected.^[2]

التبعات

• مؤكدUS federal agencies, the Secret Service and the FBI, are now involved in the investigation.
• مؤكدWithdrawals were still off in the latest update we read, and Binance gave only a target for restarting them.
• قراءتناNorth Korea is behind the hack. This is the view of two analytics firms, not a finding by Binance or a government.
• قراءتناFunds kept on an exchange depend on the exchange's own security and promises. That is our reading.

لا يزال مجهولًا

• When withdrawals will actually restart
• How much has been recovered or frozen now: the only figure we found is Binance's earlier $3 billion frozen
• Who carried out the attack
• What the proof of reserves report and the post-mortem will show

من يتأثر

World, United States, North Korea. People who keep coins on Binance or other exchanges, and anyone following crypto security

المصادر

1. Binance: Security Incident Update (2026-10-30) 30 أكتوبر 2026 · رسمي
2. BBC News: Binance hack updates: US Secret Service says it is helping to track funds stolen from crypto firm in $6.3bn hack 30 أكتوبر 2026 · إعلام