A $6.4 Billion Heist Didn't Break Bitcoin. The $3.25 Billion Still Unfrozen Might.
Binance says it will cover a $6.43 billion October 29 theft, and Bitcoin has climbed to about $78,600. The attacker still controls around $3.25 billion in assets no issuer can freeze.
On October 29, 2026, $6.43 billion in cryptoassets was taken from Binance, according to a post-incident analysis by blockchain forensics firm Elliptic. Binance estimated the impact at around $6.3 billion. Elliptic says the episode is the largest crypto heist on record, more than four times the $1.46 billion stolen from the Bybit exchange in February 2025, and that it is almost certainly the largest single theft of any kind in history.
On October 31, the FBI attributed the theft to TraderTraitor, its name for a North Korean state-sponsored hacking group also known as Lazarus Group. Binance said it will cover all losses, using its SAFU fund and company funds, and that it has reserved more than $6.3 billion of company funds to do so.
Bitcoin dropped more than 4% after the hack was disclosed, then recovered. As of Monday morning Asia time, Bitcoin was up about 1% to roughly $78,600, its third straight day of gains. That rebound is the part of the story the tape already priced. The unfinished part is still sitting in the attacker's wallets: around $3.25 billion of assets that cannot be frozen by an issuer.
A laptop, a hot wallet, and a pause
Binance's initial investigation suggested the incident may have started with a compromised DevOps engineer's laptop. That access, the company indicated, let an attacker reach a service container and submit unauthorized withdrawal transactions. On Ethereum, the attacker abused EIP-7702 delegation, a feature from the 2025 Pectra upgrade, to get Binance's own hot wallet to sign transactions on the attacker's behalf. Binance later said it uncovered additional points of breach in a complex attack.
The exchange paused withdrawals after the theft, which it said stopped the outflows. It began reopening withdrawals starting November 1. The pause is why a record theft did not keep draining once it was in public view. It is also why the next test was not the hack itself, but what customers did when withdrawals started again.
Forty-four percent frozen, the rest still in play
Elliptic has verified $2.85 billion of frozen or seized funds, about 44% of the theft. Almost all of that $2.85 billion is in the stablecoins USDT and USDC. The rest of the haul does not have that off switch.
The attacker still controls around $3.25 billion of assets spread across more than 800 addresses. Elliptic's tally includes roughly 584,000 ETH (about $1.32 billion), 18,327 BTC (about $1.42 billion), and 233 million XRP. Those holdings cannot be frozen by an issuer. Control of the keys is control of the coins.
That split is the tension inside the recovery. The frozen share is already with issuers or in seizure. The unfrozen share is still in play, parked across more than 800 addresses rather than sitting in a single recovered wallet. A $6.4 billion hole can be plugged on an exchange's balance sheet. It cannot be plugged if the stolen bitcoin, ether, and XRP never get locked.
A $3.6 billion withdrawal test
When Binance reopened withdrawals on November 1, customers withdrew a net $3.6 billion. Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT, a net outflow of about $3.64 billion. The company said that figure was just over 2% of the $171 billion of assets under its management.
The 2% line is the one Binance put next to the outflow. The arithmetic is still the arithmetic: $4.649 billion went out, $1.01 billion came in, and a net $3.64 billion left in a single window. On top of that flow, the firm still had to absorb a theft it put at around $6.3 billion. That is the job assigned to the SAFU fund and to the more than $6.3 billion of company funds Binance said it reserved so it could cover every loss.
The market's first verdict showed up in bitcoin. A drop of more than 4% after disclosure, then a climb back, then three straight sessions of gains into roughly $78,600 as of Monday morning Asia time. Binance covering losses, the SAFU plus company-fund reserve, the $2.85 billion already frozen or seized, and a withdrawal pause that the company said stopped the outflows are the parts of the response that worked in public.
What has not been resolved is the $3.25 billion the attacker still holds in ETH, bitcoin, XRP, and the rest of the unfreezable mix. Those coins will not clear in a single session. They remain inventory the attacker still controls, across more than 800 addresses, after the largest theft Elliptic has logged. Bitcoin can trade through a $6.4 billion hole that Binance says it will fill. It cannot, on its own, retire the pile that never got frozen.
