Binance lost $6.3B in about 20 minutes. I did the freeze math, and half the money is still moving.

Binance, the world's largest crypto exchange, has confirmed the largest crypto theft on record: an estimated $6.3 billion impact, with at least $5.912 billion confirmed stolen as of 8:30 p.m. ET on October 29. About $3 billion has been frozen. The rest — about $3.3 billion — has not been located, and Binance has given no update on it.

I am not going to re-report the hack. I am going to do the arithmetic that the headlines skip, because the numbers tell a different story than either "Binance got hacked" or "funds are safe" does. All of the inputs below are from Binance's own statements as quoted by Reuters, plus CoinDesk's review of Binance's proof-of-reserves data. Where a number comes from on-chain reconstruction rather than Binance, I say so.

The freeze math

Total impact (Binance estimate):            $6.300B
Confirmed stolen, 8:30 p.m. ET Oct 29:      $5.912B  (93.8% of estimate; $0.388B gap)
Frozen so far:                              $3.000B
Not located:                                $3.300B
Frozen share of total impact:               47.6%
Frozen share of confirmed stolen:           50.7%
Tether frozen:                              $1.570B
Circle frozen:                              $0.800B+
Tether + Circle:                            $2.370B  (79.0% of all frozen funds)
Ripple frozen (per co-founder Yi He):       $0.200B
Previous record, Bybit, Feb 2025:           $1.500B
Binance / Bybit:                            4.2x
Binance SAFU emergency fund:                ~$1.000B  (15.9% of $6.3B)

Start with the headline ratio: $6.3 billion is 4.2 times the $1.5 billion Bybit theft of February 2025, the previous record. This is not a slightly bigger hack. It is a different scale of event, and it happened in about twenty minutes — $315 million per minute, $5.25 million per second, if you spread the total evenly across the drain window. Averages like that are crude, but they convey the operational reality: this was not a slow bleed anyone could have caught mid-flight. By the time the first public warnings appeared, the money was gone.

The more important ratio is the freeze rate. Freezing $3 billion sounds like a win until you divide: it is 47.6% of the estimated impact, barely half of what was confirmed stolen. The other $3.3 billion is the story now. And the composition of the frozen $3 billion matters too: Tether ($1.57 billion) plus Circle (over $0.8 billion) account for $2.37 billion of it — 79.0%. In other words, the freeze worked where it was always going to work: centrally issued stablecoins, whose issuers can blacklist an address with a function call. The part that was not stablecoins is, so far, mostly not frozen. That is not a criticism of Tether or Circle; it is the structural limit of the whole "freeze the funds" playbook. It works on the assets designed to be freezable.

Then there is the SAFU fund. Binance's Secure Asset Fund for Users holds roughly $1 billion, entirely in bitcoin. That covers 15.9% of a $6.3 billion loss. So when co-founder Yi He says the company will cover "all hacking losses," that promise cannot be resting on SAFU alone. It rests on Binance's balance sheet beyond the fund — which is presumably fine, but it is worth stating plainly, because "funds are safe" plus "SAFU" sounds like a fully funded insurance pool, and the arithmetic says it is not. The $1 billion fund against a $6.3 billion hole leaves $5.3 billion to be covered from elsewhere.

What the chain actually shows

The mechanism, as reconstructed from on-chain data by CoinDesk and security researchers, is worth understanding because it is not a smart-contract bug. The attacker obtained valid signatures from Binance's hot-wallet signing system — Binance itself has said the investigation is ongoing and it cannot yet confirm the cause, so treat the mechanism below as the best-supported reconstruction, not as Binance's confirmed root cause.

On October 29, the wallet labeled Binance 14 was delegated, via Ethereum's EIP-7702 mechanism, to an attacker-deployed sweeper contract. EIP-7702 lets an ordinary wallet temporarily behave like a smart contract; setting a delegation requires a valid signature from the wallet's own key. At 20:24 UTC, a single transaction emptied Binance 14: 167,464 ETH plus 63 other tokens, including 1.615 billion USDT — roughly $2.5 billion in one transaction, 39.7% of the total impact. Minutes later, Binance 16 sent another 28,006 ETH to the same destination. CoinDesk puts the total ETH taken at roughly 204,500.

Here is the part that should worry every exchange operator reading this: a delegation belongs to the address, not the key. Rotating keys does not remove it. Clearing it requires a new authorization from the same wallet pointing at the zero address. Binance says it has revoked the affected authorizations, but the window between delegation and revocation is the whole attack. The delegation was set at about 20:20 UTC; the first sweep landed at 20:24 UTC. Four minutes from permission to empty wallet.

And there is a proof-of-reserves footnote that makes this more than a hot-wallet story. CoinDesk's review of Binance's own reserve data found that Binance 14 appears in Binance's October 1 proof-of-reserves report — meaning the stolen crypto was part of the assets backing customer balances. On October 1, Binance held exactly enough ETH to cover customers (a 100% ratio); the roughly 204,500 ETH taken represents about 5.6% of its ETH reserves, leaving ETH backing near 94%. Binance says user funds are safe and balances will be honored. That is a claim about Binance's willingness and ability to top up the reserves, and its November 1 reserve snapshot will show whether it has. Until then, "funds are safe" is a promise, not a measurement.

What moved, and what it cost everyone else

The market reaction was immediate and broad: bitcoin fell to a six-week low, down 3% to $76,469.82, and ether fell more than 3% to $2,185.83, per Reuters. BNB fell more than 8% in 24 hours to about $694 in early reporting. None of that is surprising — a $6.3 billion forced seller, or the fear of one, moves markets — but it underlines that the blast radius of an exchange hack is not limited to the exchange's users. It is every holder of the assets, repriced in an afternoon.

The FBI and the U.S. Secret Service are now working with Binance, according to a Reuters source. That is the part of the story that will take months: the $3.3 billion not yet located is moving through mixers and fresh wallets, and recovery from here is law enforcement work, not smart-contract work.

The number to watch

Forget the $6.3 billion headline. Watch two numbers instead. First, the frozen total: does it climb past $3 billion, or stall where the freezable assets run out? Second, the November 1 proof-of-reserves snapshot: does ETH backing return to 100%, and with what assets? Those two numbers will tell you whether this was a bad day Binance absorbed, or a hole it is still filling.

Sources: Reuters, October 29–30, 2026 (analyst reactions and Binance statement; Tether/Circle freezes; FBI/Secret Service cooperation; crypto insurance and SAFU fund); CoinDesk, October 30, 2026 (proof-of-reserves review, EIP-7702 mechanism, ETH reserve arithmetic); Wired, October 30, 2026 (20-minute drain window). All arithmetic computed from the cited figures on October 30, 2026.