Binance hack: what is verifiable, what is claimed, and what clients can do

On Thursday 29 October, from 20:05 UTC according to analysts, Binance wallets began sending their funds to an unknown party, through transfers bearing valid signatures. During the night, the platform put the loss at USD 6.3 billion, said it had found no evidence of a private key leak and promised to refund everything. Three statements. The blockchain can verify only one of them, the amount. On the rest, it tells a different story.

Key points

• On 29 October 2026, approximately USD 6.36 billion left Binance wallets on ten blockchains, according to the blockchain analytics firm TRM Labs. Binance puts the impact at USD 6.3 billion, of which approximately USD 3 billion has been frozen.
• According to TRM Labs and CoinDesk, the transfers carried valid signatures. The hypothesis TRM Labs considers most likely is that Binance’s signing system was compromised, not that a private key was stolen.
• Under French law, the facts would fall within the offences against automated data processing systems, punishable by up to ten years’ imprisonment when committed by an organised gang, rather than fraud.
• Binance is not an authorised provider under MiCA. The custodian liability provided for in Article 75 of the Regulation does not apply to it: its refund pledge rests only on its contract.
• Since 1 July 2026, Binance has no longer been allowed to provide crypto-asset services in France. Withdrawals, the only service still available to French clients, have been suspended since the hack.
• Clients should keep evidence of their balance on 29 October 2026 now and refuse any paid “refund” or “recovery” offer: these are scams.

What happened at Binance on 29 October 2026?

According to the blockchain analytics firm TRM Labs, on the evening of 29 October 2026 an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about twenty minutes from 20:05 UTC. That would make it the largest crypto-asset theft on record, about four times the Bybit hack of February 2025¹. Binance, for its part, puts the estimated impact at USD 6.3 billion, of which approximately USD 3 billion has been frozen².

On Ethereum, the security firm Blockaid identified a transaction submitted at 20:20:59 UTC containing 50 EIP-7702 authorisations targeting the hot wallet labelled “Binance 14”³. A hot wallet is the internet-connected wallet an exchange uses to process customer withdrawals. According to TRM Labs, each of the 50 authorisations was signed by that wallet, and only one worked. One was enough¹.

EIP-7702 is a feature introduced by Ethereum’s Pectra upgrade in May 2025: by signing an authorisation, an ordinary wallet can hand control of its behaviour to the code of a smart contract, and that delegation stays in place until the wallet signs a new one¹. According to TRM Labs, the attacker used it to make the Binance wallet run a contract that only the attacker could call. Three minutes and twenty-four seconds after the delegation, the wallet transferred its entire balance. Because the delegation remained in place, the attacker swept the incoming funds six more times, until 23:56 UTC¹.

On Bitcoin, according to a trace published by CoinDesk, just over 18,270 BTC were sent to a single address in eleven transactions, then split across nineteen wallets, seventeen of which hold exactly 1,000 BTC. At 04:23 UTC on 30 October, none had moved⁴.

Binance announced that it had suspended deposits and withdrawals and pledged to cover all losses from its SAFU emergency fund and its own funds². On the morning of 30 October, its co-CEO Yi He said that deposits were operating normally and that withdrawals were expected to resume within 48 hours¹³.

Timeline of the Binance hack

What is established, and what is only claimed?

The story now circulating mixes three kinds of material that must be kept apart.

First, what is verifiable is on the blockchain. The transactions, their timestamps, the destination addresses and the EIP-7702 format are public and can be checked by anyone. They have not been checked here: what is said about them comes from the analyses published by Blockaid, TRM Labs and CoinDesk. But that is where the material evidence lies, the kind that does not depend on anyone’s word.

Second, the origin of the attack is, at this stage, a matter of assertion. According to Binance’s statement of 30 October, its preliminary investigation suggests that the incident may involve the compromised laptop of an engineer, which allegedly gave the attacker access to a service container from which unauthorised withdrawals were submitted². That is the platform’s own account, and the platform has an obvious stake in the outcome. It is not false for that reason. It is simply not yet proven, and Binance itself has announced a detailed technical post-mortem².

The attribution to North Korea falls into the same category. It is the assessment of an analytics firm, TRM Labs, which attributes the attack to the TraderTraitor group with what it describes as high confidence¹. A serious assessment, but an assessment.

Third, the most widely repeated line, about no private key having leaked, deserves a careful reading. Binance says it has found no evidence of any private key leak². Yet according to TRM Labs and CoinDesk, the transfers carried valid signatures from Binance wallets^{1 4}. The two statements do not contradict each other: they are consistent with an attacker who did not need the key because he had managed to make Binance’s signing system sign for him. That is the explanation TRM Labs considers most likely, given that valid signatures were obtained within half an hour on blockchains with different signing schemes¹.

If that hypothesis is confirmed, the key never left the vault. But someone else was holding the pen.

Binance hack: fraud or hacking?

The word “scam” is everywhere. It is the wrong word.

Fraud (escroquerie) under Article 313-1 of the French Criminal Code requires deceiving a natural or legal person and thereby inducing them to hand over funds or property. It carries five years’ imprisonment and a fine of EUR 375,000.

According to TRM Labs, early indicators on Ethereum suggested that the authorisations had been obtained by phishing. TRM sets that explanation aside, since it leaves the outflows on the nine other blockchains unexplained, and prefers the hypothesis of a compromised signing system¹. On that hypothesis, it was not a person who was deceived, but a system that was made to sign. The same distinction governs the theft of crypto-assets from a hacked wallet, and it determines the complaint.

If the facts are confirmed as described, under French law they would fall within the offences against automated data processing systems. Fraudulently accessing or remaining in such a system carries three years’ imprisonment and a fine of EUR 100,000, rising to five years and EUR 150,000 where data is modified or the operation of the system is impaired (Article 323-1). Fraudulently introducing data into a system carries five years and EUR 150,000 (Article 323-3). Where committed by an organised gang, these offences carry ten years’ imprisonment and a fine of EUR 300,000 (Article 323-4-1).

The question of fraud would arise again if the investigation established that a person had been manipulated, whether the engineer or a signer. Nothing of the kind has been established today.

Does Binance have to refund its clients?

Binance has pledged to cover all losses. According to CoinDesk, the SAFU fund (Secure Asset Fund for Users), created in 2018, holds approximately USD 1 billion in bitcoin⁵. The rest will have to come from the company’s balance sheet.

The question is what that pledge is worth to a European client. The Markets in Crypto-Assets Regulation (Regulation (EU) 2023/1114, MiCA) protects the clients of a crypto-asset custodian: segregation of their crypto-assets from the provider’s estate, and liability of the provider for the loss of crypto-assets as a result of an incident attributable to it, capped at the market value of the crypto-asset at the time the loss occurred (Article 75(7) and (8))⁶.

But those obligations bind crypto-asset service providers (CASPs), which the Regulation defines as persons allowed to provide crypto-asset services in accordance with its Article 59 (Article 3(1), point (15))⁷.

Binance is not an authorised provider, and it says so itself. According to Cointribune, it told its French clients on 24 June 2026 that no entity of the group would obtain authorisation before the end of the transitional period, after withdrawing the application it had filed in Greece⁸. According to a third-party extract of the ESMA register as at 19 October 2026, no Binance entity appears on it⁹.

Binance’s promise is therefore backed by no MiCA liability regime. It is worth what the public commitment of a private company is worth, and whatever its contract and the law governing it allow its clients to obtain.

Binance clients in France: what is the position since 1 July 2026?

Since 1 July 2026, Binance has no longer been allowed to provide crypto-asset services in France. The reason is legal. Article 59 of MiCA reserves those services to authorised providers; the transitional regime under Article 143(3), which allowed firms already registered under national law to continue their activity, expired on 1 July 2026¹⁰. Binance, which held only its French digital asset service provider (PSAN) registration obtained in 2022, was granted no authorisation.

Its French accounts have therefore operated in restricted mode since that date: no new accounts and no euro deposits, no spot trading, withdrawals only⁸. Clients who had not withdrawn their assets now find those withdrawals suspended, according to the platform’s announcement².

These clients are thus in exactly the situation MiCA was designed to prevent: assets held by a platform bound by none of the Regulation’s safeguards.

Their rights are to be found in their contract. They need to identify, in the terms and conditions they accepted and in their statements, the company they contracted with, the governing law and the designated forum. That is the first document to gather, together with evidence of the balance held on 29 October 2026, asset by asset: statements, account exports, dated screenshots.

As for time limits, if French law applies, a liability claim against the platform is time-barred after five years from the day the holder of the right knew or should have known the facts enabling it to be exercised (Article 2224 of the French Civil Code). Since the hack has been public since 29 October 2026, prudence dictates taking that date as the starting point: the deadline is 29 October 2031. If the terms and conditions designate a foreign law, the applicable time limit must be checked in light of that choice.

Binance refund scams: how to recognise them and respond

The real scam is the one still to come.

The risk is foreseeable: an incident of this size gives fraudsters an ideal pretext to approach worried clients. The script is well known: fake compensation forms, fake customer support, fake “recovery firms” promising to retrieve the funds in exchange for an upfront fee. Binance co-CEO Yi He has herself urged users to rely only on the platform’s official channels¹¹.

A few rules that admit no exception. No legitimate party will ask for your recovery phrase. No legitimate party will ask you to pay in order to be refunded. No refund goes through a link received by text message, email or messaging app.

If the harm is done, speed is everything. In this very case, according to TRM Labs, Tether froze 971 million USDT thirty-seven minutes after the main transfer, and about USD 2.7 billion had been frozen in total during the night¹. Freezing is possible, provided action is taken before the funds are converted or dispersed. The routes to recovering diverted funds and freezing funds through the enforcement judge are covered in dedicated analyses.

Filing a criminal complaint should be considered without delay. It is the complaint that allows an investigation to be opened, in which the public prosecutor or, with the prosecutor’s authorisation, investigators may require platforms to hand over relevant information (Article 77-1-1 of the French Code of Criminal Procedure). A precise complaint, supported by the addresses, the transactions and the exchanges with the fraudster, gives investigators a chance to act before the funds are dispersed.

How the firm can help

The firm acts in crypto-asset fraud and cybercrime matters, in both advisory and litigation work.

First, for Binance clients whose assets are blocked: identifying the contracting entity, the governing law and the competent court; building the evidence file for the balance held on 29 October 2026; a claim against the platform and, if the refund pledge is not honoured, legal action.

Second, for victims of a refund scam or a fake recovery service: drafting and filing the criminal complaint, tracing the funds, freezing requests to platforms and issuers, joining the proceedings as a civil party.

In both cases, the first hours and the first documents matter. The firm can be contacted now.

Frequently asked questions

Was Binance hacked?

Yes. On 30 October 2026, Binance confirmed a security incident whose impact it estimates at USD 6.3 billion. According to TRM Labs, approximately USD 6.36 billion left its wallets on the evening of 29 October 2026, on ten blockchains.

Are my crypto-assets on Binance lost?

Binance states that user funds are safe and that all losses will be covered by its SAFU fund and its own funds. That is a public commitment by the platform, not yet performance. According to Binance, withdrawals remain suspended; deposits are operating normally.

When will Binance withdrawals resume?

On 30 October 2026, Binance announced that it expected withdrawals to resume within 48 hours, without giving a precise date. Binance says it will publish an updated proof of reserves once remediation is complete, followed by a detailed technical post-mortem.

Is Binance required to refund its clients?

Not under MiCA. The custodian liability provided for in Article 75 applies to authorised providers, which Binance is not, according to its own announcement to its French clients and to the extracts of the ESMA register. What remains is its public commitment and its contract, whose scope depends on the governing law and the forum designated in its terms and conditions.

Is Binance authorised in France?

No. Since 1 July 2026, when the transitional regime under Article 143(3) of MiCA expired, Binance has no longer been allowed to provide crypto-asset services in France, for lack of authorisation. Its French accounts allowed withdrawals only.

What is the EIP-7702 feature used in the hack?

EIP-7702 is an Ethereum feature, introduced by the Pectra upgrade in May 2025, that allows an ordinary wallet to hand control of its behaviour to the code of a smart contract by signing an authorisation. According to TRM Labs, the attacker used it to make a Binance wallet run a contract that only the attacker controlled.

What should a client in France do now?

Keep evidence of the balance held on 29 October 2026, asset by asset; identify the contracting entity, the governing law and the forum in the terms and conditions; respond to no approach outside Binance’s official channels. The firm can assist you in building that file and in the claim.

A company offers to recover my funds for a fee. Is it genuine?

No. A refund promised by the platform requires no paid intermediary. This kind of offer is the most common form of the so-called “recovery scam”. If you have already paid, act quickly: freezing the funds is a matter of hours, and a criminal complaint should be considered immediately. The firm can handle it.