Binance puts the incident at $6.3bn, says $3bn is frozen and promises to cover all losses from its own funds
Binance says its initial investigation points to a possibly compromised DevOps laptop, and it found no evidence of a private-key leak. Its last published Proof of Reserves list, dated 1 October, includes a drained wallet.
Binance puts the "estimated total impact" of the incident at around $6.3bn. About $3 billion is frozen on-chain so far. Those figures sit on its announcement page, carrying the page stamp 03:23 on 30 October. Its text was unchanged when CTOL re-read it at about 03:37 UTC.
Binance says its initial investigation "suggests" the incident "may involve a compromised DevOps engineer's laptop". Binance says that may have allowed an attacker to gain access to a service container and submit unauthorized withdrawals. It has found no evidence of any wallet private key leak. Deposits and withdrawals are suspended, and address authorisation is revoked.
Among the freezes itemised here, the largest came from the two stablecoin issuers. Tether froze more than 1.567bn USDT, per a post quoted by Yi He of Binance at 10:36 PM on 29 October as displayed. Circle's chief executive, Jeremy Allaire, wrote that Circle had frozen more than 800M USDC in coordination with law enforcement.
Citation Needed, a crypto newsletter by Molly White, estimates about $5.5bn was taken from hot wallets, using Arkham data.
It adds $27m of USD1 frozen by World Liberty Financial and $30.5m frozen by Arbitrum. On its tally, four named parties account for $2.42bn of freezes. Tether and Circle make up 98 percent of it. Binance's announcement puts the frozen total at about $3bn without saying how it is built.
Binance commits that it "will cover all losses from the SAFU fund and the company's funds" and says user funds are safe. Its announcement gives no figure for the SAFU emergency fund or the company's funds. Citation Needed says Binance's insurance fund page shows about $1.3bn in its most recent balance report. A post-mortem and an updated Proof of Reserves are promised once remediation is complete.
Binance's last published Proof of Reserves snapshot, labelled audit time 1 October 00:00 UTC with no auditor named, is the latest public reference point. USDT wallet balances of 33.27bn covered net account balances of 32.03bn, a ratio of 103.88 percent. USDC wallets held 7.77bn against 7.18bn, or 108.26 percent. Binance's page says the excess is not indicative of its own assets, so it is not a loss buffer.
Citation Needed puts the stolen stablecoins, via Arkham, at 1.768bn USDT and 0.823bn USDC.
As a static illustration only, take those amounts off the 1 October wallet balances and hold net account balances unchanged. The ratios become about 98.4 percent for USDT and 96.8 percent for USDC.
CoinDesk reports that Binance's own 1 October reserve list includes Binance 14, the wallet at the centre of the theft. It held 1.26bn USDT and 89,475 ETH then. So a wallet at the centre of the theft was in the 1 October reserve set. That does not show what the wallet held just before the incident.
CTOL's view is that the promise to cover losses is Binance's alone. The eventual cash burden will depend on recoveries and on how much comes from each source. With no figure for company funds, the roughly $1.3bn SAFU balance alone does not set the funding need.
CoinDesk says Binance's next regular reserve snapshot is dated 1 November. It is the first document to read.
The promised updated Proof of Reserves is the second. Ratios at or above 100 percent with withdrawals reopened would be consistent with reserves being replenished. A ratio under 100 percent would show a shortfall on that date, not how much of the theft was replaced. The post-mortem is the third marker. It should say how its final loss figure relates to the $6.3bn estimate of total impact.