*Last checked 2 November 2026. Details of the incident are still emerging, and figures may change as investigations continue.*

Most companies that use stablecoins for payments or treasury are unlikely to run hot wallets on the scale of a global exchange. The Binance hack is still relevant to them, because it highlighted three risks that apply to ordinary businesses as well: funds held with a third party can become unavailable at short notice, stolen funds can reach a company's wallet through payments that look normal, and a signing process can be misused even when, as Binance has said so far, there is no evidence that private keys were leaked.

## Key takeaways

- Binance suspended withdrawals from late on 29 October until a phased reopening for a limited set of tokens and networks began on 1 November, so businesses holding operating funds on the exchange could not move them for roughly two and a half days.
- Stolen funds are being swapped and bridged across networks, and the FBI has asked private-sector firms to block transactions linked to the addresses used for laundering, which makes ongoing screening of incoming payments more important.
- Stablecoin issuers froze large amounts of stolen tokens within minutes, but freezing restricts movement and is not the same as recovering or returning funds.
- Binance said it had found no evidence that wallet private keys were leaked, which highlights the need to control access to signing systems as well as protect the keys themselves.

## What happened

At around 20:05 UTC on 29 October 2026, funds began leaving Binance hot wallets across multiple blockchains. In its [Security Incident Update #2](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751), Binance estimated the stolen amount at about USD 6.3 billion. Blockchain analytics firm [Elliptic put the outflow at USD 6.43 billion](https://www.elliptic.co/insights/binance-largest-hack-in-history/), the largest theft on record.

In the same update, Binance said that at this stage it had found no evidence that wallet private keys were leaked, and that its investigation had expanded beyond the initially suspected compromised engineer's laptop to additional points of breach. The FBI [attributed the theft to North Korea's TraderTraitor group](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack) on 31 October.

Four different figures are easy to confuse, so it helps to keep them apart:

- **Stolen (outflow):** about USD 6.3 billion according to Binance, and USD 6.43 billion according to Elliptic.
- **Frozen onchain:** about USD 3 billion according to Binance as of 30 October, mostly stablecoins frozen by their issuers. Frozen funds can no longer be moved by the attacker, but they have not necessarily been returned.
- **Recovered:** Binance had not reported a recovered amount as of its 30 October update, which said further recovery efforts would follow.
- **Covered by Binance:** Binance committed to covering the stolen assets from its SAFU fund and corporate treasury, and reported setting aside more than USD 6.34 billion for that purpose.

## Risk one: operating funds held with a third party

The first effect for businesses was access. According to [onchain and press timelines compiled by Bitquery](https://bitquery.io/investigations/binance-hack), Binance paused withdrawals at about 22:30 UTC on 29 October. A phased reopening, starting with a limited set of tokens and networks, began on 1 November, and other assets had no reopening date at that point. A company that kept operating stablecoins on the exchange could not pay suppliers, process payouts, or move liquidity during that time, regardless of whether its own balance was ever at risk.

Binance committed to covering the stolen assets, but that commitment did not remove the disruption caused by suspended withdrawals. It was also a decision by one well-capitalized company, and businesses should not assume every provider would be able to make the same commitment.

The practical question is how much of the company's working balance sits with any single exchange, custodian, or payment provider, and how the company would keep operating if that balance were unavailable for a week. Many businesses use exchanges to convert between stablecoins and fiat. Keeping there only what each conversion requires, and holding operating funds in wallets the company controls under its own governance, limits the impact when a provider has to stop withdrawals.

## Risk two: stolen funds reaching your wallet

After a theft of this size, stolen assets move through swaps, bridges, and new addresses, and some may eventually reach businesses that had nothing to do with the attack. Bitquery's analysis shows the attacker converting stablecoins into ETH and TRX through decentralized exchanges and moving funds across several bridges within hours.

Alongside its attribution, the FBI asked private-sector firms to block transactions with addresses linked to the laundering. [CoinDesk reported](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses) that the list included more than 600 Ethereum addresses, about 20 Bitcoin addresses, and one Solana address. Lists like these tend to grow as investigators trace funds, and attribution can change in the days after an incident.

A business cannot stop a third party from sending funds to one of its public addresses. What it can control is what happens next. Incoming payments should be screened before the business credits the customer, releases goods or services, or makes the funds available for use. Payments accepted before an address was flagged may also need to be rechecked. A receipt that later turns out to be linked to stolen funds can create compliance, accounting, and relationship problems, even when the business acted in good faith.

## Why stablecoins and native assets behaved differently

Issuers acted quickly. Tether and Circle froze large amounts of USDT and USDC held by the attacker, in some cases within minutes, and Elliptic counts about USD 2.85 billion frozen or seized across issuers and networks. Native assets such as bitcoin and ether have no issuer able to freeze them.

Freezing restricted the movement of some stolen assets, but it did not by itself mean those assets had been recovered or returned. For a business, the issuer's ability to act on specific addresses also cuts both ways: a company's own stablecoin balance is subject to the issuer's policies. That is one more reason to know where incoming funds come from and to keep records showing that the company's addresses are used for legitimate business.

## Risk three: your own signing process

Another important lesson concerns signing. Binance said it had found no evidence that wallet private keys were leaked, while its investigation pointed to unauthorized withdrawal transactions submitted through internal systems. If that holds, the attacker reached systems that could ask for signatures rather than the keys themselves.

In a smaller company, the equivalent might be a single employee's account that can both create and approve a transfer, a payment tool that signs whatever the finance system sends it, or a wallet whose approval screen shows a summary rather than the actual transaction. None of these requires a stolen key to cause a loss.

The relevant controls are the ones covered in our guide to [Maker, Approver, and Signer roles](https://www.kryptogo.com/blog/maker-approver-signer-enterprise-wallet): approvals tied to the exact transaction being signed, independent approvers for larger payments, limits on how much can leave in a day, and a quick way to pause signing.

On Ethereum, published analysis by [Fireblocks](https://www.fireblocks.com/blog/binance-hack-eip-7702) and Bitquery indicates that the attacker used a signed EIP-7702 authorization to delegate a Binance hot wallet to malicious contract code. Fireblocks notes that this involved creating a new authorization, not exploiting an existing EIP-7702 contract. Under the [EIP-7702 specification](https://eips.ethereum.org/EIPS/eip-7702), such a delegation stays in place until the account changes or clears it. Companies using wallets on Ethereum and compatible networks should treat delegation changes and new contract interactions as high-risk actions, not only outgoing transfers.

*KryptoGO analysis:* for businesses that receive stablecoin payments, this incident highlights why risk screening should continue after a payment is received, as new address intelligence becomes available.

## What to review this week

A short review can answer the questions this incident raised:

- **Third-party balances:** how much operating money sits with each exchange or provider, and how the company would keep paying if access were unavailable for a week.
- **Incoming screening:** whether incoming stablecoin payments are screened before customers are credited or funds are used, and whether the risk data is updated as new addresses are flagged.
- **Rechecking past receipts:** whether payments accepted since 29 October can be rechecked against updated lists.
- **Signing access:** which people, services, and devices can submit a transaction for signing, and whether any single account can create and approve a payment on its own.
- **Approval integrity:** whether approvers and signers see the actual transaction details, and whether a change after approval sends the request back for review.
- **Incident contacts:** who in the company would contact issuers, exchanges, and analytics providers if the company's own funds were affected.

## What is still unknown

Binance has not published how the laptop was compromised, which credentials gave access to its internal systems, or what the additional points of breach were. Recovery figures are still changing, and laundering of the funds that were not frozen is ongoing. Conclusions drawn now should be treated as provisional.

## How KryptoGO approaches this

The incident touches each stage of how a business handles a stablecoin payment. Counterparty due diligence should reflect the business relationship, transaction risk, and applicable requirements, including KYC or KYB where appropriate. Sending and receiving addresses should be screened for risk, with screening continuing after a payment as attribution changes. Outgoing payments should follow the company's approval rules, with the signed transaction matching what was approved. And records should be complete enough to support reconciliation and investigation.

These are the governance principles KryptoGO works from. In terms of current capabilities, KryptoGO's enterprise wallet infrastructure supports role-based permissions, approval workflows, address allowlists, and audit records, and KryptoGO provides KYC, KYB, and transaction monitoring services.

**Talk to KryptoGO about reviewing your third-party exposure, incoming payment screening, and approval controls.**

*This article is for general information only and does not constitute legal, security, or compliance advice. It reflects publicly available information as of 2 November 2026.*

## Frequently asked questions

### Were businesses with funds on Binance affected?

Binance committed to covering the stolen assets. The main effect for businesses was the suspension of withdrawals, which lasted roughly two and a half days before a phased reopening for a limited set of tokens and networks began on 1 November.

### Could stolen funds from the Binance hack reach my company?

It is possible. Stolen funds are being swapped and moved across networks, and some may reach ordinary businesses through normal payments. Screening incoming payments and rechecking recent receipts helps a business identify and manage that risk, although it cannot stop third parties from sending funds to a public address.

### Were the frozen funds recovered?

Not necessarily. Freezing stops the attacker from moving the tokens, but recovery and return are separate steps. Binance had not reported a recovered amount as of its 30 October update.

### Who was behind the Binance hack?

The FBI attributed the theft to North Korea's TraderTraitor group on 31 October 2026.

## Sources

- Binance, [*Security Incident Update #2*](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751), 30 October 2026.
- Federal Bureau of Investigation, [*North Korea Responsible for $6 Billion+ Binance Attack*](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack), 31 October 2026.
- CoinDesk, [*FBI confirms North Korea's role in $6 billion Binance hack*](https://www.coindesk.com/policy/2026/10/31/fbi-confirms-north-korea-s-role-in-usd6-billion-binance-hack-asks-defi-community-to-block-btc-eth-sol-addresses), 31 October 2026.
- Elliptic, [*The largest theft in history: North Korea likely behind the $6.4 billion Binance hack*](https://www.elliptic.co/insights/binance-largest-hack-in-history/), October 2026.
- Bitquery, [*Binance Hack: $6.3B Drained on 9 Chains*](https://bitquery.io/investigations/binance-hack), October 2026.
- Fireblocks, [*Deconstructing the Binance Exploit*](https://www.fireblocks.com/blog/binance-hack-eip-7702), 30 October 2026.
- Ethereum Improvement Proposals, [*EIP-7702: Set Code for EOAs*](https://eips.ethereum.org/EIPS/eip-7702).

The Binance hack exposed three risks for any business using stablecoins: frozen third-party balances, tainted incoming payments, and misused signing access.

Binance Hack: What It Means for Businesses Using Stablecoins

What Are Maker, Approver, and Signer Roles in an Enterprise Wallet?

How Should Finance Teams Reconcile Stablecoin Payments at Month End?

KYB Onboarding: Why Cross-Border Verification Slows Down

Why Are Enterprises Using Stablecoins Beyond Crypto Trading?

Travel Rule and Cross-Border Payments: What Businesses Need to Rethink Before Implementation

What Taiwan's New VASP Act Means for Businesses: Five Key Takeaways

Why Stablecoin Transfers Break at Scale: Reconciliation, Compliance, and Address Risk

Where White-Label Wallet Projects Actually Get Stuck

How Mining Farms Use Stablecoins for Electricity Payments: From Collection to Compliance

What Are KYC, KYB, and KYA? What Businesses Actually Need to Check When Using Virtual Assets

Who Actually Needs Stablecoin Payments in 2026? - And Why Traditional Systems Can’t Support Them

What Changes When a Company Starts Accepting USDT? A Practical Guide for Finance Teams

From 2,000 BTC to Enterprise Treasury Risk

Cross-Border Trade in 2026: Receiving USDT from FX-Controlled Markets

Why Companies Shouldn’t Build Their Own Wallets for Stablecoin Payments

As Stablecoins Go Mainstream, Why Taiwan Enterprises Have a Rare Strategic Window

Why Are We Hearing So Much About Stablecoins—and Why Does Taiwan Suddenly Matter?

What Do ISO 27001, ISO 27701, and SOC 2 Type 2 Actually Protect—and Why Should Companies Care?

Cross-Border Wire Transfers vs. Stablecoin Payments: How Much Can Companies Actually Save—and At What Cost?

Why VASP Registration and Security Certifications Are Not Advantages—They’re the Minimum Requirement for Using Stablecoins in Corporate Payments

KryptoGO.xyz: The absolute best address clustering platform on the market.

2025 Mid-Year Update: Charting a Clearer Course

[Important Security Notice] Protect Your Digital Assets: Identify and Revoke Malicious Wallet Approvals

Product Newsletter: July 16, 2025

When Life Takes Away Your Lemons

The Insiders Among Us: June 18th, 2025

The Press F Experiment: June 4, 2025

It’s a Date! Vibe Coding Workshop: May 22, 2025

Unlocking Web3 Potential: Real-World Applications of KryptoGO Wallet

Meet KryptoGO Pay: April 30, 2025

Yua Mikami Ignites Solana Meme Coin $MIKAMI – The Ultimate Guide 

Create Your Crypto Payment Link: No Code Required, Accept Payments Globally!

One-Click Integration of Crypto Payments into Your App

The Future is Universal: April 9, 2025

The Signals Update: March 26, 2025

The Pump Hound Update: March 12, 2025

Escape Exchange Risks: Why KryptoGO Self-Custody Wallet is the Ultimate Choice for Web3 Users

Handle Login and Group Chats Update: February 26, 2025

Evolution of Taiwan's VASP Regulation: From Declaration to Licensing

Beginner's Guide to Hyperliquid ft. KryptoGO App: Feb 12, 2025

Refining the Waves with Ocean v3: January 22, 2025

Biweekly Update: January 8th, 2025

The '25 Roadmap Preview: December 18, 2024

“The King of Tron” Update: December 4, 2024

Biweekly Update: November 20, 2024

The 'Pulse' Update: November 6, 2024

In-Depth Technical Analysis: Why Choose a Mature Crypto Wallet Service Instead of Building Your Own

Five Stages of Evolution for Crypto Wallets

Biweekly Update: October 23, 2024

Biweekly Update: October 09, 2024

Biweekly Update: September 25, 2024

Send Via Link campaign and "Gimme more wallets" Update :  September 11, 2024

The “Send Crypto via Link” Update: August 28, 2024

KryptoGO's Award-Winning Innovations at ZK Hack Montreal, ETHDenver, and ETHTaipei

Stake Your Stables! Biweekly update: August 14, 2024

The “Not Just A Wallet” Update: July 31, 2024

Biweekly Dev Update: July 17, 2024

Biweekly Dev Update: July 3, 2024

Biweekly Dev Update: June 5, 2024

Challenges and Solutions for Using Cryptocurrency in Business Operations

Biweekly Dev Update: May 22, 2024

Biweekly Dev Update: May 8th, 2024

Biweekly Dev Update: April 17th, 2024

Biweekly Dev Update: April 3rd, 2024

Biweekly Dev Update: March 20th, 2024

Making Sense of Decentralized Wallets: EOA and Smart Contract Explained

Biweekly Dev Update: March 6th, 2024

Centralized vs. Decentralized: The Ultimate Guide to Choosing the Right Crypto Wallet for Your Business

Navigating Compliance in Taiwan's Cryptocurrency Market: From Fraud Prevention to Enhanced Regulation

【Kind Reminder】Please be vigilant against scams. KryptoGO will never proactively ask you to make investment transactions.

Biweekly Dev Update: February 21th, 2024

Biweekly Dev Update: February 7th, 2024

Web3 Business Operations: Future Trend or Current Necessity?

Biweekly Dev Update: January 24th, 2024

Biweekly Dev Update: January 10th, 2024

Biweekly Dev Update: December 27th, 2023

Biweekly Dev Update: December 13th, 2023

Biweekly Dev Update, November 29th, 2023

Biweekly Dev Update, November 15, 2023

Biweekly Dev Update: November 1st, 2023

Biweekly Dev Update: October 19th, 2023

Biweekly Dev Update: Oct 4th, 2023

The Chatroom and Social Update: September 20th, 2023

Play-to-Earn vs. Blockchain Gaming: Rediscovering the Joy of Play

Product Launch Update: September 6th, 2023

KryptoGO Launches AI-Powered One-Stop Web3 Cloud Solution

Biweekly Update: August 23rd, 2023

The Keyless Wallet Update: August 9th, 2023

Biweekly Update: July 26th, 2023

Biweekly Update: July 12th, 2023

Biweekly Dev Update: June 7th, 2023

Unlock the Future: Passkey + DID + FIDO - Exploring the Next Generation of Digital Wallets and Identities

Biweekly Dev Update: May 24th, 2023

Biweekly Dev Update: May 10th, 2023

Biweekly Dev Update: April 26th, 2023

KryptoGO team wins three ETHGlobal Tokyo Hackathon Awards! Join hands with YGG Japan and IVC to lay out GamiFi industry

Biweekly Dev Update: April 12th, 2023

Help enterprises enter the Web3 world painlessly! What is WaaS?

Biweekly Dev Update: March 22th, 2023

Binance Hack: What It Means for Businesses Using Stablecoins

Recommend Articles

Hot Articles

Hot Tags