Status check, 31 October 2026, about 10:30 UTC (Satcove). No source read by Satcove confirms that Binance withdrawals have resumed or that the proof of reserves promised for 2 November has been published. The most recent source read is Elliptic's page, updated 31 October at 05:00 UTC. Headlines seen in a web-enabled assistant's source list (Forbes: plan to resume withdrawals "this weekend"; BBC: US Secret Service helping) were not opened by Satcove and are not used as facts. Two points remain open: the actual restart of withdrawals, and Binance's full post-mortem.
In brief
- Binance estimates the total impact of the 29 October 2026 attack at about $6.3 billion and says about $3 billion is frozen. Elliptic, which traces funds on-chain, estimates $6.43 billion stolen and about $2.85 billion frozen or seized (44%).
- Frozen is not recovered, and recovered is not repaid. Nothing read shows money returned to Binance or to customers.
- Binance says it reserved more than $6.34 billion of company funds to cover losses, about $5 billion of it already held in the same assets. That is a promise, not proof of solvency.
- TRM Labs attributes the theft to TraderTraitor, a North Korea-linked group, "with high confidence". Chainalysis attributes it to the same group. Elliptic calls it "likely" and "not yet certain". No government has confirmed it and Binance attributes nothing.
- Six AI chat assistants, asked the same two questions in a single round, all rate Binance's financial recovery as likely if the reserve claims hold, and none says Binance is dead. They split on the first seven days (20% to 50% for a partial reopening with heavy outflows) and on how strong the attribution is (40% to 70%).
- Satcove verdict: confidence medium. The proof of reserves due on Monday 2 November is the decisive test.
What is known
Times in UTC are Satcove conversions of ET and PDT times published by the sources.
| Date / time | Fact | Source |
|---|---|---|
| Thu 29 Oct, ~20:20 UTC | EIP-7702 delegation on the wallet labelled "Binance 14", to a sweeper contract; assets drained minutes later | Hypernative, Blockaid (via Bitcoin.com) |
| 29 Oct, ~20:24 UTC | Tether freezes the attacker's main Ethereum wallet 37 minutes after the USDT arrived (1.18 billion USDT); Circle freezes 823 million USDC three minutes later | Elliptic |
| 29 Oct, ~22:27 UTC | Binance confirms "a security incident"; withdrawals suspended on several networks | TechCrunch |
| 30 Oct, ~00:00 UTC | Co-founder Yi He says Binance will cover all losses; the delegation is revoked at 00:10 UTC | Bitcoin.com, Hypernative |
| 30 Oct | Binance update: compromised DevOps laptop, access to a service container, no private-key leak found, about $3 billion frozen, estimated impact about $6.3 billion | The National, Infosecurity, Hypernative |
| 30 Oct | TRM Labs and Chainalysis attribute the theft to TraderTraitor; Chainalysis links the stolen funds to the September Bitget theft | TRM Labs, Chainalysis |
| 30 Oct, 23:05 UTC | Second Binance update: more than $6.34 billion reserved, phased withdrawal restart targeted within about 34 hours, proof of reserves promised by 2 Nov. | Bitcoin.com |
| 31 Oct, 05:00 UTC | Elliptic updates its estimate: $6.43 billion stolen, $2.85 billion frozen or seized (about 04:30 UTC) | Elliptic |
Satcove opened the Elliptic, TRM Labs, Chainalysis and Hypernative pages for this update. Binance's own announcement pages could not be read (they return only site navigation) and Reuters is not accessible to Satcove's tools, so Binance's statements are cited through the outlets above.
What remains uncertain
| Question | Status of the evidence | What would settle it |
|---|---|---|
| How much was stolen? | Estimate. Elliptic: $6.43 billion. TRM: about $6.36 billion across ten blockchains. Chainalysis: about $6.4 billion. Binance: "estimated impact" about $6.3 billion. Earlier estimates of $3.3 to $5.8 billion came from the first hours | A wallet-level reconciliation by Binance |
| How much is frozen? | Estimate. Binance about $3 billion; Elliptic $2.85 billion; Chainalysis about $2.8 billion; TRM about $2.7 billion. Write "about $2.7 to 3 billion", and do not add figures from different sources | Itemised list by asset and issuer |
| Can Binance repay? | Claim, unverified. Over $6.34 billion "reserved", about $5 billion in the same tokens (including BNB, Binance's own token); SAFU about $1.0 to 1.3 billion in bitcoin. No audited 2026 balance sheet read | A proof of reserves covering liabilities and naming an auditor |
| What was the cause? | Partly established. Hypernative: every outflow was signed with Binance-controlled keys; the attack abused signing access, not a contract. Elliptic: the attacker did not steal the keys but induced Binance systems to sign (50 EIP-7702 authorisations from "Binance 14"). The DevOps laptop is Binance's account; it also cites "additional points of breach" | Binance's post-mortem, not yet published |
| Who did it? | Attribution by firms, not by authorities. TRM: "high confidence". Chainalysis: attributes, no stated level. Elliptic: "likely", "not yet certain". FBI: aware, coordinating | An official attribution or forensic publication |
| Have withdrawals resumed? | Announced, not confirmed. Timing quoted as 34, 45 or 48 hours | Observed withdrawals on major networks |
| Is Binance licensed in France? | Single non-primary source. Selectra says Binance lacks the MiCA authorisation required since 1 July 2026. The AMF page read states the general deadline and does not mention Binance | AMF register or Binance France |
Vocabulary. Infosecurity's headline says "stolen" where Binance says "estimated impact". Elliptic excludes a further $169 million that left Binance after withdrawals were suspended: it says these went to long-established addresses with no link to the attacker, and does not say they were an internal leak.
What six AI assistants say
On 31 October 2026 Satcove pasted one dossier and two missions into six consumer chat assistants through their web interfaces, one round, no follow-up: ChatGPT, Gemini, Claude, Mistral, Perplexity and Grok. The questions were posed in French and answered in English. The apps chose their own model settings (Grok in "Fast" mode, Claude on a small, fast model tier); Claude and Perplexity searched the web, so their answers are not limited to the dossier. Satcove compared the answers; they are model opinions at a date, not forecasts. Mission 1 asked whether Binance can recover and how to tell real recovery from crisis communication. Mission 2 asked who is most likely behind the attack.
Can Binance recover?
All six rate financial recovery as High (Perplexity: 70%, "medium-high") if the reserve claims are accurate, operational recovery as Medium (Mistral: medium to high), and regained confidence as Medium (Claude: Low now, medium by 30 days; Perplexity: 45%). The shared logic: a covered loss is not a solved trust problem.
| AI | Financial / operational / trust | Main risk | Signal of real recovery | Signal of failure |
|---|---|---|---|---|
| ChatGPT | High / Medium / Medium | Customers doubt backing; withdrawals bunch up; selling under pressure creates slippage | Independently verified disclosure of liabilities, sustained unrestricted withdrawals, technical post-mortem | Repeated suspensions, unexplained changes to reserve figures |
| Gemini | High / Medium / Medium | Delay beyond published timelines, or unrecorded liabilities revealed by the reserves report | Seamless withdrawals plus an audited, unencumbered reserves snapshot | Prolonged freeze, emergency credit requests, secondary drains |
| Claude | High / Medium / Low now | A run when withdrawals reopen while about $1.3 billion must still be bought OTC in a falling market | On-time reserves report with independent attestation, then normal withdrawal queue | Report delayed or unaudited, unexplained reserve-wallet movements, missed deadlines |
| Mistral | High / Medium-High / Medium | Gap between the ~$1.3 billion still to buy and a post-restart run | Restart on schedule, verified reserves, net inflows over 30 days | Restart delayed again, phased "indefinitely", quiet use of client balances |
| Perplexity | Medium-High (70%) / Medium (60%) / Medium-Low (45%) | A run combined with falling prices, since coverage is partly in volatile tokens | Restart on schedule; reserves report separating liabilities, holdings and the incident reserve, with attestation | Postponed restarts; reserves report without liability method; opaque OTC trades |
| Grok | High / Medium / Medium | Runs plus a delayed or incomplete reserves report plus regulatory freezes | Phased restart without queues, independent report matching liabilities, recovery of frozen assets | Prolonged suspension, shortfall or opacity, new compromise disclosures |
Points all six make: the $6.34 billion is "credible as a company statement but not independently shown"; a proof of reserves shows assets at a moment and does not by itself prove that liabilities are covered or that funds are unencumbered; a restart will probably cause an initial outflow spike; and frozen funds are not recovered funds.
Who is behind the attack?
Each AI gave odds for five possible explanations: TraderTraitor (a hacking group linked to North Korea), independent hackers with no state backing, an insider at or near Binance, a false flag (someone imitating North Korea to hide their tracks) and a mixed scenario combining several of these. Read each row as: the AI's best guess and its odds, then the odds it gave to the other explanations.
| AI | Best guess and odds | Odds for the other explanations | Strongest evidence | Weakness | Would invalidate it |
|---|---|---|---|---|---|
| ChatGPT | TraderTraitor, 40% (68% for any North Korea-linked scenario), through compromised privileged access; confidence medium | Independent hackers 20%, insider 10%, false flag 2%, mixed 28% | EIP-7702 signed with a Binance key; three firms attribute | Circumstantial; firms may share data; no government | Forensics linking operators to another group, or showing the similarities are generic |
| Gemini | TraderTraitor, 70%; confidence medium-high | Independent hackers 10%, insider 4%, false flag 1%, mixed 15% | Funds mixed with the Bitget proceeds; speed of movement | No official attribution or post-mortem | Evidence of a contract vulnerability, or a different syndicate |
| Claude | TraderTraitor, 70%; confidence medium-high | Independent hackers 8%, insider 7%, false flag 3%, mixed 12% | Signing-key abuse, the Bitget link, the Bybit pattern | Mixing is weak evidence; analysts cite each other | Post-mortem pointing to an insider or vendor with no North Korean link |
| Mistral | TraderTraitor, 70%; confidence medium-high | Independent hackers 15%, insider 10% (25 to 30% if counted as a component), false flag 3%, mixed 25% | Three firms, Bitget mixing, scale | No ransom or claim fits states but is not proof | A different official attribution, or extortion behaviour |
| Perplexity | TraderTraitor, 65%; confidence medium-high | Independent hackers 15%, insider 12%, false flag 3%, mixed 20% | Three firms, Bitget overlap, operational fit | No claim, no government confirmation | Wallets, infrastructure and cash-out unrelated to known clusters |
| Grok | TraderTraitor, 55 to 65%; confidence medium | Independent hackers 20 to 25%, insider 10 to 15%, false flag under 5%, mixed 15 to 25% | Same three firms, mixing, speed | No official attribution, no claim | Proof of a pure insider sale, or non-North Korean attribution by firms and governments |
Percentages overlap for Mistral, Grok and Perplexity (the mixed scenario is counted on top of the others), so the columns do not always sum to 100. All six call the DevOps-laptop account an entry point or a simplification rather than a proven root cause, and all warn about confirmation bias: once TRM named TraderTraitor, other analysts may read familiar patterns as proof.
Disagreements that matter
1. How strong is the Bitget link?
Gemini: the mixing of Binance funds with Bitget proceeds "strongly supports" a North Korean author. Claude: it is "weak evidence" because laundering networks are shared. Why they differ: commingling can come from a shared author or from a shared cash-out service, and the dossier cannot tell the two apart. What would settle it: infrastructure overlap or malware evidence, not wallet mixing. For the reader: read the attribution as a strong hypothesis from private firms, not a finding.
2. How likely is a messy first week?
Claude: a partial reopening with outflows has a 20% probability. Mistral: 50%, higher than a controlled restart (45%). ChatGPT, Gemini, Grok and Perplexity sit between 40% and 45%. Why they differ: the more pessimistic models treat any delay or token-by-token limit as a failed restart; the others treat a staged restart as the plan. What would settle it: which tokens and networks reopen, how quickly, and with what limits. For the reader: limits or delays on withdrawals do not, alone, show a shortfall; a reserves gap would.
3. What will the proof of reserves prove?
All six say it cannot by itself prove solvency, but they weigh it differently: Gemini gives 55% to "confidence restored" within 30 days, ChatGPT 30%, Claude and Grok 35%. Why: whether a published snapshot will include customer liabilities and an independent auditor is unknown. What would settle it: the report's method and who signs it. For the reader: judge the report by whether it shows liabilities, not only assets.
4. Does frozen help now?
Gemini: frozen funds are "non-liquid until legal processes complete" and cannot meet redemptions. Mistral: they can potentially be clawed back via issuer cooperation. Why: both can be true on different time horizons. What would settle it: the first confirmed return of frozen funds, and to whom. For the reader: until money returns, the repayment promise rests on Binance's own balance sheet.
5. Is the laptop story a root cause?
No assistant defends it as the root cause. This is agreement, not independent confirmation: all six read the same dossier statement that additional breach points exist. What none could say is how a single laptop reached signing authority. For the reader: the unanswered question is a control failure, not a single stolen device.
Errors found in the answers
The dossier supplied to the models still contained an older line saying TRM Labs, Elliptic and Chainalysis all attribute the attack with "high confidence". Elliptic's page says "likely" and "not yet certain". Gemini and Mistral repeated the older wording; this article uses the Elliptic wording. Mistral also calls the $169 million that left after the suspension a possible "red flag" for internal leakage; Elliptic says only that it excluded those transfers. Claude cited unverified "inside job" claims on X. Perplexity wrote of "mixer-style obfuscation", which no source read shows. These claims are not used here.
What coverage missed
- The reserve is partly in Binance's own token. The assets said to cover about 80% of losses include BNB, whose value tracks Binance's health (raised by Gemini and Perplexity).
- A snapshot is not a balance sheet. Reserves proofs usually show assets; customers need liabilities, encumbrances and an auditor (all six).
- Whose money left. The sources do not say whether the drained assets were customer or corporate funds, which changes who bears the loss before any pledge applies (Claude).
- Issuers can freeze. Tether and Circle froze about $2 billion within hours. That limited the loss and also shows how much depends on centralised stablecoin issuers (Gemini).
- A staged restart can mean unequal access. The order in which tokens and networks reopen has not been published (ChatGPT).
Scenarios
The table below gives the range across the six assistants and their median. Each assistant defined the scenarios from Satcove's wording, but the pairs are not complementary: the two scenarios at each horizon sometimes sum above or below 100%. These are editorial estimates by models, not statistics, and give no price forecast.
| Horizon | Scenario | Range (median) | Validation signals | Invalidation signals | Consequence for users |
|---|---|---|---|---|---|
| 7 days | Controlled restart | 45% to 65% (52%) | Withdrawals observed on major networks; published limits; reserves report with liabilities | Restart date missed again; repeated suspensions | Access returns, possibly capped or staged |
| 7 days | Partial restart and outflows | 20% to 50% (40%) | Some tokens only; heavy outflows; wider spreads | Full opening within the window | Delays and limits on some assets |
| 30 days | Confidence restored | 30% to 55% (35%) | Clean reserves report; post-mortem published; first frozen funds returned | Selective payouts; report without liabilities | Normal withdrawals; compensation process clearer |
| 30 days | Prolonged outflows and regulatory pressure | 30% to 60% (50%) | Investigations; disputes over frozen assets; sustained net outflows | Net inflows resume | Slower access; possible restrictions by jurisdiction |
| 6 months | Binance keeps its dominant position | 40% to 75% (60%) | Stable share; audited statements | Licence losses; sustained share loss | Little change to where users trade |
| 6 months | Binance loses significant share | 20% to 55% (32%) | Licence or enforcement actions; competitor gains | Recovery of volumes | More users move some assets to rivals or to self-custody |
Has there been worse?
By amount, no known precedent comes close if Elliptic's figure holds. The nature of the event matters as much as the number.
| Case | Date | Amount | Nature | Source / status |
|---|---|---|---|---|
| Binance | 29 Oct. 2026 | $6.43 billion (Elliptic); estimated impact $6.3 billion (Binance) | Exchange hack: signing access abused | Elliptic, Binance |
| Bybit | Feb. 2025 | $1.46 billion | Exchange hack | Elliptic |
| Ronin | Mar. 2022 | about $625 million | Validator keys compromised | Dossier figure, not re-opened |
| Mt. Gox | 2011 to 2014 | about $470 million at the time (value varies with the bitcoin price) | Theft, then bankruptcy | Dossier figure, to be confirmed |
| FTX | Nov. 2022 | not comparable | Fraud and bankruptcy, not a hack | Dossier |
What about France?
Only Selectra (30 October 2026) describes the French position: Binance would lack the MiCA authorisation required since 1 July 2026, would no longer onboard French customers and would have cut their deposits; withdrawals, the only way out, are suspended. The AMF page Satcove read confirms the general rule (providers need MiCA authorisation from 1 July 2026) but does not mention Binance, and a Binance statement on its licence could not be found. Treat the status as unverified and check the AMF register or Binance France. Selectra adds that the 100,000-euro deposit guarantee does not cover crypto-assets and that Binance's pledge is not a legal guarantee.
Satcove verdict
In short: Binance can probably recover financially, but regaining trust will take longer, and nothing read proves it yet.
- Can Binance recover? The six assistants agree: probably yes on the money, if Binance's reserve claims are accurate. Trust is harder and slower to rebuild. Satcove shares that reading. Confidence: medium.
- Why not more certain? The $6.34 billion is a statement by Binance itself. About 80% of it is said to sit in volatile tokens, BNB included, and no audited 2026 figure has been read.
- Who did it? TraderTraitor, the North Korea-linked group, is the strongest hypothesis. TRM Labs states high confidence, Chainalysis and Elliptic concur in different words, and the stolen funds were mixed with those of the Bitget hack. But this comes from private firms, no government has confirmed it, and the Bitget link alone is weak evidence. Confidence: medium to high.
- What would prove a real recovery? Withdrawals reopening on the major networks without new limits; a reserves report that shows liabilities and names an auditor; a post-mortem that explains how one compromised laptop reached signing authority.
- What to watch first? Whether withdrawals actually reopen, the content and method of the reserves report due on 2 November, and the post-mortem. A missed deadline, a gap in reserves or a post-mortem that contradicts earlier statements would lower this verdict.
The hack may be behind us; the proof that Binance can truly cover it, regain trust and avoid a lasting outflow has not yet been made. This article gives no investment advice and no price forecast, and any message asking for your credentials is a scam.
Confidence note. Medium overall. Valid on 31 October 2026, based on sources read up to 31 October 05:00 UTC.
Frequently asked questions
Was Binance hacked for $6.3 billion? Binance gives an estimated total impact of about $6.3 billion. Elliptic estimates $6.43 billion stolen, TRM about $6.36 billion and Chainalysis about $6.4 billion. Figures differ by method and time.
Are my funds lost? No final net loss is established. Binance promises to cover all losses; that is a company commitment, not a legal guarantee.
When will Binance withdrawals resume? Binance announced a phased restart within roughly 34 to 48 hours of its 30 October updates, subject to security checks. No source read confirms a restart as of 31 October, about 10:30 UTC. Deposits were restored.
Is the SAFU fund enough? Not alone: about $1.0 to 1.3 billion in bitcoin against an estimated impact of $6.3 billion. Binance says it reserved over $6.34 billion of company funds; proof of reserves was promised for 2 November.
Who is behind the attack? TRM Labs attributes it to TraderTraitor with high confidence; Chainalysis attributes it to the same group; Elliptic says "likely". No government or Binance attribution exists.
Has there been a bigger crypto theft? The previous record cited is Bybit in February 2025, $1.46 billion according to Elliptic. FTX was a fraud and bankruptcy, not a hack.
Are French customers protected? According to Selectra, deposit insurance of 100,000 euros does not cover crypto-assets and Binance's pledge is not a legal guarantee. Binance's French licensing status is unverified.
Is Binance dead? Nothing read supports that. The measurable risk is loss of trust, which will show in actual withdrawals, net flows, the reserves report and the post-mortem.
Sources and limits
Opened by Satcove for this update (31 Oct. 2026): Elliptic, "The largest theft in history" (updated 31 Oct., 05:00 UTC); TRM Labs, "North Korea steals $6.36 billion from Binance" (30 Oct.); Chainalysis, "Binance exploit: latest findings" (30 Oct.); Hypernative, "Inside the largest crypto theft of all time" (30 Oct.); AMF, MiCA publication page (general rule, dated June 2023).
Read earlier (30 Oct.): TechCrunch, Bitcoin.com (two pages, latest 23:05 UTC), Infosecurity Magazine, The National, Bitcoin Magazine, AirdropAlert (secondary), Selectra, Yahoo Finance France, La Revue du Digital.
Not opened or not readable: Binance's announcement pages (navigation only); Binance, Yi He, CZ, Tether, Circle and Binance.US posts on X; Reuters, BBC, Forbes and CoinDesk coverage cited by a web-enabled assistant; Chainalysis's Bitget article.
Limits of the AI panel. Single round, consumer apps, different model settings, two with web search. They worked from Satcove's dossier, which contained one outdated attribution line (corrected above). Their probabilities reflect the dossier and general knowledge, not independent intelligence. Anything an assistant added from outside the dossier was excluded unless confirmed by a source above.
Logo: the Binance logo (Wikimedia Commons, file Binance_logo.svg, public domain as a text logo) identifies the company; Binance is a registered trademark.
Update log
- 31 Oct. 2026, ~10:30 UTC: third version. Figures aligned with Elliptic, TRM Labs and Chainalysis pages; hack methodology and attribution updated; two missions put to six assistants (recovery and attribution); disagreements, scenarios and verdict rewritten; status banner added. Withdrawals not confirmed as resumed.
- 31 Oct. 2026, ~04:00 UTC: second version, with eight questions put to six models through their APIs and a structured comparison.
- 31 Oct. 2026, ~02:30 UTC: recovery plan added (over $6.34 billion reserved, proof of reserves promised for 2 Nov., phased restart within about 34 hours).
- 30 Oct. 2026, ~13:00 UTC: first version; withdrawals suspended, deposits restored, no official attribution.