Articles★ Featured

Sixty Hours: What the Binance Hack Taught Us About On-Chain Finance

Hackers took $6.3 billion from Binance in 20 minutes. Sixty hours later, withdrawals were back. Here is what a public ledger made possible, and what it still cannot do.

By Remi·November 10, 2026·12 min read

Remi Articles cover for Sixty Hours: What the Binance Hack Taught Us About On-Chain Finance, showing a ledger, a 60-hour stopwatch and a frozen wallet

On the afternoon of 29 October, hackers drained about $6.3 billion from Binance in roughly 20 minutes. By most counts it is the largest theft of any kind ever recorded. Sixty hours later, Binance customers were withdrawing their money again, and none of them has been asked to cover a cent of the loss.

Most of the coverage has been about the size of the hit. I think the bigger story is what happened in the hours after it.

The first stolen funds were frozen in under an hour. About half the total was locked within a day. Binance has since replaced 95% of what was taken out of its own pocket, with no law forcing it to, and has promised the rest.

In banking, stolen money usually slips away through mule accounts, which are bank accounts criminals rent or borrow to pass cash through. Tracing it takes years. On a public ledger, you can watch a theft happen, follow it and stop part of it while it is still in motion.

Sixty hours, step by step

The attackers went after one of Binance's hot wallets. Think of a hot wallet as the cash drawer at the front of a bank branch. It is online and holds what the exchange needs for day-to-day withdrawals. Co-CEO Richard Teng said the attackers abused a recent Ethereum feature called EIP-7702 to make that wallet follow their instructions, skipping Binance's normal approval checks (Cryptonomist). The vault, known as cold storage, holds most customer funds offline. It was not touched (TokenPost).

How the attack started. Source: Chainalysis, 30 October 2026.

Read it from left to right. The pink circle is a mixing service, a tool that blends many people's coins together so nobody can tell whose is whose. The attacker used it to get clean-looking money. That money paid for two wallets, shown as brown circles: one to fund the attack and one to launch it. The pink arrows on the right are the moments the attacker's code reached into Binance's wallet and pulled the money out.

Timeline of the Binance hack from the first theft on 29 October to withdrawals reopening on 1 November

Wikipedia, CNN, crypto.news, Brad Feld, FBI.

Binance posted updates on X through all of this, signed by both co-CEOs, Yi He and Richard Teng. The numbers changed every day. The message did not. Binance would carry the loss, and its users would not.

Detect, follow, freeze

Tether froze the first attacker wallet at 5:01 pm, 56 minutes after the attack began. Circle followed at 5:04 pm. By the next day, about $3 billion of the stolen money could no longer move.

Bar chart: about $3.0B of the stolen funds frozen by Tether, Circle and partners, $1.5B could not be frozen and $1.8B still held by the attackers

This only works because every transfer on a public blockchain is visible to anyone who looks. Within minutes, analysts at TRM Labs, Elliptic and Chainalysis were tracking the money wallet by wallet. Stablecoin issuers like Tether and Circle can freeze their own tokens at any address, and they did. The FBI later published the Ethereum, Bitcoin and Solana addresses tied to the hack. Every exchange in the world now has a list of wallets to turn away.

Not everything could be stopped. Bitcoin and ether have no central issuer, so nobody can freeze them. Part of the haul is still with the attackers, and they will likely try to launder it slowly over months. Still, as of 30 October they had not managed to turn any of it into cash (Wikipedia).

Compare that with a bank wire. Once a fraudulent transfer leaves a bank, it moves across private ledgers that only the banks involved can see. Getting it back depends on requests, court orders and the cooperation of other banks, often in other countries. By the time anyone has the full picture, the money is usually gone.

A map of every dollar

Source: Chainalysis, 30 October 2026.

Here is what you are looking at. Every grey dot is a wallet, which works a lot like a bank account that anyone can look up. Every thin line is one payment from one wallet to another. The attacker's software bounced the stolen money around this web thousands of times to confuse anyone following it. It looks like chaos, but every line is on record, with its amount and its time, for anyone to check.

The day after the hack, Chainalysis published a set of graphs tracing the stolen money, including the one above. Its CEO Jonathan Levin shared one on X with a short message. Industry partners had already frozen about $3 billion, and Chainalysis would keep following all of the funds (CoinGape).

The attacker knew they were being watched. According to Chainalysis, they rushed $500 million of stablecoins into a single wallet and swapped $325 million of it for about $285 million of ether in roughly 20 minutes. Giving up $40 million on one rushed trade tells you how badly they wanted out of anything that could be frozen. They still lost much of that race. Chainalysis dates the first freezes to 5:14 pm, and other records put Tether's first freeze at 5:01 pm. Either way, it took less than an hour.

The race against the freeze. Source: Chainalysis, 30 October 2026.

This picture shows the race in four steps. A quick word first: stablecoins are digital dollars, and the company that issues them can lock them in place. Ether, the coin of the Ethereum network, has no such company, so nobody can lock it.

The attacker sends $500 million in stablecoins to one wallet.
That wallet trades $325 million of them for ether, to get the money out of reach.
The attacker rushes the last $175 million to a brand new wallet, hoping to move before anyone notices.
It is too late. The issuer locks that wallet, and the $175 million cannot move.

Then they tried something new. Thousands of automated transfers loop the money back and forth between addresses, many of them first seeded with exactly 1 TRX, the coin of the Tron network. Chainalysis says it had never seen this pattern before. The aim is to bury the trail in noise. But every one of those hops is still on the map. Messy is not the same as hidden.

The map also gave away who did it. Chainalysis watched the stolen funds mix on-chain with money from last month's Bitget hack, which was already tied to North Korea. It named TraderTraitor at 12:30 am, about eight hours after the theft began (Chainalysis).

How the attacker was identified. Source: Chainalysis, 30 October 2026.

The top half is the Binance money. It splits across several wallets and then comes back together, a trick called layering. The bottom row is money from an earlier hack that was already linked to North Korea. On the right, the two streams end up in the same wallet. That shared wallet is the fingerprint. In banking terms, it is like finding cash from two different robberies in the same safe deposit box, and seeing it happen live.

There is no picture like this in banking. Each bank sees its own ledger and nothing else. Once money lands at another bank, especially in another country, the trail goes dark until someone gets a court order. Nobody can draw the full map while the theft is still happening. In the Commerzbank case, it took nearly three years just to reach the first arrests.

Nobody made them do it

No rule required Binance to pay back a single customer. As NPR noted, Binance has promised to repay users, but current rules do not necessarily force it to (NPR). A bank in the same position would usually be meeting a legal duty. Binance was keeping a promise.

It kept it fast. On 30 October the exchange reserved more than $6.34 billion of company money. About $5 billion of that was already held in the exact tokens that were stolen, and it bought the rest on the open market and through over-the-counter desks (TokenPost). In Teng's words on X: "Our users will not bear the financial impact of this incident."

Bar chart: Binance replaced 80% of the stolen assets by 30 October, 90% by 31 October and 95% by 1 November, when withdrawals reopened

The money came from four places: the Secure Asset Fund for Users (SAFU), the futures insurance fund, Binance's bitcoin reserve and its corporate treasury (Wikipedia). SAFU exists for exactly this kind of day. Binance has said it will refill it to about $1 billion and publish a full incident report once the investigation ends (Brad Feld).

The frozen $3 billion is not part of that $6.34 billion. Binance counted it as still to be recovered (crypto.news). So the exchange did not wait for the freeze to pay off. It paid first and kept chasing the money second. That is the order customers care about.

The best test of whether customers believed it was what they did next. By Sunday afternoon they had pulled $4.6 billion out and put $1 billion back in. That is a net outflow of about 2% of Binance's $171 billion in assets (Brad Feld). Anyone who has watched a real bank run knows what one looks like, and this was not it. People checked that their money was there, and most of them left it where it was.

How banking handles the same problem

Bank customers are well protected too, and it is only fair to say so. When hackers break into a bank's own systems, the bank almost always carries the loss. The real difference is what happens to the stolen money.

Take Commerzbank. In November 2023, attackers used a faulty software update at a payment provider to drain about €30 million from customer accounts over four days. The bank made its customers whole (The Record). The money itself went through shell companies and crypto platforms, mostly to Brazil. Police made the first arrests in August 2026, nearly three years later, and a Brazilian court ordered about $20 million in assets seized (Help Net Security). I found no report of any money actually returned yet.

Or take the Carbanak gang. From 2013 it broke into more than 100 banks in 40 countries and took over $1.2 billion. The banks lost their own money, not their clients'. The suspected leader was arrested in Spain in 2018, and the stolen cash had already been laundered (Engadget).

Comparison table of the Binance 2026, Commerzbank 2023 and Carbanak 2013 to 2018 thefts: amount stolen, duration, funds frozen, customer losses and arrests

In all three cases, customers came out whole. The difference is the money. In banking, stolen funds disappear into private systems and come back slowly, if at all. On a public ledger, half of them were frozen before the first day was over.

What this does not prove

Now for the parts that do not fit so neatly.

Binance paid because it chose to and because it could. Very few exchanges hold billions in spare reserves. NPR noted that critics worry smaller exchanges would struggle to repay users after a hack like this (NPR).

Crypto also has worse stories. After the Bitfinex hack in 2016, every user lost about 36% of their balance and got IOU tokens in its place. Bitfinex bought those back within about eight months (Cointelegraph). Mt. Gox customers had it far worse. After the exchange collapsed in 2014, they waited more than ten years to start getting paid (Cointelegraph).

The attack also exposed a real weakness inside Binance. On the Ethereum side, nothing was forged. As one security engineer put it in a discussion Brad Feld shared, Binance's own signing system approved transactions it should have refused (Brad Feld). The blockchain did exactly what it was told. The failure was in who got to do the telling, and Binance owes the market a full account of it in its incident report.

The full proof of reserves is also running late. It will let each customer check that their balance is backed, and it is now due on 3 November (UTC), a day after the original promise.

So here is the honest version. The public ledger made the theft visible and partly reversible. Binance's reserves, and its choice to spend them, did the rest. Take away either one and this story ends very differently.

What it means

For years, critics treated transparency as crypto's weak spot. Every transaction is public, so every mistake is public too. This week turned that around. Because the ledger is open, the industry saw the theft as it happened. Several companies froze funds within the hour, and law enforcement had a clear trail from day one.

I build payment infrastructure for a living, so this is the part I care about most. Stablecoins with freeze controls, real-time monitoring and a funded protection reserve turned the largest theft on record into a 60-hour pause for customers. None of those three is exotic. They can be designed into any system that moves money.

The next step is to make Binance's response the standard rather than a choice. That means protection funds that are required by rule, checked by auditors and big enough for the risk. Get that right, and the public ledger becomes one of the strongest consumer protections in finance.