Binance $6.3B Hack and the SAFU Gap

At 20:05 UTC on Thursday, October 29, 2026, five Binance wallets on the XRP Ledger emptied themselves into a single address, leaving only dust behind. Fifteen minutes later, a Binance Bitcoin hot wallet sent 18,270 BTC (about $1.47 billion) into the same cold dark. By the time the sweep finished, roughly $6.3 billion had drained out of Binance’s hot wallets across ten blockchains. It is the largest crypto theft on record.

Then the withdrawals stopped. Users with balances on the exchange could watch their holdings and could not move them. BNB (BNB-USD) fell about 7% to roughly $699 during the session, and Bitcoin (BTC-USD) traded at $77,929 at 8:00 p.m. ET, according to verified market data for the completed session.

Binance’s own account, published as a Security Incident Update on October 30, puts total impact at about $6.3 billion and says about $3 billion had been frozen on-chain. Deposits are operating normally and withdrawals are expected back within 48 hours. The exchange says it will cover all losses from its SAFU fund and company funds.

What the Public Record Shows About Binance’s Bottom Line

There is no audited consolidated net profit or net loss for Binance Holdings Ltd. in public circulation. The company is privately held, has no official headquarters, and does not publish consolidated financial statements. The last revenue figure in wide circulation is $12 billion for 2022, reported by Fortune, and there is no comparable audited net income for 2023 through 2026.

Two figures get mistaken for that bottom line. The first is BNB Chain network revenue, which reached $54.2 million in the third quarter of 2026. The second is the $1 billion in assets under management that bStocks, Binance’s tokenized-equity product, crossed in October. Neither is Binance Holdings’ profit: the chain number accrues at the protocol layer, and the bStocks number is client money, not revenue.

The Breach: $6.3 Billion Out, $3 Billion Frozen

TRM traced the first outflow to the XRP Ledger between 20:05 and 20:09 UTC on October 29, where five Binance wallets sent 233.46 million XRP to a single address and left only minimum balances behind. At 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 BTC, worth about $1.47 billion. Ethereum carried the largest share, about $3.79 billion including 200,630 ETH and 185 other tokens, among them 1.875 billion USDT and 823 million USDC, according to TRM Labs. The total reached roughly $6.36 billion across ten chains, about four times the $1.5 billion Bybit theft of February 2025.

On Ethereum the attacker used EIP-7702, a feature that lets an ordinary wallet delegate its code to a contract, to turn the hot wallet into a sweeper it controlled. Decrypt reported that a delegation was submitted about three minutes before the first transfer. TRM counts 50 pre-signed authorizations and reads the pattern as compromise of Binance’s hot-wallet signing infrastructure rather than a flaw in Ethereum itself.

Stablecoin issuers moved faster than courts could. Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet, about $1.8 billion at the time, per Decrypt. TRM counted roughly $2.7 billion frozen once Ripple, World Liberty Financial and Arbitrum’s security council were included. The same firm attributes the attack to TraderTraitor, North Korea’s hacking unit, with high confidence, citing Tornado Cash funding of the operator wallet 36 hours earlier and rehearsals on test wallets.

Binance co-CEO Richard Teng pushed back on the simplest version of that story, saying the breach was not a single one-click action and that the investigation has not attributed responsibility to any individual. He repeated that no private-key leak had been found, Cointelegraph reported. CoinDesk found that Binance 14, one of the drained wallets, appears in Binance’s October proof-of-reserves, which means the crypto that moved was backing customer balances; as we detailed in our explainer on the breach, that makes the pledge to cover losses a balance-sheet commitment rather than a reassurance.

BNB Chain’s third-quarter numbers are the clearest revenue disclosure anywhere in the group. Network revenue rose 54% to $54.2 million from $35.2 million, according to Blockworks data reported by Blockonomi. Transaction fees supplied $49.1 million and maximal extractable value payments $5.1 million. The chain processed 1.51 billion transactions, up 7.5%, at an average fee of $0.032.

BNB Chain Q3 2026: $54.2 Million Revenue, Up 54%, and a 1.646 Million BNB Burn

The 37th quarterly burn removed about 1.646 million BNB on October 19, worth roughly $1.2 billion at about $729 per token, leaving supply near 131.51 million. That burn is the link between exchange activity and token value, and it is also why the chain’s revenue line cannot be read as Binance’s profit: users pay those fees to validators and to the burn, and they are not booked as corporate earnings.

The weak spot sits in usage. Daily active addresses fell 14% to 2.10 million. Turnover was carried by tokenized equities rather than organic payments, with about $25.6 billion of tokenized-stock trades in Q3, roughly 11 times the $2.4 billion recorded in Q2, per the same Blockworks report. A 54% revenue increase on falling addresses is a fees-and-mix story, and it is a small one next to a $3.3 billion loss.

bStocks: $1 Billion in AUM and $40 Billion of Volume in Four Months

bStocks, the tokenized-equity line Binance launched in June 2026, crossed $1 billion in assets under management in October, its fourth month, according to a company announcement. The same release claims more than $40 billion in cumulative trading volume, nearly 100 listed products, and $6 billion of 1:1 conversions. Those are Binance’s own figures, distributed through PR Newswire and carried by CNBC-TV18, and none of them is independently audited.

The 1:1 backing claim matters more than the headline. If each token is matched by a share held in custody, the $1 billion is client assets, and Binance earns fees on trading and conversion rather than a spread on the asset base. AUM tells you about adoption. It does not tell you about margin.

Both the growth and its concentration are visible in the numbers. BNB Chain’s tokenized-stock trading reached $25.6 billion for Q3, with supply of $1.13 billion and about 1.8 million holders. QQQB, the tokenized Invesco QQQ ETF, accounted for about 80% of bStocks’ DEX volume. A product line that depends on one index tracker for most of its turnover is a narrow franchise, and access is limited to eligible non-US users.

BNB at $714.29: Reading the Price Without Overreading It

BNB’s tape on October 29 was a confidence move, not an earnings move. Decrypt recorded the token at roughly $699, down about 7%, as withdrawals paused. A later snapshot from Blockchain.news put BNB at $714.29, down 4.88% over 24 hours and below its 7-, 20-, and 50-day moving averages. The two prints differ by hours, not by source quality: the token bounced off the low and stayed negative on the day.

Bitcoin at $77,929 at 8:00 p.m. ET gives the reference point: the whole crypto complex was under pressure, and BNB carried an extra exchange-specific discount. At roughly $700 and about 131.5 million tokens outstanding, BNB’s implied market value is near $92 billion. That is arithmetic from two sourced numbers, not a reported valuation.

The price does not settle the financial question. BNB’s supply reduction is funded by chain fees, so a 54% rise in network revenue supports the burn, while a $3.3 billion loss is absorbed by the company. Those are different balance sheets under the same brand.

Auto Order Routing and the Product Build-Out

Product velocity did not stop during the incident. Binance introduced Auto Order Routing on Spot, which sends a single order through liquid pairs such as BTC/USDT to improve execution instead of filling against a thinner book. Since June 1, 2026, the exchange has also offered more than 7,000 US stocks and ETFs to eligible non-US users through an ADGM broker-dealer entity and Alpaca, per CoinDesk Research.

Neither launch carries a disclosed revenue figure. Their relevance is strategic and also operational: they diversify fee income beyond crypto spot, where September volume across 14 major exchanges rose 36.5% to $696.7 billion, and they widen the surface that has to be secured. This breach started in a withdrawal service, which is exactly the plumbing that tokenized equities expand.

What Would Close the Gap

Three disclosures would let a reader state Binance Holdings’ net profit or loss instead of an incident-level proxy. The first is audited consolidated financial statements, which the company has never published. The second is a regulatory filing in a jurisdiction that requires one, whether through a licensed subsidiary’s annual accounts or a registration with a US regulator. The third is a real-time reserve attestation with named addresses, which would show whether customer assets are whole after the freeze.

Until one of those exists, the defensible numbers are the ones above: roughly $3.3 billion of net loss exposure on the breach, a $4.3 billion settlement already paid, and a chain-level revenue line of $54.2 million that belongs to a separate ledger. Anyone treating the chain figure as Binance’s profit is off by two orders of magnitude.

Risks: Withdrawals, Reserves, and the Iran Probe

The first risk is operational. Withdrawals have to reopen on schedule, and Binance has to explain how a compromised DevOps laptop became authority to submit withdrawal transactions. A second delay beyond the stated 48 hours would turn a solvency question into a custody question, and BNB would price it before any filing does.

The second is legal. Reuters reported in September 2026 that federal prosecutors are investigating Binance over possible Iran sanctions violations, nearly three years after the $4.3 billion plea. The New York Times reported that prosecutors allege Chinese firms used the exchange to move proceeds from Iranian oil sales. That probe sits alongside the monitor installed by the 2023 settlement, so a compliance failure now is also a breach of the agreement that kept the company operating in the US market.

The third is competitive. CoinGecko data cited by Cointelegraph put the top-10 spot DEX-to-CEX volume ratio at 23.5% in the second quarter of 2026, up 2.1 percentage points from the first. Standard Chartered’s Geoffrey Kendrick argued the breach could push more flow toward decentralized venues and repeated a $100 UNI target for 2030. That is a forecast, not a result, but it names the direction of travel.

Outlook

Ownership and leadership add to the disclosure problem. Binance was founded in July 2017 by Changpeng Zhao and Yi He, raising about $15 million in an initial coin offering, according to the company’s public profile; it now lists Richard Teng and Yi He as co-CEOs and about 5,000 employees. Zhao pleaded guilty in 2023, served prison time, and was pardoned by President Trump on October 23, 2025. He said on X that he no longer manages the exchange, per BleepingComputer. A company with no audited accounts, no headquarters, and a founder outside management gives investors little to underwrite beyond volume and the token.

My call, stated as a forecast: BNB-USD trades below $680 at an 8:00 p.m. ET reading on November 30, 2026. The basis is mechanical. A paused withdrawal queue, an unresolved $3.3 billion loss, and a live sanctions probe give the token no reason to re-rate before the post-mortem and a reserve update land, and the Fed’s October 28 hold at 3.75% to 4.00%, covered here, keeps the speculative bid tight. The call fails if BNB holds above $680 through that date, which would mean the market treated the loss as a covered operating expense rather than a franchise problem.

For investors tracking the wider exchange trade, the comparison is instructive: Hyperliquid’s fee engine shows how a venue can publish protocol-level revenue, burns, and buybacks in near real time while a private company stays opaque. Binance reports neither an audited bottom line nor a reconciled reserve in real time. Until it does, the $6.3 billion breach is the only number on the record that can be checked against independent sources, and the company’s own profit remains the largest undisclosed figure in crypto.

Disclosure: This analysis is based on public reporting and verified market data as of October 30, 2026. It is not investment advice.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: