Finance
“Earlier this week, hackers drained more than $6 billion from wallets across at least four different blockchains, setting off a worldwide effort to contain the damage." (Instagram, @bloombergbusiness, published 2026-10-31)”
Plain restatementIn the week ending 2026-10-31, attackers removed more than $6 billion in crypto assets from Binance-controlled wallets on four or more blockchains, triggering an international containment and tracing effort.
General information only - not financial advice.
This Bloomberg post is accurate. Binance confirmed on its own official channels that attackers drained its hot wallets starting around 20:05 UTC on October 29, 2026, and estimated the impact at roughly $6.3 billion. Independent blockchain analytics firms put the figure slightly higher, at about $6.36 billion and $6.43 billion as of October 31, 2026, and identified nine to ten affected blockchains, so the post's "at least four" is a conservative floor rather than an error. Stablecoin issuers Tether and Circle froze at least $2.3 billion of the linked funds, and the FBI publicly attributed the theft to a North Korea-linked group on October 31, 2026. Two points of context the caption does not include: the money came from Binance's own exchange wallets rather than from customers' personal wallets, and by October 31 Binance said it had restored backing for about 90% of the affected assets and would resume withdrawals. The exact final total is still being revised across sources, and the full account of how the attackers got in has not been published. Anyone seeing this caption circulate now should know it describes what was taken on one night, not a standing shortfall.
[drifted from the evidence:] Earlier this week, [drifted from the evidence:] hackers drained more than $6 billion from wallets [drifted from the evidence:] across at least four [drifted from the evidence:] different blockchains, [drifted from the evidence:] setting off a worldwide effort [drifted from the evidence:] to contain the damage." (Instagram, @bloombergbusiness, published 2026-10-31)
[added by the neutral restatement:] In the week [added by the neutral restatement:] ending 2026-10-31, attackers removed more than $6 billion [added by the neutral restatement:] in crypto assets from [added by the neutral restatement:] Binance-controlled wallets [added by the neutral restatement:] on four [added by the neutral restatement:] or more blockchains, [added by the neutral restatement:] triggering an international containment and tracing effort.
Red-tinted words in the claim drifted from the evidence. Green-tinted words are what a neutral restatement needs.
The trace / claim to source
- A breach of Binance occurred on 2026-10-29, which falls within the week referenced by a post dated 2026-10-31. Binance confirmed it publicly and estimated the impact at about $6.3 billion in token assets.
- "More than $6 billion" is supported and is, if anything, conservative. Independent blockchain analytics firms put the total at approximately $6.36 billion (TRM Labs) and $6.43 billion (Elliptic), both as of 2026-10-31.
- "At least four different blockchains" is supported as a floor. Published on-chain reconstructions identify nine to ten affected networks, so the claim's stated minimum holds.
- The description of a worldwide containment effort is supported: Binance paused withdrawals across networks, Tether and Circle froze at least $2.316 billion in stablecoins as of 2026-10-30, and the FBI, Secret Service and IRS-CI engaged with the case.
- The post is authentic Bloomberg content promoting a real Bloomberg article published 2026-10-31, not a fabricated or repurposed graphic.
- The caption says "wallets" without stating that these were Binance's own exchange-controlled hot wallets, not individual customers' self-custody wallets. A reader could take it to mean personal wallets were drained directly. The underlying record is specific that unauthorized withdrawal transactions were submitted from Binance hot wallet infrastructure. This does not change whether the claim is true, but it changes what a casual reader pictures.
- Date context mismatch (forward-looking, applies to anyone reading the post now rather than to the post as written): by 2026-10-31, Binance stated it had restored backing for about 90% of the affected assets and planned to resume withdrawals on 2026-11-01. The caption is an accurate snapshot of the drain, but circulated later without that update it understates how much had been replenished. The $6 billion figure describes what was taken, not a standing net loss to users as of 2026-11-01.
- The precise total is still being revised. Binance's own figure (~$6.3bn), TRM Labs (~$6.36bn) and Elliptic (~$6.43bn) differ, as valuations depend on token prices at the moment of transfer and on which addresses are included. All three exceed $6 billion, so the claim's threshold is not in dispute.
- The full attack vector is not settled. Binance's initial statement pointed to a compromised DevOps engineer's laptop, and at least one later security write-up states investigators found additional points of breach. The complete forensic account has not been published.
- How much of the stolen value will ultimately be recovered or permanently frozen is open. Roughly $2.3 billion in stablecoins was frozen by issuers as of 2026-10-30, but frozen is not the same as returned, and the fate of the non-stablecoin portion is unresolved as of 2026-11-01.
- The FBI's attribution to the North Korea-linked TraderTraitor group is an official assessment made on 2026-10-31. It has not been tested in court, and Binance had not itself named the attacker at that point.
Binance itself confirmed the breach. Binance said the incident began at approximately 20:05 UTC on October 29, 2026 and involved compromised hot wallets, with the company's official estimate of the impact at about $6.3 billion in token assets. On its initial investigation, Binance said the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The exchange paused withdrawals on multiple networks as a precaution and confirmed to reporters it was dealing with a security incident. The multi-chain element is documented in detail. On-chain analysis records wallets on ten blockchains being hit: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. One independent reconstruction records that in under four hours the wallets sent coins worth about $6.3 billion to new addresses, with Ethereum, Bitcoin and TRON taking the biggest hits. Independent sizing sits slightly above Binance's own figure: Elliptic's analysis shows $6.43 billion in cryptoassets was stolen from Binance on October 29 2026, more than four times the $1.46 billion stolen from Bybit in 2025, while TRM Labs put the figure at approximately US$6.36 billion across 10 blockchain networks. The worldwide containment effort described in the caption is also documented. Binance said it had froze around $3 billion in assets and pledged to cover all user losses, and stablecoin issuers acted: Tether and Circle froze at least $2.316 billion in stablecoins linked to the reported activity, comprising $1.567 billion in USDT and $823 million in USDC. Attribution came from law enforcement two days after the attack. The FBI said Saturday that the agency, along with the U.S. Secret Service and the IRS, has observed North Korean malicious cyber activity as "TraderTraitor." Subsequent developments, after the post was published: Binance said it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets, and planned to resume withdrawals, with the first withdrawal phase covering 15 blockchain networks.
Complete reasoning
The reply is formatted for pasting into the thread where the claim is circulating.
Ask this case
Answers come only from the case file above; nothing is added.
Is it true that hackers stole more than $6 billion from Binance?
Yes. Binance confirmed the breach itself and estimated the impact at about $6.3 billion. Independent analytics firms TRM Labs and Elliptic put the figure slightly higher, at about $6.36 billion and $6.43 billion, so the claim is accurate and if anything conservative.
Were these personal crypto wallets that got drained?
No. The money came from Binance's own exchange-controlled hot wallets, not from individual customers' self-custody wallets. The caption's use of the word 'wallets' without this detail could leave readers with the wrong impression, though it does not make the claim false.
How many blockchains were actually affected?
The post says 'at least four,' which is a conservative floor. On-chain investigations identified nine to ten affected blockchains, including Ethereum, Bitcoin, Tron, Solana, and others.
Who was behind the attack?
The FBI, along with the U.S. Secret Service and IRS, publicly attributed the theft on October 31, 2026 to a North Korea-linked group known as TraderTraitor. This is a law enforcement assessment made shortly after the attack and has not been tested in court.
Did users end up losing $6 billion permanently?
Not necessarily. By October 31, Binance said it had restored backing for about 90% of the affected assets and planned to resume withdrawals. The $6 billion figure describes what was taken during the attack, not a standing loss to users afterward.