In its 3 November preliminary report, Binance said an attacker used its internal signing service to move assets outside the usual withdrawal process on 29 October. Binance valued the affected assets at about $6.34 billion and reported around $2.85 billion frozen or intercepted. It committed to bearing the loss.
Event / source publication date: 3 November 2026The following is Human Fintech’s analysis
Where the audit trail splits.
Consider a treasury team reconciling a withdrawal. The blockchain supplies a time, an amount and a destination. The exchange ledger supplies the customer instruction. A valid signature connects the movement to a wallet, but only a comparison with an independently recorded instruction can connect it to the intended business purpose. The most revealing exception may be a perfectly valid transfer with no matching order.
This changes what to ask of a custody provider after an incident. Which system set the destination? Could the same operator change that record and release the funds? An explanation of who held the private key covers only one part of the transaction.
Recovery has several clocks.
A token issuer might restrict movement at a receiving address while investigators establish who can claim the assets. Meanwhile an exchange can use its own inventory to restore balances. A business awaiting a withdrawal needs a third piece of evidence, the availability of the particular token and network its counterparty accepts.
For a settlement due this afternoon, the relevant records are a dated reserve snapshot, the withdrawal notice for that network and the eventual transaction receipt. Each supports a different decision. Treating their timestamps separately makes it possible to explain a delayed payment even when the exchange account already shows sufficient funds.
White Fintech.
Part VII of White Fintech covers payment businesses, including company structure, risks, compliance and economics. Explore the contents and the free sample.
Complete English edition, PDF + EPUB. Read the first 30 pages free, with no sign-up.