Changpeng Zhao posted on X at 17:07 UTC on Nov. 2, 20261. Binance's founder said his company paid for its own hack. Three things stayed out of the payout: a loan, an asset sale, a funding round. CZ called the method a balance sheet. His post skipped the word cash entirely. Binance's Oct. 29 hack cost $6.3 billion, the largest crypto theft on record3. CZ's post settled one question that week. Two more stories from the same day raised harder ones. A second exchange took a smaller hit, and a viral crash claim beat the market's real numbers.
The Balance Sheet Behind CZ's Claim
Changpeng Zhao's post ran longer than his usual line. “Binance did not borrow money, Binance did not sell assets, Binance did not raise money. Binance covered from its balance sheet. This differs from other incidents that people keep wanting to compare to,” he wrote1. The quote keeps his own banned words, exactly as he typed them. A balance sheet is a company's own cash, holdings and reserves. Debt, a stock sale and a funding round each hand a claim to someone else instead. CZ's post ruled out all three.
A second post that hour filled in the math. “Binance has allocated 100% of the funds, it's just 5% remaining to convert to some of the small coins taking time,” CZ wrote2. CNBC had already reported, two days earlier, that Binance put its coverage at 90%4. The money came from its user protection fund, a slice of its futures insurance fund, and its own corporate treasury. Each of those three pools sits inside the company already. CZ's Nov. 2 claim lines up with Binance's Oct. 31 math.
Blockchain trackers paint a messier picture underneath that math. TRM Labs said 40% of the stolen funds froze within an hour of the theft, about $2.4 billion6. Ari Redbord of the firm told Bankless that figure on Oct. 30. Elliptic counted a different slice on Nov. 27. It found $3.24 billion still sitting in wallets tied to the theft, spread across 12,000 addresses on 11 blockchains. The thief had already run 28 bitcoin through 18 mixing transactions by then, Elliptic found.
Six Dated Steps Run From Binance's Oct. 29 Hack to CZ's Nov. 2 Balance-Sheet Claim
Dated steps in Binance's hack, its recovery and CZ's Nov. 2, 2026 post, in order
Sources: X [1]; CNBC [3]; CNBC [4]; TokenPost [6]; X [9]; Techloy [17].
Read the chart as a table
| Date | Event |
|---|---|
| Oct. 29, 2026 | Binance loses $6.3B. Binance's hot wallet is drained of $6.3 billion in client assets |
| Oct. 30, 2026 | 40% of funds frozen. TRM Labs says 40% of the stolen funds froze within an hour |
| Oct. 31, 2026 | Binance covers 90%. Binance says it has covered 90% of the losses |
| Nov. 1, 2026 | Net outflows hit $3.64B. Withdrawals reopen; $3.64 billion leaves in 9.5 hours |
| Nov. 2, 2026 | CZ cites balance sheet. CZ says Binance covered the hack from its balance sheet |
| Nov. 2, 2026 | Mercado Bitcoin breach. Mercado Bitcoin pauses withdrawals after a separate breach |
The theft began in a hot wallet, one connected to the internet for speed. An attacker used a feature called EIP-7702 to turn that wallet into a tool it controlled, TRM Labs found5. The attacker had 50 signed authorizations ready in advance. A cold wallet, kept offline, resists that exact trick.
TRM Labs Found $2.4B Frozen Oct. 30; Elliptic Found $3.24B Still Loose Nov. 2
Stolen Binance funds, frozen or still untraced, by tracker and date, in billions of dollars
- Untraced, Nov. 2: $3.24B
- Frozen, Oct. 30: $2.4B
Sources: TokenPost [6]; crypto.news [7].
Read the chart as a table
| Item | Value |
|---|---|
| Frozen, Oct. 30 | $2.4B |
| Untraced, Nov. 2 | $3.24B |
Both sides, in their own words
Does a founder's word on X settle a bill that size?
“Binance did not borrow money, Binance did not sell assets, Binance did not raise money. Binance covered from its balance sheet. This differs from other incidents that people keep wanting to compare to”
“Binance making users whole would help, but reimbursement alone does not answer the security questions”
A Second Exchange, A Smaller Breach
Mercado Bitcoin, Brazil's biggest crypto exchange, posted its own statement at 12:56 UTC on Nov. 29. The company said it caught and contained a security incident inside one of its systems early that morning. Client funds stayed safe and its data stayed private, the statement said. Deposits and withdrawals paused as a precaution while the company traced the money and worked with investigators.
The numbers behind that statement run small beside Binance's. Arkham flagged about $46.3 million in suspicious transfers, spread across ten blockchains, The Block reported10. Emmett Gallic, an Arkham analyst, said the attacker swept older deposit addresses and sold memecoins and other small tokens for bigger, harder-to-trace ones. Tether's chief executive moved within hours of the smaller breach too. "Tether froze more than 4.5M USDT related to this security incident," Paolo Ardoino wrote on X at 15:06 UTC11.
That freeze reads as a rounding error beside Tether's earlier move. The company froze more than $1.567 billion tied to the Binance hack on Oct. 29, a separate case three days before8. Two breaches, two exchanges, three days apart, sit at very different scales.
The Numbers Behind the Crash Claim
A different claim went viral that same evening. Crypto Rover posted at 18:03 UTC, carrying a chart image, reproduced here exactly as written: “INSANE CRASH. $700 Billion has been wipeout from US stock market in the last 2.5 hours as Iran says we'll strike US bases if US strikes again”12.
Crypto Rover@cryptorover🚨INSANE CRASH
$700 Billion has been wipeout from US stock market in the last 2.5 hours as Iran says we'll strike US bases if US strikes again. pic.twitter.com/BI22Dd99W9
Real numbers told a calmer story. The Dow Jones Industrial Average gained 0.4% that day, closing at 51,983.98, Yahoo Finance reported13. Over that same session, the S&P 500 fell 0.5% and the Nasdaq Composite fell about 1%. Bitcoin slipped 1.65% to $76,731.23.
Oil told the opposite story from Crypto Rover's post. Crude fell toward $104 a barrel, Yahoo Finance reported13. Reports of a diplomatic deal between the United States and Iran drove the drop, rather than a fresh strike. The Times had reported hours earlier that Iran could hit American bases in Europe14. President Trump would need to order fresh strikes first, a story APA carried the same day. Falling oil, on a de-escalation report, reads as the opposite signal from a market in panic.
A one percent slide in one index still moves real money. That slide sits far short of an "insane crash" that erases $700 billion in under three hours. One major index gained ground that day. The other two posted ordinary, single-digit moves.
Who Gets to Call It Covered
Binance's own account asks for trust more than proof. Joni Zhuleku, co-founder and chief research officer at Altcoin Pro, drew the line plainly. “Binance making users whole would help, but reimbursement alone does not answer the security questions,” Zhuleku said15. His point skips the dollar math. It aims at the hole in Binance's wallet that let the theft happen at all.
Binance built one answer to that gap. The exchange ran a zero-knowledge proof of reserves for ten tokens, with a snapshot taken at midnight UTC on Oct. 3116. Any user can download the verifier's open-source code and check their own balance against it. Independent audits have already checked that code, even though Binance's own system still takes the snapshot.
Zhuleku's test and CZ's math answer different questions. One grades the vault. The other grades the bill. A reader with money on Binance needs both answers, together.
By the numbers
- Binance's Oct. 29 hack cost $6.3 billion in client assets, by its own count3.
- TRM Labs found 40% of the stolen funds frozen within about an hour, Oct. 306.
- Elliptic traced $3.24 billion still sitting in theft-linked wallets, as of Nov. 27.
- Binance's net outflows hit $3.64 billion in the 9.5 hours after withdrawals reopened on Nov. 117.
- Arkham flagged $46.3 million in Mercado Bitcoin's separate Nov. 2 breach10.
- Tether froze more than $1.567 billion tied to the Binance hack, far above its $4.5 million Mercado Bitcoin freeze811.
- The Dow gained 0.4% on Nov. 2, the day a viral post claimed a $700 billion crash13.
What to watch
Watch whether Elliptic's $3.24 billion figure shrinks in the weeks ahead, a sign law enforcement is closing in. Binance's own recovery count should reach 100% once its last small coins finish converting, by CZ's own math2. Mercado Bitcoin's promised updates will show whether its $46.3 million estimate holds steady. A reserve audit run by an outside firm would answer Zhuleku's question directly.
Sources
- Changpeng Zhao, "A little something that's not mentioned, and ppl may not even think about...," post on X, Nov. 2, 2026, https://x.com/cz_binance/status/2117302637574144147
- Changpeng Zhao, "Binance has allocated 100% of the funds, it's just 5% remaining to convert...," post on X, Nov. 2, 2026, https://x.com/cz_binance/status/2117300264738889901
- Jenny Lee, Liz Napolitano and Davis Giangiulio, "Binance hack: $6.3 billion impacted in record crypto theft," CNBC, Oct. 29, 2026, https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html
- Michael Wayland, "Binance hack: asset coverage and withdrawals," CNBC, Oct. 31, 2026, https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html
- TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," TRM Labs, Oct. 30, 2026, https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Riza Dagoc, "TRM Labs says 40% of Binance hack funds frozen; further recovery hinges on tracing and legal action," TokenPost, Oct. 30, 2026, https://www.tokenpost.com/news/insights/45268
- Lawrence Mondal, "Binance hacker mixes $2.2m in Bitcoin as $3.24b remains tracked," crypto.news, Nov. 2, 2026, https://crypto.news/binance-hacker-bitcoin-coinjoin-stolen-funds/
- AmbCrypto, "Binance Investigates Security Reports as Tether Says It Froze Over $1.567B USDT," AmbCrypto, Oct. 29, 2026, https://ambcrypto.com/binance-investigates-security-reports-as-tether-says-it-froze-over-1-567b-usdt/
- Mercado Bitcoin, "Comunicado oficial (security incident statement)," post on X, Nov. 2, 2026, https://x.com/MercadoBitcoin/status/2117239507263132056
- Jason Shubnell, "Mercado Bitcoin, Brazil's largest crypto exchange, hit by $46 million security breach," The Block, Nov. 2, 2026, https://www.theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333
- Paolo Ardoino, "Tether froze more than 4.5M USDT related to this security incident.," post on X, Nov. 2, 2026, https://x.com/paoloardoino/status/2117272224814219720
- Crypto Rover, "INSANE CRASH...," post on X, Nov. 2, 2026, https://x.com/cryptorover/status/2117316737528111584
- Grace O'Donnell, "Stock market today: S&P 500 and Nasdaq extend tech sell-off, Dow gains as oil prices plunge," Yahoo Finance, Nov. 2, 2026, https://finance.yahoo.com/markets/live/stock-market-today-monday-november-2-dow-sp-500-nasdaq-091835095.html
- APA, "Iran threatens US bases in Europe if Trump orders new strikes," APA, Nov. 2, 2026, https://en.apa.az/europe/iran-threatens-us-bases-in-europe-if-trump-orders-new-strikes-533615
- Selva Ozelli, "Binance hack: 'Reimbursement alone' is not enough, says Joni Zhuleku," crypto.news, Nov. 2, 2026, https://crypto.news/binance-hack-reimbursement-alone-is-not-enough-says-joni-zhuleku/
- Rony Roy, "Binance completes reserve proof for 10 tokens after $6.3B hack," crypto.news, Nov. 2, 2026, https://crypto.news/binance-completes-reserve-proof-for-10-tokens-after-6-3b-hack/
- Ogbonda Chivumnovu, "Binance Hack Explained: TraderTraitor, $3.64B Net Outflows," Techloy, Nov. 2, 2026, https://www.techloy.com/binance-hack-3-64-billion-outflows/