Binance Hack Q&A: What Finance Teams Should Check Now
Elliptic has opened a public question-and-answer session on the Binance theft, and the practical message for finance teams is simple: screen your records now and document the result. Around $6.43 billion was stolen on October 29, the largest theft of cryptoassets on record, and any firm whose wallets, counterparties or client flows touch the affected chains has a reason to check. Good crypto accounting software turns that check from a scramble into a repeatable control.
What the Elliptic update actually says
The source is a short post from Elliptic, the blockchain analytics firm, inviting questions about the incident. It is worth being precise about what it contains, because much of the early commentary around large hacks drifts beyond the facts.
The facts in the post
According to Elliptic, roughly $6.43 billion was taken from Binance on October 29. The FBI has attributed the theft to the North Korean group known as TraderTraitor. Elliptic's own investigators say they have traced the stolen funds across more than 12,000 wallets spread over 11 blockchains. The firm describes its research as consistent with the established pattern of large, state-linked exchange thefts, and notes that North Korea-linked groups are among the most prolific crypto thieves.
The post also says that exposure to funds stolen by such groups carries serious sanctions and anti-money-laundering risk. That sentence is the one finance leaders should underline. It is not a statement about Binance's solvency or about any individual customer. It is a statement about what happens to anyone who later receives, holds or processes the proceeds.
The Q&A format and the blocklist
Dr. Tom Robinson, Elliptic's Founder and Chief Scientist, will answer submitted questions on video. Questions were open until the end of Wednesday, November 4, and Elliptic says it will add the video to the page once it is ready. Separately, Elliptic has made a free Binance exploit blocklist available so that the wider crypto community can screen against the attributed addresses immediately. We covered the release in more detail in our note on Elliptic's free Binance exploit blocklist.
The post does not publish the video's contents, specific findings beyond those above, or any figures on recoveries or freezes. We have not added any. Anything the video says should be checked against Elliptic's page once it goes live before it enters a memo or a client communication.
Why a hack on one exchange becomes your accounting problem
It is tempting to treat a theft at a single exchange as a headline risk that belongs to the exchange, its regulators and law enforcement. For accounting and finance teams, that framing is too narrow. Stolen funds do not stay still. The point of tracing them across more than 12,000 wallets and 11 blockchains is that the proceeds are being split, moved and swapped, and every hop is a chance for them to land in an ordinary-looking account.
Sanctions and AML exposure travels with the funds
If the attribution to a North Korea-linked group holds, then receiving proceeds, even indirectly and unknowingly, can create sanctions and AML questions for the recipient. Whether a given receipt becomes a legal problem depends on jurisdiction, on what the firm knew, and on its controls. What does not depend on any of that is the evidentiary position: a firm that can show it screened, when it screened and what it found is in a far stronger place than one that cannot. For related regulatory context, see our piece on the FBI attribution to North Korea and what it means for accounting.
The books and records angle
Accountants are not blockchain investigators, and nobody expects them to be. But the sub-ledger is where wallet addresses, counterparties, transaction hashes and timestamps already live. That makes it the natural place to run a screen and to retain the output. When an auditor, bank or regulator later asks how a firm responded to the Binance incident, the strongest answer is a dated, reviewed record attached to the ledger, not an email thread.
What B2B teams should do this week
The steps below are deliberately practical and do not depend on any detail beyond what Elliptic has published. They apply whether you are an accounting firm supporting crypto-active clients, an internal finance team at a digital asset business, or an auditor planning procedures.
Screen addresses against the blocklist
Export the counterparty and deposit addresses your records hold for the period around and after October 29, and compare them with the attributed addresses in the free blocklist. Include addresses that sit one or two hops away where your data allows it, because laundering rarely sends funds straight to the destination. If your crypto accounting software supports address tagging and bulk import, load the list as a watch set so that future activity is flagged without a manual rerun. Our guide on how to spot exposure to the Binance hack in your ledgers walks through the mechanics.
Check exchange balances and counterparties
Separate from tainted-fund screening, confirm where your own assets sit. If your firm or a client held balances on the affected exchange, reconcile the on-platform balance to your books and record any restriction, delay or uncertainty in the notes. If you cannot reconcile, say so in writing and record why. This is a reporting-quality issue as much as a risk issue, and it is the sort of thing that reads badly when it is discovered later rather than disclosed now.
Write the file note, even for a nil result
A nil result is still a result. Record the date and time of the screen, the source and version of the list, the scope of addresses checked, who reviewed it and what was concluded. If a match appears, escalate to your money laundering reporting officer or compliance lead immediately and do not move, swap or return the funds on your own initiative. Decisions about reporting, freezing and returning assets belong with compliance and counsel, not with the bookkeeping function.
Accounting and tax implications for firms and CFOs
The Elliptic post does not discuss accounting treatment, so what follows is analysis of how a large, attributed theft typically interacts with financial reporting, not a statement of anything Elliptic or any regulator has said about this case.
Valuation, impairment and disclosure
Firms with balances on an affected platform should consider whether the recoverability of those balances has changed, and what the applicable framework requires them to assess and disclose. The right answer depends on the reporting framework, the legal nature of the claim against the platform and the facts at the reporting date. The discipline that applies in every case is the same: document the judgement, the evidence you relied on and the date. A credible, contemporaneous file is worth more than a precise-looking number with no support.
Subsequent events and going concern
For year-ends that fall close to October 29, finance teams should ask whether the incident is an adjusting or non-adjusting event for them, and whether it bears on liquidity or going concern for any entity with meaningful exposure. Again, this is a question for professional judgement. The useful contribution from the finance function is a clear list of what balances, counterparties and obligations are affected, so that judgement is made on facts.
Tax records and loss claims
Where a business or client believes it has lost assets, the tax treatment of any loss varies widely by jurisdiction and by facts, including whether a loss has been realised, whether recovery is possible and how the asset was held. We do not offer a view on any specific claim here. What we can say is that the evidence supporting any later position, such as acquisition cost, transaction history, platform statements and correspondence, should be preserved now while it is easy to retrieve. Good digital asset accounting software keeps a clean cost-basis and transaction trail that makes any later claim far easier to support.
Building controls that outlast this incident
This will not be the last large theft attributed to a state-linked group. Elliptic itself frames the Binance incident as consistent with a pattern. The sensible response is to make this week's work permanent rather than a one-off exercise.
Make screening a standing control
Move from ad hoc checks to scheduled screening of new counterparties and inbound transfers against current blocklists and attribution data. Crypto bookkeeping software that stores addresses and counterparties in structured fields makes this possible without exporting spreadsheets every time. Pair it with a clear escalation path so a flagged item reaches the right person the same day.
Preserve evidence in a way an auditor can follow
Auditors and regulators respond well to controls that are consistent, dated and reviewed. Keep the list versions you screened against, the outputs, the reviewer sign-offs and any escalations in one place linked to the relevant period. If your team is also thinking about how automated tools fit into this, our note on agentic AI for digital asset risk sets out sensible questions to ask vendors.
Brief clients and boards in plain language
Clients and boards will ask whether they are affected. A short, factual note works better than a long one: what happened according to named primary sources, what you checked, what you found, and what you will do if the picture changes. Avoid speculation about recoveries, attribution beyond what the FBI and Elliptic have said, or the fate of any individual customer's funds. For the wider reading list, our crypto compliance reporting hub collects the related guidance.
What we still do not know
The Elliptic page is an invitation to ask questions, not a full post-mortem. Until the video is published, several things remain unaddressed in the source: how the funds are expected to be recovered or frozen, what the exchange has said to customers, and how regulators outside the United States will respond. Treat any claim on those points as unverified unless it comes from the exchange, a regulator or a law enforcement body directly.
That uncertainty is a reason to build the habit rather than wait for clarity. The screen you run today against the blocklist takes little time. The file note takes less. The value is that both exist, with dates on them, when someone asks.
FAQ
How much was stolen in the Binance hack, according to Elliptic?
Elliptic says around $6.43 billion was stolen from Binance on October 29, describing it as the largest theft of cryptoassets on record. It adds that its investigators traced the funds across more than 12,000 wallets on 11 blockchains.
Who is responsible for the theft?
The FBI has attributed the hack to the North Korean group TraderTraitor, and Elliptic's research attributes the attack to North Korea-linked actors. Finance teams should cite those named sources rather than repeating attribution from unsourced commentary.
What is the free Binance exploit blocklist?
It is a list of attributed addresses that Elliptic has made available at no cost so the crypto community can screen against them. Firms can compare their counterparty and deposit addresses with it and retain the output as evidence of the check.
Can crypto accounting software help with this kind of screening?
It can, to the extent it stores addresses, counterparties and transaction hashes in structured form and supports tagging or bulk import of a watch list. The software does not make the legal judgement, but it makes the screen repeatable and the evidence easy to retain.
What should we do if an address matches the blocklist?
Escalate immediately to your compliance or money laundering reporting officer and legal counsel. Do not move, swap or return the funds yourself. Record the match, the time, the list version and every step taken afterwards.
Source: Elliptic