Binance estimates security incident impact at $6.3 billion and freezes $3 billion

Key Facts

Binance estimated the total impact of a security incident at about $6.3 billion and said about $3 billion in related assets had been frozen on-chain, according to a statement published on October 30, 2026. The exchange did not explicitly confirm that funds had been stolen, while the potential damage remained unclear in an AP report published on October 29. TRM, in an analysis cited by AP, estimated that an attacker moved about $6.36 billion from Binance wallets across 10 blockchains. TRM said most of the transfers took place over about 20 minutes, an estimate of movements observed by the firm that does not amount to a Binance declaration of a final loss. The gap between Binance’s impact estimate and TRM’s transfer estimate puts the scale of the incident at the center of what the investigation must clarify.

Binance said its preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop, allowing the attacker to access a service container and send unauthorized withdrawal transactions. It added that it had found no evidence that private wallet keys were leaked. The company’s statement gave no further details about the access route or the amount of funds that had actually left its control. TRM said it attributed the attack, with a high degree of confidence, to TraderTraitor, which it described as a North Korean hacking unit. Chainalysis also said the group was likely behind the attack, while Binance said it was working with law enforcement to identify those responsible and had not announced confirmation of their identities.

Binance said it would cover all losses from its SAFU fund and company funds, and that user funds were safe. It also plans to publish an updated proof of reserves after remediation is complete. In its October 30 update, it said deposits were operating normally, while withdrawals remained suspended as it completed a security fix for its withdrawal service and associated addresses. The company expected withdrawals to resume within 48 hours, according to the same update. This follows the suspension of deposits and withdrawals during initial checks, while the service that enables assets to be taken off the platform remained under review.

Stablecoin issuers also took part in freezing assets linked to the incident. Circle said it had frozen the equivalent of more than $800 million in coordination with law enforcement, while Tether’s chief executive said the company had frozen the equivalent of more than $1.5 billion, according to AP on October 29. Binance reported that about $3 billion had been frozen on-chain as of its October 30 update. These figures reflect what the different parties have reported about frozen assets and do not, by themselves, determine the fate of the rest of the amount identified by analytics firms. Reuters reported on October 30 that Binance had not provided an update on the status of the remaining $3.3 billion of its impact estimate, leaving its recovery and fate among the open questions.

TRM said the volume of transfers could make the incident the largest recorded cryptocurrency theft, if its estimates are confirmed. For comparison, AP reported that Bybit was hacked in February 2025, with losses of about $1.5 billion; Reuters also cited the $610 million Poly Network hack in August 2021 among previous major incidents. Reuters said the Binance incident had revived questions about the security of customer funds and could prompt investors to reassess the risks of owning digital assets. The comparison remains tied to estimates of transfers and impact that have yet to be settled by the investigation’s findings. Binance said it would publish a detailed technical report after the investigation was complete and the facts had been verified.

Bitcoin fell 3.2% to below $79,000 on the evening of Thursday, October 29, according to AP, in a move recorded at that time. The decline also extended to cryptocurrency-related stocks in extended U.S. trading; Coinbase shares fell 4.8% and Strategy shares about 6%, according to Reuters. Tim Sun, a researcher at HashKey, said disruption to deposits and withdrawals could affect market makers’ ability to move capital between exchanges. Geoffrey Kendrick of Standard Chartered said downward pressure on prices could persist until asset freezes were lifted and further details about the hack emerged. The two steps Binance later identified are the expected resumption of withdrawals within 48 hours and publication of the technical report and proof of reserves after remediation is complete.