Binance estimates breach impact at $6.3 billion as crypto liquidations reach $1.53 billion
Key Facts
Binance estimated the security incident’s total impact at about $6.3 billion in an update published on October 30, saying its partners had frozen about $3 billion in affected assets on the blockchain. The update came as the cryptocurrency market recorded forced liquidations of $1.53 billion over 24 hours through Friday morning in Asia, according to CoinDesk, citing CoinGlass. Long positions, which bet on rising prices, accounted for 83.8% of the total. Binance said, "The estimated total impact is about $6.3 billion." The figure reflects the exchange’s estimate of the incident’s impact, while blockchain analytics firm TRM offered a different estimate of the transfers it tracked from Binance wallets.
Binance said its initial investigation indicated that a DevOps engineer’s laptop may have been compromised, giving the attacker access to a service container and allowing unauthorized withdrawal transactions. The company added that it had found no evidence that private wallet keys were leaked. A later investigation, however, uncovered additional points of compromise, according to Associated Press and Reuters reports, without Binance providing details. The company had not identified the attackers in its update. AP cited TRM as saying that the group known as TraderTraitor, which it described as a North Korean hacking unit, was behind the attack; this was TRM’s assessment, not an attribution announced by Binance.
TRM said the attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks, with most of the transfers taking place in about 20 minutes. Blockchain records, according to Reuters, showed that most of the operation began shortly after 20:00 GMT on Thursday, October 29, and took about 20 minutes. This figure differs from Binance’s estimate of $6.3 billion: TRM’s estimate represents the volume of assets it tracked being moved, while Binance described its figure as the estimated total impact of the incident. TRM also estimated that about $2.4 billion in Bitcoin and Ether had become inaccessible to the attackers after issuers froze about half of the stolen assets. Reuters said some of the funds had already been used as collateral to borrow Ether.
Binance pledged to cover all losses using its SAFU fund and company funds, and said user funds were safe. The SAFU fund, according to Binance’s website as reported by Reuters, holds a $1 billion Bitcoin reserve to protect customers in the event of a security breach. The company said it would publish an updated proof of reserves after remediation measures were complete, without specifying a date. AP reported that deposits were unaffected while withdrawals remained suspended, and Binance expected them to resume within a day or two. The agency added that the exchange began restoring assets to users on Friday, while a source familiar with the matter told Reuters that Binance was working with law enforcement agencies around the world, including the FBI and the U.S. Secret Service.
AP said Circle froze more than $800 million in tokens linked to the incident, while Tether froze the equivalent of more than $1.5 billion. These actions are part of efforts to limit the movement of assets that TRM said it tracked across multiple networks. TRM had estimated that cryptocurrency stolen in about 150 incidents over the past year totaled $2.9 billion. The incident also surpassed the Bybit breach recorded in 2025, valued at $1.5 billion and linked by the FBI to hackers from North Korea. Reuters said U.S. analytics firms saw similarities between the attack and previous operations attributed to North Korean hackers, while Binance had not announced the attackers’ identity.
The disruption coincided with a wave of leveraged-position liquidations: Bitcoin positions saw about $499 million in liquidations and Ether positions about $358 million, according to CoinDesk, citing CoinGlass. Binance recorded $754.6 million in liquidations, including $670.6 million from long positions, followed by Hyperliquid with $251.4 million and Bybit with about $186.5 million. Ether fell below $2,200 before trading near $2,240, according to CoinDesk. EL7 data showed Bitcoin’s daily close at $77,754.5 on October 30, compared with $77,991.89 the previous day. A Standard Chartered expert said, "A new base level will become clear only after the assets are released and more details of the breach are known."
In its Friday morning coverage, AP said Bitcoin had approached $77,000 after surpassing $86,000 earlier in the month, while Coinbase Global shares fell 12.5% and Strategy shares dropped 7.5% in the session cited. The global head of digital assets research at Standard Chartered said Binance’s problems could later push investors toward decentralized exchanges. The next operational steps remain tied to the resumption of withdrawals and the completion of asset recovery for users. Binance also said it would publish technical details of the incident after completing its investigation and verifying the facts. The company did not set a date, and tied publication of the updated proof of reserves to the completion of security remediation measures.