Binance hack costs about $6.3 billion, temporarily suspending withdrawals
Key Facts
Binance estimated the total impact of a security incident targeting its wallets at about $6.3 billion, according to the exchange, as reported by the Associated Press on October 29, 2026. The company said it had begun recovering assets for users, while temporarily suspending withdrawals and keeping deposits available. The incident came as cryptocurrency prices fell: bitcoin dropped 3.2% on Thursday evening to below $79,000, the news agency reported. Binance said about $3 billion in assets had been frozen on-chain by that point. It also said it would absorb the losses, while the resumption of withdrawals remained contingent on completing remediation and investigation procedures.
In its initial account, Binance said the incident may have begun with the compromise of a laptop belonging to an engineer on the DevOps team. The company said this may have enabled the attacker to access a service container and submit unauthorized withdrawal transactions. It added that it had found no evidence that private wallet keys were leaked, a point that distinguishes the incident from the possibility that those keys were directly compromised. The initial account did not provide a definitive explanation of how the incident occurred or how the investigation proceeded afterward. Binance said it was working to recover affected assets for users. It pledged to cover the losses from its SAFU fund and company funds, and to publish an updated proof of reserves after remediation was complete.
TRM Labs estimated that the attacker transferred about $6.36 billion from Binance wallets across 10 blockchain networks. The company said, as reported by the Associated Press, that most of the funds were moved in about 20 minutes. This estimate differs from the impact figure of about $6.3 billion that the news agency attributed to Binance, as each figure reflects an estimate from its respective source. In an update reported by Reuters, Binance said $2.54 billion in crypto assets had been frozen, and that the figure could rise as cooperation continued with law enforcement agencies, token issuers and blockchain analytics firms. Binance also said it had temporarily frozen the Binance Alpha platform as a precaution during the investigation. These measures indicate that the response to the incident involved tracking and freezing assets, as well as halting activity on the named platform.
Circle said it had frozen more than $800 million in currencies linked to the incident, in coordination with law enforcement agencies, according to the Associated Press. Tether also said it had frozen more than $1.5 billion linked to a possible attack on Binance. Reuters reported that about half of the stolen assets were stablecoins and that issuers later froze those assets. But freezing stablecoins does not, by itself, mean they will be returned to Binance, according to the Reuters report. TRM Labs estimated that about $2.4 billion in stolen bitcoin and ether had become inaccessible to the attackers. The value of frozen assets and that of assets that could not be accessed remain separate indicators in the estimates of the parties tracking the funds.
TRM Labs attributed the attack to the North Korean TraderTraitor group, according to the Associated Press. By comparison, the company said Bybit suffered a loss of $1.5 billion in a hack in February 2025. The Federal Bureau of Investigation attributed the Bybit attack to North Korea and the TraderTraitor group. Reuters also reported that Binance holds a $1 billion bitcoin reserve in its SAFU fund, designated to protect customers in the event of a security breach. Binance announced that it would cover all losses from the fund and company funds. It also said it would publish an updated proof of reserves after remediation was complete, adding that user funds were safe.
Binance temporarily suspended withdrawals and said in a statement reported by the Associated Press on October 30 that they were expected to resume within a day or two. It said deposits were unaffected and that it had begun recovering assets for users. The reported statement did not specify a more precise time for withdrawals to resume beyond that timeframe. The exchange also said it would continue covering the losses from its SAFU fund and its own funds, and would issue an updated proof of reserves after remediation was complete. During the investigation, Reuters reported that trading on Binance Alpha had been temporarily suspended as a precaution. These steps, alongside asset freezes and coordination with law enforcement agencies and token issuers, remain among the measures announced by the exchange and the parties involved following the incident.