Binance Estimates Security Incident Impact at About $6.3 Billion, Says $3 Billion Frozen
Key Facts
Binance estimated the total impact of a security incident at about $6.3 billion and said about $3 billion in assets had been frozen on-chain as of its official update on October 30. The platform pledged to cover all losses from the SAFU fund and company funds, stressing that user funds are safe. The impact estimate differs from the value of frozen assets: the freeze describes what could be prevented from moving, while the first figure represents Binance’s estimate of losses associated with the incident. The update followed initial coverage on the evening of October 29, when the platform said it had not explicitly confirmed any withdrawal of funds, and AP reported at the time that verified frozen funds totaled $2.54 billion. Binance said the figure could rise as it continued to track and freeze additional assets in cooperation with law enforcement, token issuers, blockchain intelligence firms and industry partners.
Binance said its preliminary investigation suggests the incident began with the compromise of a DevOps engineer’s laptop, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The company added that it had found no evidence of wallet keys being exposed, presenting this as a preliminary finding rather than a confirmed final cause. The likely path points to the role of an employee’s device and possible access to an internal service in the incident, according to Binance’s account. The platform did not provide a final detailed tally of assets that left or the amount recovered in its update. It said it would publish a detailed technical review after the investigation was complete and the facts had been verified.
In its operational response, Binance said it temporarily suspended deposits and withdrawals pending completion of security checks and revoked authorization for the affected address. It also engaged law enforcement and blockchain intelligence partners to track the funds and work on recovering them. The platform also temporarily halted trading features related to Binance Alpha, including buying tokens on the platform using a Spot Wallet balance, spot trading through Alpha and other related services. It said these features would return once the issue was resolved. Its announcement did not specify when they would resume or when deposits and withdrawals would be restored, while linking the suspension of the latter to completion of security checks.
Moves by stablecoin issuers were part of early efforts to restrict assets linked to the incident. AP reported on October 29 that Circle had frozen the equivalent of more than $800 million in coordination with law enforcement, and that Tether’s chief executive said his company had frozen the equivalent of more than $1.5 billion. The following day, Binance said the total value of assets frozen on-chain was about $3 billion. These figures are estimates announced at different times by different parties and should not be added together as separate totals; freezing balances linked to certain addresses does not mean all affected assets have been recovered. The company said its cooperation with partners and authorities could enable additional assets to be tracked and frozen.
Binance’s pledge to compensate users puts the SAFU fund at the center of its stated response. The official support page says the fund held crypto assets worth about $1 billion, according to a January 2026 update, and that its value changes with market movements. Binance, according to the same page, retains discretion in determining which losses and claims qualify for compensation. It also states that SAFU payout requests must be submitted through support within 90 days of the eligible loss. Binance confirmed it would cover all losses from the fund and company funds, but did not specify in its update how coverage would be divided between the two sources or when compensation would be completed.
The initial market reaction coincided with the spread of reports about the incident; AP reported that Bitcoin fell 3.2% on the evening of October 29 to below $79,000. In the same coverage, the agency quoted Changpeng Zhao as saying the incident “looks like a Binance hack,” adding that he expected, as a shareholder, user funds to be fully covered. Binance later announced in its official update its commitment to cover the losses, while confirming that user funds were safe. The price movement describes what happened during that period, while AP did not attribute the decline to the incident in that quote alone. Binance said it would publish a proof-of-reserves update after the response was complete.
The next steps announced by the platform include continuing to track and recover funds, completing the technical investigation, and then publishing a detailed review once the facts have been verified. Binance tied publication of a new proof-of-reserves update to completion of the response. It also said frozen assets could increase as coordination with law enforcement, token issuers, blockchain intelligence firms and industry partners continues. Its announcement did not specify a timeline for these findings or for determining the total assets that could be recovered. The estimated impact of about $6.3 billion remains separate from the about $3 billion Binance said it had frozen as of October 30.