EL7.AI
CryptoMediumUpdated×2•Originally published 31 October 2026•Updated 31 October 2026•
4 min read

Binance estimates impact of hot-wallet breach at about $6.3 billion

Key Facts

1Binance estimated the incident’s impact at about $6.3 billion and said about $3 billion had been frozen on-chain.
2TRM estimated transfers at about $6.36 billion across 10 blockchains.
3Binance said it allocated more than $6.34 billion, including $5 billion in affected assets, to cover about 80% of the affected amount.
4TRM estimated that the attacker still held assets worth about $2.4 billion beyond the reach of issuer freezes.
5Binance expected the initial proof-of-reserves snapshot results by November 2, 2026.

Binance estimated the total impact of the breach of its hot wallets at about $6.3 billion and said its partners had helped freeze affected assets worth nearly $3 billion on-chain as of its update on October 30, 2026. The figure measures the platform’s estimate of the impact, while TRM Labs estimated the value moved from Binance wallets at about $6.36 billion; the estimates came from two different parties. Binance said it allocated more than $6.34 billion in company funds to cover the impact. Of that amount, it said $5 billion was held in the same affected tokenized assets, and that the allocation covered about 80% of the affected amount. The platform said user funds were safe and that deposits and other unaffected services continued to operate while withdrawals were suspended.

TRM said the attacker moved about $6.36 billion across 10 blockchains, with most transfers concentrated over about 20 minutes starting at 20:05 UTC on October 29. The company attributed the attack with high confidence to the North Korea-linked TraderTraitor group, based on on-chain and off-chain information. In its technical analysis, TRM said the attacker used an EIP-7702 authorization on the Ethereum network to turn a hot wallet into a withdrawal tool under the attacker’s control. It added that the attack involved 50 pre-signed permissions, which it said pointed to a compromise of the hot-wallet transaction-signing system. Binance said its initial investigation indicated a compromised laptop might have been involved, before a subsequent investigation uncovered additional compromise points. The platform said it found no evidence that private keys had leaked and did not publish final details about the additional compromise points or their connection to the transfer path.

As part of efforts to contain the funds, stablecoin issuers froze about $2.67 billion, while the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, according to TRM. TRM estimated total frozen assets at about $2.7 billion, close to Binance’s estimate of about $3 billion in assets frozen on-chain. The company said the attacker still held more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond the ability of any issuer to freeze. The figures show the differing ability to halt asset movements between currencies that issuers can freeze and other assets over which they have no authority. Binance said it had engaged partners to track and work to freeze affected assets.

Binance temporarily suspended deposits and withdrawals to complete security checks, and said other unaffected services remained available. A HashKey researcher told Reuters that disruptions to deposits or withdrawals could limit market makers’ ability to move capital between trading platforms, raising liquidity concerns. Binance aimed to begin gradually resuming withdrawals within about 34 hours of its update, subject to the completion of security checks. It also said it planned to take an initial proof-of-reserves snapshot 12 hours after the update and expected the results to be ready by Monday, November 2, 2026. It added that it expected to share further technical findings within about 48 hours, after verification and provided that publication would not harm the ongoing investigation.

The response extended to other platforms: Coinbase said it had made precautionary changes to systems that store cryptocurrency keys offline, describing them as “out of an abundance of caution.” Kraken said it was monitoring industry incidents to draw lessons that could be applied to its defenses. The CEO of OKX called for an immediate alert system that would allow participating parties to share information when breaches occur, coordinate a rapid response and potentially freeze funds suspected of being stolen temporarily. Comparing the incident with an earlier one, Binance co-founder Changpeng Zhao said the breach could be the largest in dollar terms, while noting that previous attacks had involved larger Bitcoin balances. The Associated Press reported losses of about $1.5 billion from the February 2025 Bybit platform breach and said the FBI attributed that attack to North Korea and the TraderTraitor group.

Cryptocurrencies fell in the period following the breach. Reuters reported that Bitcoin dropped more than 4% on Thursday, October 29, and Ether fell more than 5%, before both assets recouped some of their losses on Friday. In Asian trading on Friday, October 30, Bitcoin fell more than 3% to a six-week low of $76,368, while Ether declined more than 3% to a two-month low of $2,178. In extended U.S. trading after the breach, Coinbase shares fell 4.8% and Strategy shares about 6%, according to Reuters. The moves came amid a broader decline in the cryptocurrency market, and available sources do not attribute the full downturn to the breach alone.