EL7.AI
CryptoMedium•31 October 2026•
5 min read

Binance breach leaves $6.3 billion impact and $3 billion in assets frozen

Key Facts

1Binance estimated the incident’s total impact at about $6.3 billion and said about $3 billion in affected assets had been frozen on-chain.
2TRM Labs said about $6.36 billion was transferred from Binance wallets across 10 blockchains, mostly over about 20 minutes starting at 20:05 UTC on October 29, 2026.
3Binance said it allocated more than $6.34 billion to cover the impact, including $5 billion in the affected assets themselves, covering about 80% of its value.
4Binance is targeting a gradual resumption of withdrawals within about 34 hours, subject to completion of security checks.
5Bitcoin hit a six-week low of $76,368 and ether a two-month low of $2,178 on October 30, 2026.

Binance estimated the total impact of the breach of its hot wallet at about $6.3 billion, and said its partners had helped freeze affected assets worth nearly $3 billion on-chain as of its update on October 30, 2026. TRM Labs, for its part, estimated that the attacker transferred about $6.36 billion from Binance wallets, a figure describing the value of transfers according to the research firm’s estimate, not an independent estimate of the exchange’s losses. Binance said users’ funds were safe and it would cover the losses from its SAFU fund and company funds. The scale of the incident puts the exchange’s response and its ability to cover the impact at the center of developments, after it prompted a temporary suspension of withdrawals and efforts to trace the funds. It also prompted calls from industry officials to share information and coordinate responses among exchanges when breaches occur.

In a subsequent update, Binance said it had allocated more than $6.34 billion in company funds to cover the impact, including $5 billion held in the same affected tokens. The exchange estimated that its allocation covered about 80% of the impact’s value and said it was buying the remaining assets through markets and over-the-counter channels. In another update, it said it had internally allocated about $6.34 billion in company funds to cover losses, consistent with its announcement of the funds set aside, though the wording on coverage differed between updates. It said deposits and other unaffected services continued to operate while withdrawals were suspended. It also pledged to publish a proof-of-reserves update after remediation was complete, followed by a detailed technical review once the investigation was over and the facts had been verified.

On the initial account of the breach, Binance said the incident may have begun with the compromise of a laptop belonging to an engineer on the DevOps team, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The company said it had found no evidence that private wallet keys had been leaked. But its subsequent investigation uncovered additional points of compromise after the initial suspicion of the laptop, according to its update, and the investigation is still aimed at establishing the sequence of the attack and appropriate preventive measures. Binance said the hot wallet was targeted at about 04:05 on October 30, 2026, UTC+8, and the attack resulted in the loss of tokens valued at about $6.3 billion. The available updates did not provide a final breakdown of those additional points or how they were connected to the unauthorized withdrawal path.

TRM Labs estimated that the transfers involved ten blockchains, with most taking place over about 20 minutes starting at 20:05 UTC on October 29, 2026. The firm said it attributed the attack with a high degree of confidence to TraderTraitor, a group linked to North Korea, based on on-chain and off-chain information. Binance did not make a similar attribution in its published investigation details. After the incident, Binance temporarily suspended deposits and withdrawals while it completed security checks, and invalidated the affected address. It also said it had engaged law enforcement and blockchain analytics partners to trace the funds and work to recover them. The exchange is targeting the start of a gradual resumption of withdrawals within about 34 hours of its update, subject to completion of security checks.

At the industry level, Coinbase said it had made precautionary adjustments to its systems that store cryptocurrency keys offline, describing them as “out of an abundance of caution only.” Kraken said it was monitoring industry incidents to draw lessons that could be applied to its defenses. OKX Chief Executive Star Xu called for an instant alert system that would allow participants to share information as soon as a breach occurs, coordinate a rapid response and temporarily freeze funds suspected of being stolen. These statements describe precautionary measures and a call for a shared mechanism; they do not establish that broad withdrawal restrictions were imposed by competing exchanges. Binance is working with the FBI and the U.S. Secret Service, according to Reuters; the FBI said it was engaging with public- and private-sector partners to assess the activity’s scope and impact and coordinate investigative steps. Abu Dhabi’s Financial Services Regulatory Authority, which issued Binance’s main operating license, also said it was closely monitoring the incident and in contact with the company.

The news came amid a decline in cryptocurrency prices. Reuters reported that bitcoin fell more than 4% on Thursday, October 29, while ether declined more than 5%, before both recovered some losses on Friday. On October 30, bitcoin hit a six-week low of $76,368, while ether fell more than 3% to a two-month low of $2,178. BNB fell about 6.4% over 24 hours to $696 before markets stabilized. Reuters said Coinbase, Strategy and Robinhood shares fell as cryptocurrency prices dropped in the wake of the breach. Published information does not include a separate measurement of the incident’s contribution to moves in prices or shares.

The incident comes amid a series of thefts in the sector; Reuters, citing researchers at TRM Labs, said attackers stole $2.9 billion worth of cryptocurrency in about 150 attacks during 2025. Binance had 335 million registered users globally and about $162.8 billion in assets under custody, according to its 2025 annual report, illustrating the size of its customer base and the assets associated with the exchange. Binance said deposits and other unaffected services continued to operate, while the resumption of withdrawals depended on completion of security checks. After the investigation concludes and the facts are verified, the company said it would publish a detailed technical review, alongside a proof-of-reserves update after remediation is complete. Its update did not specify a calendar date for publication of the technical review.