$1.53 Billion in Crypto Positions Liquidated After Binance Hot Wallets Breach
Key Facts
Forced liquidations of cryptocurrency positions reached $1.53 billion over 24 hours through Friday morning in Asia, in a wave that coincided with declines in bitcoin and ether prices after Binance acknowledged a breach of its hot wallets. CoinDesk said long positions, which are bets on rising prices, accounted for 83.8% of the total. Binance said the breach occurred at about 20:05 UTC on October 29 and resulted in the loss of an estimated $6.3 billion in tokenized assets. In its update, the exchange said deposits and other unaffected services continued operating, while withdrawals were temporarily suspended during security reviews. The figures highlight the overlap between selling pressure from leveraged position liquidations and the security incident at the world’s largest cryptocurrency exchange.
Most liquidations were concentrated in the latter half of the period tracked by CoinDesk, reaching about $1.37 billion over 12 hours, including $1.23 billion in long positions. That share shows that positions betting on a rise were most exposed to forced closures as prices fell. CoinDesk said closing long positions typically generates sell orders, which can add to pressure when prices are already low. Liquidations therefore do more than record losses on open positions: the closures themselves can add selling pressure to the market. Long positions accounted for 83.8% of total 24-hour liquidations, according to the same report.
On prices, the Associated Press reported that bitcoin fell 3.2% on Thursday evening to below $79,000. EL7 data showed bitcoin closing at $76,706.01 on October 30, compared with $77,991.89 the previous day. Ether closed at $2,226.50, down from $2,253.13 on October 29. XRP closed at $1.2435, compared with $1.2377 the previous day, meaning it rose between the two recorded daily closes. These daily readings differ from the intraday price moves reported during the sell-off.
Binance said its preliminary investigation indicated that a laptop belonging to an engineer on the DevOps team may have been exploited to access a service container and send unauthorized withdrawal transactions. It added that a subsequent investigation uncovered additional points of compromise, and found no evidence that private wallet keys had been leaked. The agency reported that TRM estimated the value of assets moved from Binance wallets at about $6.36 billion across 10 blockchains, with most transfers completed in about 20 minutes. TRM attributed the attack, with high confidence, to the North Korean TraderTraitor group. The agency quoted Binance co-CEO Richard Teng as saying, "We are working around the clock to address this matter."
Binance said it had allocated more than $6.34 billion in company funds to cover the stolen assets and had begun working to recover assets for users. It added that it had worked with blockchain partners to freeze about $3 billion in affected assets. According to the agency, Tether froze assets linked to the incident worth more than $1.5 billion, while Circle said it had frozen the equivalent of more than $800 million in coordination with law enforcement. The amount Binance said it allocated to cover losses is close to the value of the lost assets it reported, while the frozen sums relate to separate recovery measures. These steps offer ways to contain part of the breach’s impact, alongside the ongoing security review and suspension of withdrawals.
The scale of the incident places the breach in the context of a series of major attacks on exchanges. In February 2025, Bybit suffered a breach that caused $1.5 billion in losses, and the U.S. Federal Bureau of Investigation said North Korea and the TraderTraitor group were responsible. The value of the assets Binance said it lost in the current incident exceeded that figure, and TRM said assets were moved across 10 blockchains in about 20 minutes for most of the amount. The Bybit comparison comes from a previous incident cited by the agency, while estimates of the current breach are based on Binance’s disclosures and TRM’s analysis. Resuming withdrawals and publishing the investigation’s findings remain among the key operational steps expected from the exchange.
Binance said it expects to share additional technical findings within about 48 hours, after they have been verified. It also aims to begin resuming withdrawals within about 34 hours of its update published on October 30, in stages and as security checks are completed. The exchange said it plans to conduct an initial proof-of-reserves snapshot within 12 hours, with the result ready by Monday, November 2, 2026. These timelines remain subject to completion of the checks, according to the exchange’s statement, and withdrawals will resume gradually. Binance said deposits and unaffected services continued operating during the suspension of withdrawals.