Binance hack: about $6.3B taken, withdrawals paused

SECURITY ALERT

UPDATED 20:48 UTC, 30 Oct: In a second incident update published at 19:33 UTC and signed by its two co-chief executives, Binance said its tech team “targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks”, in phases. Counted from the post, that points to around 05:30 UTC on Sunday, 1 Nov. Withdrawals had not resumed as of 20:48 UTC. (Binance update, Binance on X)

Binance said it has set aside more than $6.34 billion, including $5 billion in the exact tokens that were taken, which covers “approximately 80%” of the loss, and is buying the remaining 20% through market and OTC channels. It plans an initial proof-of-reserves snapshot within 12 hours of the update, with results ready by Monday, 2 Nov. About $3 billion has been frozen on-chain, the exchange said.

The update said the investigation has “uncovered additional points of breach” beyond the laptop first suspected, but found no evidence that wallet private keys were leaked. Binance expects to share further technical findings “within about 48 hours” and will publish a post-mortem report.

The FBI said it is aware of the incident and working with partners, Reuters reported via Decrypt, and a person familiar with the matter said Binance is also working with the US Secret Service, which did not comment. Circle chief executive Jeremy Allaire said Circle has frozen more than $800 million in USDC tied to the incident, and Tether chief executive Paolo Ardoino said on 29 Oct that Tether had frozen more than 1.567 billion USDT. (Decrypt)

UPDATED 14:52 UTC, 30 Oct: Binance co-chief executive Richard Teng said in a video at 14:32 UTC that the exchange is “very hopeful” users will be able to withdraw before its Sunday deadline, “which is on track to be within 40 hours”. He said the withdrawal service is being rebuilt and will not be switched back on until it passes testing, and that a full proof-of-reserves report will be shared by Monday, with an initial view hoped for before then. Withdrawals had not resumed as of 14:52 UTC. (Teng on X)

Teng said the attack “was not carried out by one person”, that the attacker used “a self-destruct mechanism that destroyed tooling and traces”, and that the EIP-7702 delegation over the hot wallet “did not pass through our normal approval controls”. He repeated that only Binance’s own hot wallet was affected and that most customer assets sit in cold wallets. Earlier, at 10:55 UTC, Binance said it has reserved more than $6.34 billion of company funds to cover the loss, $5 billion of it already held in the affected tokens, and is buying the rest through market and OTC channels, which “can take longer because some tokens may have low liquidity”. (Binance on X)

Blockchain analytics firm TRM Labs has attributed the theft “with high confidence” to TraderTraitor, the North Korean group the FBI blamed for the $1.5 billion Bybit hack, and Chainalysis has also named the group, Decrypt reported. TRM puts the theft at about $6.36 billion across 10 blockchains; Chainalysis puts it at about $6.4 billion. North Korea has previously denied hacking allegations, and Binance itself has not attributed the attack. Cointelegraph, citing a source, reported that Binance is working with the FBI; Binance has not named the agencies involved. (Decrypt, Cointelegraph)

UPDATED 10:53 UTC, 30 Oct: Binance now says the laptop was not the whole story. In an investigation update at 08:47 UTC, the exchange said later work had “uncovered additional points of breach” in what it called “a complex attack”. It said outflows stopped when withdrawals were paused, that about $3 billion has been frozen so far, and that it is still on track to resume withdrawals “in 45 hours”. Withdrawals had not resumed and no updated proof of reserves had been published as of 10:53 UTC. (Binance on X)

Co-chief executive Richard Teng said at 07:37 UTC that this was not a single “one-click” action, that the investigation “has not attributed responsibility to any individual”, and that Binance has found no evidence of a wallet private key leak. He said a technical post-mortem and an updated Proof of Reserves will follow once the investigation and remediation are complete. (Teng on X)

Blockchain analytics firm Chainalysis said it has “a high degree of confidence” that North Korea is responsible, citing funds from last month’s Bitget exploit mixing with funds taken from Binance. Binance has not attributed the attack. Chainalysis later said it was seeing “never-seen-before laundering patterns”, with thousands of transactions in a short period. (Chainalysis, follow-up)

One laptop.

Six billion dollars.

Binance says attackers compromised one of its engineers’ laptops, reached an internal service and pushed unauthorised withdrawals out of its wallets on Thursday night, 29 Oct 2026, with an estimated impact of about $6.3 billion, according to the exchange’s preliminary findings and announcement.

That would be the largest crypto theft on record, about four times the roughly $1.5 billion taken from Bybit in February 2025.

Binance says it will cover all losses from its emergency fund and company money.

Withdrawals are still paused.

The timeline

At 20:21 UTC, an address funded through the mixer Tornado Cash installed a delegation on a Binance hot wallet, using an Ethereum feature called EIP-7702, according to Etherscan records cited by Decrypt. A hot wallet is an internet-connected wallet an exchange uses to pay out withdrawals.

At 20:24 UTC, the same wallet sent 167,464 ETH and 63 token transfers, including 1.615 billion USDT, to a brand-new address, Decrypt reported.

At 21:04 UTC, Circle froze 823 million USDC in that receiving wallet, according to Decrypt. Tether froze 975.1 million USDT there too.

Later that evening, Binance said it was “actively investigating” and had “not confirmed any impact to user funds”.

At 00:14 UTC on Friday, the on-chain investigator ZachXBT posted that Arbitrum’s Security Council had frozen about $30.5 million.

At 01:19 UTC, Coinbase chief executive Brian Armstrong said Coinbase was blocking sends to the compromised wallets.

At 01:36 UTC, Binance said it would cover all losses and that deposits and withdrawals were suspended.

At 02:25 UTC, it put the impact at about $6.3 billion.

At 04:36 UTC, it said deposits were back to normal and that it expects withdrawals to start resuming within 48 hours, after what it called a security overhaul.

So how does a laptop sign for $6 billion?

How it happened

Binance’s answer, so far, is short.

Its preliminary investigation points to a compromised DevOps engineer’s laptop. From there, an attacker may have reached a service container and submitted withdrawal transactions that Binance did not authorise, the exchange said.

It says it has found no evidence that a wallet private key leaked, and that the investigation is continuing.

The security firm Blockaid read the chain differently, but not in conflict. It said the attacker bundled 50 EIP-7702 authorisations into one transaction aimed at a Binance wallet, and that one of them matched the nonce the account required, Cointelegraph reported. The wallet was then delegated to an unverified contract that let an operator sweep its tokens and ether.

Put another way, the vault was not cracked. The thing that tells the vault to open was.

Blockaid chief executive Ido Ben-Natan told Cointelegraph the pattern looked “very, very similar” to the Bybit attack, and that it resembled operations linked to North Korea. He stressed that attribution was unconfirmed.

Binance has not identified the attackers. It says it is working with law enforcement.

If no key leaked, who else had the power to approve that delegation?

Follow the funds

The totals do not agree yet. Treat each one as an estimate.

Count	Figure	Source
Binance’s estimated impact	about $6.3 billion	Binance, 02:25 UTC
Arkham’s tally	$6.01 billion, $2.9 billion still movable	The Defiant
Early on-chain tally	$5.57 billion across Ethereum, Bitcoin and Tron	Decrypt
Frozen on-chain	about $3 billion	Binance

Binance says about $3 billion has been frozen with help from blockchain partners.

The issuers did much of that.

Tether chief executive Paolo Ardoino said the company froze more than 1.567 billion USDT, The Defiant reported. “In coordination with law enforcement, we have frozen more than 800M USDC,” Circle chief executive Jeremy Allaire posted, according to Decrypt. Binance co-chief executive Yi He thanked Ripple for freezing about $200 million in RLUSD, Decrypt reported.

What the issuers can freeze, the attacker is trying to swap.

Wallets tied to the theft traded stablecoins for ether on Uniswap and borrowed ether on Aave against USDT, according to Etherscan records reviewed by Decrypt. Aave then froze its V3 markets on Ethereum mainnet. Kamino paused borrowing in one Solana market as a precaution.

About $911 million has been swapped into ETH and TRX, Arkham data show, according to The Defiant.

Ether has no issuer. Nobody can freeze it.

The drained wallet matters for customers too. It was one of the addresses Binance lists in its proof of reserves, CoinDesk reported, and the ether that left it was roughly 5.6% of the exchange’s reported ether reserves, by CoinDesk’s count. Binance says it will publish an updated proof of reserves once the fix is done.

How much of the $2.9 billion will still be movable by Monday?

Protect yourself

If you hold funds on Binance, check balances only through the official app or website. Binance says user funds are covered; nothing you do now speeds up a withdrawal.
Ignore anyone offering to “recover” or “unlock” Binance funds in direct messages, or links to “claim” a refund. Real updates come from Binance’s own channels.
Turn on withdrawal-address allowlisting and an anti-phishing code in your exchange account settings if you have not already.
If you use DeFi lending markets that paused overnight, check open positions and health factors before markets reopen.

Binance has had a busy month: this week it also applied for a Brazilian licence, with Brazil’s deadline falling today. Hours before the drain, Polymarket halted trading over a different kind of breach, a compromised third-party script. For why signing power is the prize, see what a private key can do, and for how stablecoin freezes work in practice, see a legal fight over a USDT freeze.

The largest exchange in crypto kept its keys.

It lost control of what used them.

Corrections and new evidence: [email protected]

This article is for information only and is not investment advice.