Binance Confirms $6.3B Hack: $3B Frozen, Withdrawals Suspended

Binance has confirmed what on-chain data had been signaling for hours: a cyberattack on Binance between the evening of October 29 and the early hours of October 30, 2026 generated unauthorized withdrawals with an estimated impact of approximately $6.3 billion. If the figures hold up under investigation, this would be the largest theft in the history of cryptocurrency, more than four times the size of the Bybit hack in February 2025.

Confirmation arrived via an official statement published on October 30 at 02:23 UTC, in which the world's largest exchange by volume declared it had frozen approximately $3 billion on-chain with the help of blockchain partners, temporarily suspended deposits and withdrawals, and committed to covering all losses through the SAFU fund and corporate reserves.

What Binance Said in the October 30 Statement

The statement published by Binance's team is brief and measured. Preliminary investigation suggests the incident may have originated from a compromised laptop belonging to a DevOps engineer, which would have allowed an attacker to access a service container and dispatch unauthorized withdrawal transactions. Binance stated it found no evidence of a private key leak from its wallets and promised a detailed technical post-mortem once all facts are verified.

The estimated total impact stands at approximately $6.3 billion. According to the Security Incident Update published by Binance on October 30, 2026, roughly $3 billion has already been frozen on-chain and an updated Proof of Reserves will be published once remediation is complete. Three immediate measures were listed: temporary suspension of deposits and withdrawals during security checks, revocation of authorization for the implicated address, and engagement of law enforcement and blockchain intelligence partners to trace and recover funds.

Timeline of the Night: From Binance Wallet 14 to the Freeze

The sequence reconstructed by security firms and on-chain investigators began on the evening of October 29, when blockchain analysts noticed abnormal outflows from hot wallets labeled as Binance, particularly those known as Binance 14 and Binance 16. According to forensic analysis by Blockaid, roughly $1.6 billion in USDT, approximately $800 million in USDC, hundreds of millions in ETH, and additional amounts in UNI, LINK, RLUSD, and dozens of minor tokens flowed out of those addresses. Multiple reconstructions indicate that the bulk of the funds moved in approximately twenty minutes, distributed across around ten blockchains.

The exchange's first public signal was a generic post about a possible security anomaly under review. Shortly after, Binance co-founder and shareholder Changpeng Zhao wrote on X that the situation looked like a hack, thanking Tether and Circle for their rapid asset freezes and expressing confidence that all user funds would be covered. In the hours that followed, Binance raised its estimate of frozen funds from $2.54 billion to approximately $3 billion and made its commitment to cover losses official.

How Big Is This: Comparing the Binance Hack to Crypto History

The $6.3 billion figure is Binance's own estimate and has not yet been independently verified. Chainalysis placed the theft at around $5.9 billion, Arkham Intelligence tracked approximately $5.84 billion in assets across wallets labeled as belonging to the attacker, while Blockaid initially identified around $3.3 billion in suspicious transfers spanning Ethereum, Arbitrum, and Avalanche.

Whatever the final tally, the scale exceeds every prior benchmark. The roughly $1.5 billion theft from Bybit in February 2025, which led to Bybit filing a lawsuit against North Korea and the Lazarus Group, had been the all-time record. For more recent context, the Bitget hack on September 24, 2026, later revised to $387.5 million, was considered the largest of the year just one month ago. One proportion deserves attention: according to public data from DefiLlama, Binance held just under $145 billion in client assets before the attack (excluding proprietary tokens like BNB), meaning the declared loss represents just over 4% of that total.

Tether and Circle: The Emergency Brake That Saved Half the Haul

The most significant part of the response came not from Binance but from the stablecoin issuers. Paolo Ardoino, CEO of Tether, stated on X that Tether had frozen more than $1.567 billion in USDT connected to the potential attack. Jeremy Allaire, CEO of Circle, confirmed the freeze of more than $800 million in USDC in coordination with law enforcement.

Together, the two stablecoin issuers froze roughly $2.4 billion within hours, accounting for the largest portion of the $3 billion Binance claims were frozen in total. This is the same mechanism we have documented repeatedly this year: from the freezing of 344 million USDT tied to Iran to the blocking of 72 million USDT following the anomalous Monero pump, and the joint action by Tether and Circle against Iranian exchange Wallex. The centralized issuer blacklists the address, and the tokens become immovable.

The limitations of this mechanism are equally plain. According to reconstructions by Tech-ish, cited by multiple outlets, approximately 700 million USDT had already left the receiving address before Tether’s blacklist took effect, and a significant portion was converted into Ether. The share held in ETH and bitcoin, which by design no issuer can freeze, remains the hardest to recover. One final point: freezing is not the same as returning funds. Getting blocked assets back to their rightful owners typically requires formal legal proceedings, with no standard timeline.

Does the SAFU Fund Cover It? Running the Numbers

Binance stated it will cover all losses through the SAFU fund and corporate reserves, and that user funds are safe. That is a commitment declared by the exchange, not yet an independently verified fact, and the numbers clarify why the official statement explicitly references corporate resources alongside the fund.

The Secure Asset Fund for Users, established in July 2018 and funded by a portion of trading fees, was fully converted into bitcoin in early 2026. The fund’s public wallet holds approximately 15,000 BTC, a value that fluctuated between $1 billion and $1.27 billion depending on bitcoin’s price in recent weeks, per CoinGecko market data. With roughly $3 billion frozen and around $3.3 billion still outside Binance’s control, SAFU alone covers less than one-third of the unrecovered portion and under one-fifth of the total impact. The rest must come from the exchange’s own balance sheet. Binance deployed the same fund after the May 2019 hack, when approximately 7,000 BTC (worth around $40 million at the time) were stolen, but the current scale is an order of magnitude larger. That is precisely why the updated Proof of Reserves promised after remediation is set to be the most scrutinized document of the coming weeks.

Who Is Behind It: North Korea Attribution Remains Preliminary

Binance has not committed to any attribution, saying only that it is working with law enforcement to identify those responsible. Several blockchain analytics firms point toward North Korea. TRM Labs considers involvement by TraderTraitor, an operational unit under the Lazarus Group umbrella, to be probable, and independent investigator ZachXBT described the attacker as likely Lazarus-linked.

A source close to the investigation, speaking to CoinDesk, noted that very few actors globally would be capable of executing an operation of this scale, but also cautioned that attribution is not yet final, observing that North Korean groups typically move and liquidate funds faster than what was seen on the night of October 29. The access vector Binance described closely mirrors the Bybit case, where attackers gained entry through a compromised machine belonging to a third-party developer, and the September Bitget incident, where a compromised backend system allowed transaction data to be falsified. In all three episodes, the weak point was not the cryptographic security of the wallets, but the human and infrastructure chain governing them.

What This Means for Binance Users

On the operational side, co-CEO Yi He stated that Binance expects to restore withdrawals within 48 hours. Subsequent service updates indicate deposits were already functioning normally, with the suspension limited to withdrawals pending a full review of the service and associated addresses.

We cannot confirm that all services had been fully restored at the time of publication. For readers in the EU, one additional clarification applies: as documented in our exchange directory, Binance suspended services for European Union residents from July 1, 2026, having failed to obtain a MiCA license before the deadline. Direct exposure for EU users is therefore currently limited to any residual positions or accounts held through non-EU entities. Market reaction was swift but, according to multiple on-chain analysts, contained relative to the scale of the event: bitcoin fell below $77,000, hitting six-week lows per TradingView data, Ether dropped over 5% to around $2,200, and BNB, the most directly exposed token, shed between 7% and 8% in 24 hours, with over $600 million in long positions liquidated in the first hour alone, per CoinGlass.

On a practical level, the advice echoes what Binance itself published: avoid any links received via private messages, email, or social media promising refunds, verification steps, or incident updates. Check all communications exclusively through the official app or website. The hours after a major hack are prime time for phishing campaigns built around the news cycle. Users with funds on the exchange can track developments via the official announcements page and, once published, the updated Proof of Reserves.

Why This Attack Reshapes the Debate on Centralized Exchanges

The Binance incident caps an autumn already marked by record-breaking breaches, with Bitget forced to reopen withdrawals on a phased schedule after its September attack. The episode shifts the conversation across three distinct dimensions.

The first is technical: a single compromised laptop with access to withdrawal infrastructure is a vector that cold-key architecture alone cannot neutralize. The post-mortems from Bybit, Bitget, and now Binance all converge on that same finding.

The second is systemic: the ability of Tether and Circle to freeze over $2.4 billion in minutes has become the sector’s primary containment tool, but it also confirms how deeply the most widely used crypto assets depend on two centralized issuers, with all the implications that carries for censorship risk.

The third concerns trust: Binance has pledged to cover every loss, but real verification will come through the transparency of its post-mortem report, the updated Proof of Reserves, and how quickly withdrawals return to full operation. We will update this article as official confirmations arrive on all three fronts.