Binance $6 Billion Hack: All You Need to Know and Where Things Stand Now

TL;DR

• Binance estimates that approximately $6.3 billion in cryptocurrency was affected after attackers allegedly exploited access through a compromised DevOps engineer’s laptop.
• The company is working with Tether, Circle, Ripple, and other blockchain companies to trace and freeze affected assets, while investigations into the attackers continue.
• Binance says customer funds are safe, deposits have resumed, and withdrawals remain temporarily suspended while security improvements are implemented.

Binance is dealing with one of the largest security incidents in cryptocurrency history after an attack resulted in approximately $6.3 billion in estimated losses across its cryptocurrency wallets.

The incident, which came to light on October 29, 2026, prompted the world’s largest cryptocurrency exchange to temporarily suspend withdrawals, launch an investigation, and coordinate with several blockchain companies to freeze affected assets.

While the scale of the incident initially raised concerns about the safety of customer funds, Binance has assured users that their assets remain safe and pledged to cover all losses. Here’s everything known about the incident and the latest developments.

How the Binance Security Breach Happened

Binance’s initial investigation suggests that the incident may have started with a compromised laptop belonging to a DevOps engineer. According to the exchange’s October 30 security announcement, the compromised device potentially gave an attacker access to an internal service container, which was subsequently used to submit unauthorized withdrawal transactions.

Binance emphasized that it had found no evidence of any wallet private key leak. However, the exchange has yet to publish a complete technical explanation of how the attackers obtained the ability to authorize the transactions. The estimated impact stands at approximately $6.3 billion, with affected assets reportedly spread across multiple blockchain networks.

Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.

As an immediate precaution, Binance has:

– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.

Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.

Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.

https://t.co/ywB2mKFy0p

— Binance (@binance) October 30, 2026

Binance CEO Richard Teng Clarifies the Attack

Following Binance’s initial explanation, CEO Richard Teng provided additional clarification about the suspected attack, cautioning against oversimplifying how the breach occurred. Teng explained that the incident was not simply a case of an attacker exploiting one engineer’s permissions or executing a single-click operation.

Instead, the attack involved a more complex process, and Binance’s investigation had not attributed responsibility to any individual. The compromised laptop is currently a suspected entry point, not a complete explanation of the security failure. Teng also indicated that Binance would provide a detailed technical post-mortem after its investigation is complete and all relevant facts have been verified.

I want to speak to you directly about what happened.

Bottom line – your money is safe, and we’re covering every loss.

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.

To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.

So far, we have found no evidence of any wallet private key leak.

We’ll share a detailed technical post-mortem once the investigation is complete and every fact is verified – and publish an updated Proof of Reserves once remediation is complete.

What you need to know:
• Your funds are safe
• Binance will cover all losses from the SAFU fund and company funds
• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
• No evidence of any wallet private key leak
• Deposits are unaffected and operating as normal

What we’ve done:
• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
• Revoked the affected address authorizations
• Engaged law enforcement and blockchain intelligence partners to trace and recover funds

Our team hasn’t stopped. We’re working closely with law enforcement to ensure the matter is handled appropriately – and I’ll share what I can, as soon as I can.

— Richard Teng (@_RichardTeng) October 30, 2026

Approximately $3 Billion in Affected Assets Frozen

One of the most significant developments has been the industry’s response to the stolen funds. Binance confirmed that it had worked with blockchain partners to freeze approximately $3 billion worth of affected assets on-chain.

Several major cryptocurrency companies and stablecoin issuers participated in the response, including Tether, Circle, Ripple and World Liberty Financial. Their involvement highlights how cooperation between centralized exchanges, blockchain networks and stablecoin issuers can help restrict the movement of stolen cryptocurrency.

Nevertheless, approximately $3.3 billion of the estimated impact had not yet been accounted for in Binance’s reported frozen-asset figure. Efforts to trace and recover the remaining funds are ongoing.

Binance Suspends Withdrawals but Promises to Cover All Losses

As an immediate precaution, Binance temporarily suspended deposits and withdrawals while conducting security checks and revoking the affected address authorizations. The exchange subsequently confirmed that deposits were no longer affected and had resumed normal operations.

Withdrawals, however, remained temporarily suspended as Binance worked on strengthening its withdrawal services and related addresses. The company expected withdrawals to resume within 48 hours of its October 30 update.

More importantly, Binance pledged to cover all losses resulting from the incident through its Secure Asset Fund for Users (SAFU) and company resources. This means customers will not be expected to absorb the losses associated with the breach. Binance also promised to publish an updated Proof of Reserves after completing its remediation efforts.

Who Is Responsible for the Binance Hack?

Although Binance has not officially identified the attackers, blockchain intelligence companies TRM Labs and Chainalysis have reportedly attributed the incident to North Korea’s TraderTraitor hacking group. The attribution is based on similarities to previous attacks linked to the group. However, Binance has not independently confirmed who is responsible, and the investigation is ongoing.

Where Things Stand Now

As of October 30, Binance has confirmed an estimated $6.3 billion impact, approximately $3 billion in frozen assets, and its commitment to cover all resulting losses. Deposits have resumed, but withdrawals remain temporarily suspended pending security improvements.

The exchange is also working with law enforcement agencies, blockchain intelligence firms, and industry partners to trace the remaining funds and identify those responsible. Binance has promised a comprehensive technical post-mortem and an updated Proof of Reserves once its investigation and remediation are complete.

For now, the biggest questions are how the attackers managed to execute the unauthorized transactions, how much of the remaining funds can be recovered, and what additional security measures Binance will introduce to prevent another incident of this scale.