Crypto

Binance Puts Its Hack At 6.3 Billion Dollars As 3 Billion Freezes And Withdrawals Stay Paused

By Crypt0 · Oct 30, 2026

Binance now puts the damage from the attack on its hot wallets at about 6.3 billion dollars, and it says it will cover every dollar of it. The figure is the exchange's own estimate, released late on October 29, and it sits above the early tracker tallies that first put the drain near 5.6 billion dollars. About 3 billion dollars in affected assets has already been frozen onchain with help from stablecoin issuers, networks, and law enforcement. Deposits and withdrawals remain suspended while security checks continue, and Binance says they will resume as soon as the issue is fully resolved.

The drain began shortly after 8 in the evening UTC on October 29, when one of Binance's largest Ethereum hot wallets sent 167,464 ETH plus 63 token transfers, including 1.615 billion USDT, to a brand new address. A second wallet followed with 28,005.6 ETH. Onchain tallies from Decrypt count at least 5.57 billion dollars across Ethereum, Bitcoin, and Tron, with 18,270 BTC worth about 1.4 billion dollars and about 630 million dollars on Tron. Arkham data cited by CoinDesk put attacker wallet holdings near 5.7 billion dollars, while Chainalysis estimated about 5.912 billion dollars stolen at the time of the theft. The numbers disagree because they measure different things, from outflows to wallet balances, and none of the early tallies is an official Binance figure.

Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer. The exchange says the attacker used that access to reach a service container and submit unauthorized withdrawal transactions, and it says it has found no evidence of any wallet private key leak. Minutes before the drain, an address funded through the Tornado Cash mixer submitted a wallet delegation under EIP 7702, an Ethereum feature that lets a regular wallet hand control of its actions to smart contract code. How the attacker got the authorization signed in the first place is still unknown, and a detailed technical post mortem is promised once the facts are fully verified. TRM Labs attributed the theft to North Korea's TraderTraitor unit with high confidence, though Binance has not named an attacker.

The freeze race is where the story turns in users' favor. Tether chief executive Paolo Ardoino said the company froze more than 1.567 billion USDT tied to the incident, and Circle froze about 823 million USDC. The Arbitrum Security Council used emergency powers to move 74.56 million ARB from the attacker's wallet into a frozen wallet, and lending markets moved to block borrowing against the stolen coins, according to The Block. Binance's emergency SAFU fund holds about 1 billion dollars in bitcoin, far smaller than the loss, so the coverage pledge reaches beyond that fund into company money. Binance co founder Changpeng Zhao, who no longer runs the exchange, posted that it does look like a hack and that he expects all user funds to be fully covered.

CoinDesk's review of Binance's own reserve data adds the sharpest detail. The wallets emptied in the attack are the same wallets the exchange lists as proof that customer crypto is fully backed. Its October 1 report includes a wallet labeled Binance 14, the wallet at the center of the attack, holding 1.26 billion USDT and 89,475 ETH among 37 assets at the time. Binance held exactly enough ETH to cover customer balances on October 1, so the roughly 204,500 ETH taken leaves ether backing near 94 percent. The next reserve snapshot lands November 1, and it will show whether the exchange has already replaced the missing assets. BNB fell sharply on the news, with market trackers putting the slide at roughly 4 to 7 percent, and bitcoin briefly slipped below 79,000 dollars.

For readers, the practical effect today is the pause. Coins held on Binance cannot move off the exchange on the affected networks until the exchange lifts the suspension, while Binance says balances will be honored and user funds are safe. Binance.US says it is not affected. The deeper lesson is the one this site has carried since 2016. Coins on an exchange sit in someone else's wallet, and your keys, your coins, your life is the only setup with zero counterparty risk. Until Binance publishes its full account of the attack, treat every update that does not come through official Binance channels as suspect, because hacks always bring a second wave of scams dressed as help.

Sources

• CoinDesk, Binance says customer money is safe after huge hack drains key reserve wallets
• CoinDesk, Binance hacker splits 1.4 billion dollars of bitcoin into 19 wallets that no one can freeze
• CNN, World's largest crypto exchange hit by world's largest heist
• Wall Street Journal, Binance suspends transactions after biggest ever cyber heist

New to crypto? Read the crypto glossary, browse frequent questions, read our story, or explore the story archive.