Binance says breach affected about $6.3bn, with about $3bn frozen

Centre · 2On Saturday 31 October Binance said it had covered 90% of the stolen amount, partly by deploying its $1 billion SAFU reserve fund and corporate treasury. The remaining 10% is in less liquid tokens that may take longer to source, and Binance said it remained on track to reopen withdrawals on Sunday 1 November. 1 2 Left · 1ABC News (Australia) reported that almost $9 billion had been hacked and that Binance was working to recover $4.2 billion it froze, figures that differ from the $6.3 billion and roughly $3 billion given by Reuters, the BBC and CNA. 3 Right · 1President Donald Trump said he did not know whether North Korea was responsible but that his administration was looking into it, adding that Binance said it had the situation "pretty much under control". 4

Mixed · 2Binance said on Thursday 29 October 2026 that it is aware of reports of a potential security issue and is actively investigating. 5 6 Mixed · 2The reports say billions of dollars in digital assets were moved from Binance wallets; the Daily Mirror put the total at $2.8bn in its text (and $2.7bn in its headline), while BNO News, citing Yahoo Finance and blockchain data, said more than $2 billion left Binance's online wallets for an address created hours earlier. 6 5 Centre · 1Binance's statements differ slightly in the coverage: its spokesperson told HT.com and the Mirror that it has not confirmed any impact to user funds, while its post on X said user funds are completely safe. 7

Centre · 1Binance said its security teams are reviewing information urgently, will update through official channels once information is verified, and warned users to be cautious of scams and not to trust unofficial links, messages or requests for account information. 5 Centre · 1Binance said it had frozen $2.54 billion in crypto assets, that the amount could rise as it worked with law enforcement, token issuers and blockchain intelligence firms to trace more, and that it would resume withdrawals once the issue was fully resolved, according to CNA. 8 Centre · 1Binance spokesperson Ross O'Leary told TechCrunch the exchange had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." 9

Centre · 3Al Jazeera and the BBC reported that Binance suspended all deposits and withdrawals, and that it promised a full post-mortem once the investigation is complete; CNA added that trading on its Binance Alpha platform was also suspended. 10 11 8 Centre · 1Changpeng Zhao, Binance's founder and former CEO, said it appeared the exchange had been hacked and that he expected all user funds to be fully covered. 5 Centre · 3Co-founder Yi He said "Binance will cover all hacking losses", and the BBC reported the firm said it will "cover all losses"; Zhao, who stepped down as CEO in 2023 and is described as a major or majority shareholder, no longer manages the exchange. 8 11 10

Centre · 1Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT related to a potential Binance hack, and Circle CEO Jeremy Allaire said Circle had frozen more than $800 million in USDC in coordination with law enforcement. 5 Centre · 1Binance co-founder Yi He said on X that Ripple had frozen roughly $200 million, according to CNA, and Binance.US, a separate exchange, said it was not affected. 12 Centre · 2In a later statement on Friday, Binance put the estimated total impact at about $6.3 billion, with about $3 billion frozen on-chain so far; France 24 noted it gave no update on the remaining $3.3 billion, and analysts including Chainalysis said it could be the biggest crypto heist on record. 13 14

Mixed · 2Binance said its initial investigation suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorised withdrawal transactions, and that it found no evidence of any wallet private key leak. 13 15 Centre · 1Binance later said on X that its initial investigation had suggested a compromised laptop but that its subsequent investigation "has uncovered additional points of breach", calling it a "complex attack"; it said outflows stopped once withdrawals were paused and that it was on track to resume withdrawals in 45 hours, with deposits unaffected. 16 Centre · 1Binance said it would cover all losses from its SAFU reserve fund and company funds and publish an updated Proof of Reserves after remediation; FinanceFeeds, cited by Hindustan Times, estimated the fund holds about $1 billion in bitcoin, leaving a gap of roughly $2.3 billion. 13

Mixed · 2CNA reported on Friday that Binance said it had reserved more than $6.34 billion in company funds, including $5 billion already held in impacted token assets, with user funds to be verified publicly through proof of reserves; Meduza reported Binance had begun returning assets. 17 18 Centre · 3Binance, which France 24 said has 335 million registered users and about $162.8 billion in assets under custody per its 2025 annual report, said it is working with law enforcement to identify those responsible; the National noted deposits and withdrawals remain suspended. 14 15 19 Centre · 1CNA also reported that World Liberty Financial, a crypto company linked to US President Donald Trump and his family, said it worked with custodian BitGo to freeze stolen funds, with Yi He putting that at $27 million in stablecoins and about $2 million in World Liberty tokens; Coinbase said it was unaffected, and Polymarket's halt earlier that day was an unrelated incident. 8

Centre · 1According to the Yahoo Finance report cited by BNO News, the transfers included ether and USDT, some funds were later moved to another address, and the transfers were initiated by an address funded through Tornado Cash; it was not clear who controlled the receiving addresses. 5 Centre · 1TechCrunch said crypto watchers estimate at least $2 billion was drained from Binance's hot wallets and that some estimates put possible losses at up to $5.7 billion, but the figures are unconfirmed, the theft may be ongoing, and it is unclear who is behind it. 9 Centre · 1Arkham CEO Miguel Morel said data indicated billions appeared to have been hacked by an unknown actor, that the cause was unconfirmed, and that the incident began around 4:30 p.m. EST and appeared ongoing. 8

Mixed · 2NBC News, which said the outflow was first reported by Bloomberg, noted that money held at exchanges such as Binance is not government-insured, leaving any refunds to the exchange's discretion; TechCrunch said that if confirmed in the billions it would rank among the largest crypto thefts, after the record $1.4 billion Bybit theft in 2025. 20 9 Mixed · 3Markets reacted: Al Jazeera reported Bitcoin fell about 5 percent to below $77,000, Deutsche Welle reported a 3.2% fall to below $79,000, and IJR reported nearly $628 million in liquidations in one hour, mostly leveraged bets on rising prices. 10 21 22 Centre · 2France 24 reported Bitcoin hit a six-week low of $76,368, Coinbase shares fell 4.8%, and The National, citing The Block and CoinGlass, reported more than $1.5 billion of leveraged positions liquidated in 24 hours, with prices recovering somewhat later on Friday. 14 19

Left · 1ABC News (Australia) reported up to $6.3 billion (A$8.9 billion) was stolen, quoting experts who said not all of it will necessarily be successfully stolen because stablecoin issuers can freeze funds, and who raised the possible role of AI-assisted hacking. 15 Centre · 2Deutsche Welle noted that Zhao pleaded guilty in 2023 to failing to prevent money laundering, was pardoned by Trump in 2025, and that Zhao and Binance have been key supporters of Trump family crypto ventures; CNA cited TRM Labs figures of $2.9 billion stolen in nearly 150 attacks last year. 21 8 Centre · 1Binance has not yet published a full post-mortem: it says its initial investigation is preliminary and has not itself confirmed who the attackers are, but TRM Labs said on 30 October that it attributes the attack to the North Korean group TraderTraitor "with high confidence" (as reported by Hindustan Times and The National), and an Australian forensics expert named Lazarus Group as a likely focus. 23

Centre · 1In a blog post, TRM said an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes; on Ethereum it used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper with 50 pre-signed authorisations, which TRM said pointed to a compromise of Binance's hot wallet signing infrastructure. 23 Centre · 1TRM said Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins and Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB, about $2.7 billion in total, while the attacker sold USDT to market makers and borrowed ETH against USDT on Aave, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach. 23 Centre · 1TRM said features such as small Tornado Cash withdrawals funding an operator wallet, staging well before the theft and pre-obtained signatures executed in one burst match earlier North Korea-linked heists, including the February 2025 Bybit theft (about $1.5 billion), though the laundering route so far differs from the bridge-heavy pattern after Bybit. 23

Left · 1Metro reported that a second analytics firm, Chainalysis, also said it had "high confidence" the North Korean group was linked to the incident; Binance has not directly confirmed North Korean involvement and said it is working with law enforcement to "confirm the identity of these criminals". 24 Left · 1Wired reported that Elliptic's chief scientist Tom Robinson said North Korea is likely responsible but that Elliptic has not specifically tied it to TraderTraitor; Chainalysis said the strongest evidence was seeing funds stolen from Binance commingle in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors; and neither Binance nor law enforcement has named North Korea. 25 Mixed · 2Breitbart, citing CNN, reported that Chainalysis and Singapore-based Pangolin Intelligence also expressed confidence in the North Korea link, and the BBC said investigators have blamed Lazarus Group, also called TraderTraitor, for nearly all large crypto hacks of the past five years; North Korea has always denied such activity. 26 27

Left · 1Elliptic's Robinson told Wired that about $2.8 billion, around 44 percent of the total, had been frozen, almost all stablecoins, and that the remaining $3.3 billion is mostly bitcoin, ether and XRP which no one can freeze; he did not expect the frozen share to rise much, and said that if North Korea is responsible the theft would almost double everything the regime has stolen in crypto to date. 25 Centre · 1A person familiar with the situation told Reuters, carried by CNA, that Binance is working with law enforcement around the world including the FBI and the US Secret Service; the US embassy in London declined to comment. 28 Centre · 1The US Secret Service said it was "working around the clock" "to identify, freeze, trace, and recover" stolen funds, and Binance said it was also working with the FBI. 27

Centre · 1Co-CEO Richard Teng said "This was not carried out by one person" and that the subsequent investigation "has uncovered additional points of breach", adding that the attackers used a self-destruct mechanism that destroyed tooling and traces; the BBC noted online comparisons with FTX's reassurances before its 2022 collapse. 27 Centre · 1The Financial Services Regulatory Authority in Abu Dhabi said on 30 October it was aware of the incident, engaging closely with Binance and monitoring it. 29 Centre · 1CNA, citing Reuters, reported that co-founder Yi He said Binance does not need to sell its SpaceX shares because its annual revenue is enough to cover the losses; founder Changpeng Zhao had earlier told Elon Musk the platform held "$1.x billion in SpaceX alone". 30

Centre · 1Zhao also publicly asked Elon Musk to stop mocking the hack on X ("bad time to troll"); Zhao's rough calculation was about $3 billion frozen plus over $1 billion in SAFU, leaving a gap of about $2 billion, while Yi He said annual revenue was sufficient to cover losses without selling SpaceX shares. 31 Centre · 1The National quoted analysts saying there is no evidence AI was used in the hack, and that since no keys leaked but Binance's own systems signed the withdrawals, the weakness lay in how assets were held in internet-connected hot wallets rather than in the blockchain itself. 32 Centre · 1A National opinion column by Dubai-based fund specialist Yevgeny Bebnev argued the freezes showed crypto's reliance on stablecoin issuers, noting the attacker borrowed 19,762 wrapped Ether (about $45 million) against $60 million of USDT on Aave minutes before Tether froze the address. 33

Centre · 1GB News reported that North Korea's mission in Geneva and its embassy in China had not yet commented, and that Binance expects to resume withdrawals within 48 hours (Binance later said 45 hours); TRM policy chief Ari Redbord called it "the largest bank heist in human history", and Metro quoted him calling it a "watershed moment" with the attacker still appearing to control a huge amount of the assets. 16 Mixed · 2GB News's text gives the theft as "$4.7billion" and quotes frozen and remaining sums in pounds (£2.2billion and £2.7billion), whereas the Guardian and Metro give $6.3bn (£4.7bn) with about $3bn frozen, so GB News's figures appear to mix currencies. 34 35 Mixed · 2Reuters, carried by the Straits Times, reported Bitcoin fell more than 3% to a six-week low of $76,368, ether to a two-month low of $2,178, BNB 5% and Strategy shares nearly 6%; Gulf News said Binance had revoked the affected address authorisation and would resume deposits and withdrawals after security checks, without a timeframe. 36 37