Binance Reports a $6.3 Billion Security Incident: What Is Known, What Is Disputed and What Users Can Do

This article is based on public reports from 29 and 30 October 2026. The incident is still under investigation and details are changing, so some figures here may already be out of date. Where possible, I name who said what.

On 29 October 2026, Binance reported a security incident that several outlets describe as the largest crypto theft on record. At this stage, most of what is public comes from two kinds of sources: statements from Binance, and analysis of blockchain data by outside firms. The two do not fully agree on how it happened. This article separates what is reported, what is alleged, what is disputed and what is unknown, and ends with practical steps for people who keep funds on exchanges.

What Binance has said

According to reports by Reuters, Al Jazeera, CoinDesk and others:

• Binance called the event a "security incident", suspended deposits and withdrawals, and said user funds are safe.
• It said it will cover all losses. Co-CEO Richard Teng wrote that the company would cover every loss. Reports say the money would come from its SAFU fund and company funds.
• It said its teams are working with law enforcement, token issuers and industry partners to freeze assets.
• It put the impact at about $6.3 billion. Reuters writes that this was stolen. CoinDesk writes that Binance described it as assets "affected". The wording matters, so check the original statement.
• It said about $3 billion had been located and frozen on-chain.
• It said a preliminary investigation suggests the incident may have started with a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit unauthorized withdrawals. It also said it found no evidence of a wallet private key leak "so far". Teng added that it was not a single one-click action and that responsibility has not been attributed to any individual.
• It promised a detailed technical post-mortem and an updated Proof of Reserves after remediation, and said it is revoking affected address authorizations and overhauling its withdrawal service.
• Forbes reports that deposits were operating again while withdrawals stayed paused, with Binance expecting to resume them within 48 hours. That is an expectation, not a confirmed result.

How big was it? The figures differ

Different parties give different numbers. They measure different things, and some were made hours apart.

Source (as reported)	Figure
Early estimates, Axios citing an Arkham page	$1.7 billion to $5.7 billion
Chainalysis, as reported by Forbes	$5.9 billion at the time of theft
Binance, as reported by Reuters	about $6.3 billion
TRM Labs, as reported by Forbes	about $6.36 billion across 10 blockchains, mostly in about 20 minutes

Frozen amounts also vary:

• Tether's CEO said more than $1.567 billion in USDT was frozen, and Circle's CEO said more than $800 million in USDC. Earlier figures from other sources, such as about $971 million and $823 million, were lower.
• Binance co-founder Yi He said Ripple froze about $200 million. World Liberty Financial and BitGo froze a smaller amount of their stablecoin.
• Reuters notes Binance did not say what happened to the remaining roughly $3.3 billion. TRM Labs' Ari Redbord, quoted by CNBC and cited by Insurance Business, said about $2.4 billion of what is not frozen is bitcoin and ether, which no issuer can freeze.
• Analyst Julio Moreno (CryptoQuant) tracked 18,270 BTC, about $1.4 billion, moving from a Binance cold wallet into 19 new addresses, and CoinDesk reports it had not moved on at the time of writing.

Who is blamed? An allegation, not a finding

TRM Labs attributes the attack to TraderTraitor, a North Korean hacking unit that the FBI linked to the 2025 Bybit theft, with "high confidence". Reuters reports that Chainalysis said it was also highly confident, and that it saw funds from an earlier exploit mixed with the proceeds. Neither Binance nor law enforcement had attributed the attack in the reports I read. Reuters notes that North Korea routinely denies using state-linked cyber units to steal funds. This is the view of private analysts. Treat it as an allegation until an authority confirms it.

How did it happen? This is disputed

This is the part where accounts diverge.

• Binance's account: a compromised engineer's laptop, access to a service container, and unauthorized withdrawals, with no evidence of a leaked private key so far.
• Blockaid: the security firm counted eleven Binance hot wallet keys signing the transfers and described the use of a mechanism called EIP-7702, which lets an address delegate to contract code. It says rotating keys would not remove such a delegation. FinanceFeeds notes this does not contradict "no key leak" outright but sits uneasily beside it.
• Check Point (to the BBC): the attackers did not break encryption or steal keys, but took over the system that tells keys what to sign.
• Mark Karpeles (former Mt Gox head, to Reuters): the attackers probably accessed the private keys for at least two wallets.
• Arkham's CEO also speculated, and said so, that EIP-7702 or access to systems that approve transactions may have been involved.

These accounts may describe different parts of the same chain of events, or they may differ. Only the post-mortem and independent analysis can settle it. Any firm claim today, including the ones in this article, should be read as preliminary.

What is not known

• The full attack path and which controls failed.
• Who is behind it.
• The final loss and recovered amounts, and what happens to the unfrozen part.
• When withdrawals fully return to normal.
• Whether further incidents are connected. A separate incident at Polymarket was reported at the same time, which Axios links, via researchers' findings, to a third-party tool provider. There is no public link to the Binance case.
• How losses beyond the $1 billion-scale SAFU fund will be absorbed. Reuters cites Binance's website for the fund's size, and the cost would fall largely on company funds.

What the market did

Reuters reports Bitcoin touched a six-week low near $76,400 and ether a two-month low, with BNB down about 5%. CoinDesk reports around $1.5 billion in liquidations, mostly of long positions. A smaller token, FUN, collapsed in one pool after a wallet labelled as a Binance exploiter sold into it (our breakdown).

What this means for ordinary users

The incident does not mean that every exchange is unsafe, and it is not a reason to panic. It is a reminder of risks that were always there.

1. Funds on an exchange are a claim on the exchange. If the platform is breached, you depend on its ability and willingness to cover losses. Statements of coverage are promises, not guarantees.
2. Don't keep more on an exchange than you need. Money you do not plan to trade is better off elsewhere.
3. Spread risk. Not everything with one platform, one wallet or one method.
4. Self-custody has its own risks. It moves the responsibility to you: your keys, your device, your habits. Use a separate wallet for experiments.
5. Use the account protections available. Strong two-factor authentication, an anti-phishing code and a withdrawal address allowlist if the platform supports them.
6. Watch for scams riding the news. After large incidents, fake "compensation", "refund" or "account recovery" messages and look-alike sites appear. Use only official channels, never share seed phrases or keys, and never sign a transaction you don't understand. Before sending funds to an address, you can check it first, and a free account lets you keep track of what you check.
7. Treat proof-of-reserves updates with care. They are useful but limited, and they do not replace the post-mortem.

What to watch next

• Binance's technical post-mortem and the updated Proof of Reserves.
• Whether withdrawals return as promised.
• Any attribution from law enforcement.
• Movements of the frozen and unfrozen funds, particularly the bitcoin.

Figures, statements and attributions in an incident like this change quickly. Verify the current details yourself in Binance's official channels and in the original reports before you act on anything you read here.

This article is for general information only and is not financial advice.