Binance has estimated the total impact of Thursday’s security incident at approximately $6.3 billion and said that about $3 billion of the affected assets has been frozen onchain with help from blockchain partners. The estimated size would place the incident among the largest in the industry’s history, exceeding the roughly $1.5 billion taken from Bybit in February 2025, which had been the largest recorded theft from a crypto exchange.

The exchange initially said that a compromised DevOps engineer’s laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance has since said its investigation uncovered “additional points of breach.”

In an investigation update, Binance said: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination…”

The statement was posted by Binance on X on October 30, 2026: https://twitter.com/binance/status/2116089661408108712

The exchange said it had found no evidence that any wallet private key was leaked. Binance initially suspended deposits and withdrawals, revoked authorization for the affected address, and began working with law enforcement and blockchain intelligence firms to trace and recover the funds.

Binance said it would cover all losses through its Secure Asset Fund for Users, or SAFU, an emergency reserve for users, as well as company funds. The fund was created in 2018 and is financed through a portion of trading fees, giving the exchange a dedicated buffer for precisely this kind of emergency. The exchange reiterated that “user funds are safe.”

Deposits had returned to normal by Friday morning, Binance CEO Richard Teng said, while withdrawals remained suspended as the company carried out “a security revamp of the withdrawal service and its related addresses.” Binance said it remained on track to resume withdrawals in 45 hours after the suspension began.

Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” describing the incident as “a more complex attack process.” He added: “Our investigation has not attributed responsibility to any individual.”

Teng’s statement was posted on X on October 30, 2026: https://twitter.com/_RichardTeng/status/2116072080525656150

Binance said it was still gathering facts and would publish “a detailed technical post-mortem once the investigation is complete and every fact is verified.” Teng also said the exchange would publish an updated Proof of Reserves after remediation was complete — a report designed to demonstrate that an exchange’s holdings cover its customers’ balances.

Blockchain analytics firm Arkham estimated that approximately $6.01 billion was taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. Eastern Time on Thursday. Hot wallets are the internet-connected wallets exchanges use to process withdrawals, as distinct from offline cold storage. According to Arkham, issuers had frozen $2.80 billion of the assets, while approximately $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens remained movable.

Arkham reported that the attacker continued moving funds. Early Friday, the wallets sent $38.82 million in Ethereum to a new address while retaining $1.12 billion in ETH. Hours later, a Tron address identified by Arkham as belonging to the attacker sent approximately $2.1 million in TRX to nine new addresses through 14 transfers. That movement is visible to anyone watching the chain, which is what allows analytics firms to track the funds and partners to coordinate freezes as the money travels.

Arkham’s report is available on X: https://twitter.com/arkham/status/2116022327674810570

Stablecoin issuers freeze assets

Stablecoin issuers moved to freeze assets as funds left Binance. Both USDT and USDC are centralized tokens whose issuers can blacklist addresses, a freeze mechanism that native chain assets such as Bitcoin and Ether do not have. Tether and Circle froze approximately 975.1 million USDT and 823 million USDC held in the main receiving wallet, with a combined value of about $1.8 billion. Decrypt reported the freezes on Thursday, when an onchain tally estimated the outflow at $5.57 billion.

Binance co-founder Changpeng “CZ” Zhao thanked the two issuers for their “quick freeze.”

As of Friday morning, Arkham’s entity page for the attacker showed holdings of approximately 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, along with frozen stablecoin balances.

Binance’s official announcement is available here: https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7