Binance has estimated the total impact of a major security incident at approximately $6.3 billion, with roughly $3 billion in affected assets already frozen on-chain. The cryptocurrency exchange suspects that attackers used a compromised employee laptop to submit unauthorized withdrawal transactions, and it has suspended withdrawals while upgrading the affected infrastructure.

In an official October 30 announcement, Binance said it had found no evidence that wallet private keys had leaked. The exchange pledged to cover customer losses through its Secure Asset Fund for Users (SAFU) and company funds. The reserve, established in 2018 and funded through a portion of trading fees, exists to absorb user losses during platform emergencies.

In a subsequent update on X, Binance clarified that deposits continued to operate normally. Withdrawals, however, remained suspended as the security team upgraded the withdrawal infrastructure, with the company saying it expected services to resume within 48 hours.

Investigation Points to Compromised Employee Laptop

Binance's preliminary findings point to a compromised laptop belonging to a DevOps engineer. Investigators believe the device may have provided access to a service container, which the attacker allegedly used to submit unauthorized withdrawal transactions.

The exchange stressed that its investigation remains incomplete and that the full attack path has not been established. It also reiterated that it had found no evidence of a private key leak — a distinction suggesting the incident may have involved compromised operational systems rather than direct exposure of wallet credentials.

As part of its immediate response, Binance revoked the affected address authorization, and its security team began reviewing withdrawal services and associated addresses to prevent further unauthorized activity. The company promised a detailed technical post-mortem once investigators verify the incident's root cause. Law enforcement agencies and blockchain intelligence firms are assisting with the investigation.

Estimated Losses Reach $6.3 Billion as $3 Billion Is Frozen

Binance put the incident's total financial impact at approximately $6.3 billion, a figure that substantially exceeds initial blockchain estimates of around $5.8 billion. If confirmed, it would also surpass the roughly $1.5 billion drained from exchange Bybit in February 2025, which had been the largest cryptocurrency theft on record. The exchange reported that approximately $3 billion in affected assets had already been frozen on-chain, following cooperation with blockchain networks, stablecoin issuers, and industry partners. The speed reflects a structural feature of the stablecoin market: issuers such as Tether and Circle maintain freeze functions that can lock tokens at flagged wallet addresses, capabilities previously deployed in responses to other exploits.

Tether CEO Paolo Ardoino previously reported freezing over $1.567 billion in USDT associated with the incident. Circle CEO Jeremy Allaire also confirmed restrictions affecting more than $800 million in USDC. Separately, Binance co-founder Yi He reported that the Arbitrum Security Council had frozen approximately $30.5 million linked to the attack. These individual figures should not be added to Binance's $3 billion total without confirmation that they represent separate amounts.

Meanwhile, blockchain analytics firm Chainalysis estimated that at least $5.912 billion had been stolen as of 00:30 UTC on October 30. Eric Jardine, the firm's research head, said investigators had identified movements across several blockchains.

The figures measure different aspects of the incident: Binance's $6.3 billion represents its estimated impact, while the $3 billion figure covers restricted assets. Neither figure establishes how much money has been returned to the exchange.

Withdrawals Remain Suspended as Binance Promises Compensation

Binance initially suspended both deposits and withdrawals while investigating the incident — a standard containment step during an active security response. A subsequent service update clarified that deposits remained operational, while withdrawals stayed paused as engineers reviewed the affected infrastructure. The 48-hour restoration timeline remains an estimate.

The exchange has pledged to compensate affected customers using its SAFU emergency reserve and corporate funds, and it has maintained that customer funds are safe.

Binance founder Changpeng Zhao, who stepped down as chief executive in November 2023, said the incident appeared to be a hack and welcomed the response from stablecoin issuers. Zhao noted that he no longer manages Binance but remains a shareholder.

Coinbase CEO Brian Armstrong also offered assistance. In an October 30 statement, Armstrong said Coinbase was blocking transfers to compromised wallets and had contacted Binance. The coordinated response reflects industry-wide efforts to prevent attackers from moving funds through other cryptocurrency services.

Incident Raises Questions About Exchange Reserves

The hack has also raised questions about the assets backing Binance customer balances. Proof of Reserves reporting became widespread industry practice after the 2022 collapse of FTX, when exchanges came under pressure to demonstrate that customer deposits were fully backed. A review of Binance's October 1 Proof of Reserves identified an affected hot wallet among the exchange's reported reserve addresses, and the analysis suggested that some asset backing ratios could have declined after the unauthorized transfers.

However, the earlier reserve snapshot cannot establish Binance's current backing position. The exchange said it would publish an updated Proof of Reserves after completing its remediation work — a report that could clarify how Binance has replaced affected assets and funded its compensation commitment.

Markets React as Key Questions Remain

The incident has also affected cryptocurrency markets, with Bitcoin and other major tokens declining as investors assessed the potential financial and operational consequences.

For now, the main questions concern the final amount stolen, the recovery of restricted assets, and the timeline for restoring withdrawals. Binance said its teams would continue tracing the funds and working with authorities. The company has not announced a completed recovery or published its final investigation report.