Binance is investigating a security breach estimated to have caused losses of $6.3 billion. The exchange has frozen roughly $3 billion in assets and suspended user deposits and withdrawals, but it has not yet determined how much of the money is lost for good.

What Binance says it found

According to Binance's statement on October 30, the laptop of a DevOps engineer was compromised. The attacker may have used it to gain access to a service container and initiate unauthorized withdrawals. So far, Binance says it has found no evidence that wallet private keys were exposed.

It remains unclear how much damage has ultimately occurred. Binance has put the estimated damage from the event at $6.3 billion, though that figure does not mean all of the money is gone forever.

After issuing an initial warning on X, Binance cancelled authorization for the affected address and contacted police and blockchain investigators to help track down the stolen funds.

According to the exchange, any losses will be compensated from its SAFU reserves as well as from company funds. SAFU — short for Secure Asset Fund for Users — is an emergency insurance fund Binance established in 2018 and finances with a share of trading fees. Binance will also issue a technical report once the investigation has finished, and an updated proof of reserves will be published once the security issues have been cleared. Proof of reserves attestations, which are intended to show that an exchange holds the customer assets it claims, have become a standard confidence check for centralized platforms.

Frozen is not recovered

The roughly $3 billion Binance has frozen is not the same as money recovered. The freezes relied in part on the ability of stablecoin issuers to blacklist addresses on the tokens they issue, a power that has become a central tool in responding to exchange thefts.

Tether CEO Paolo Ardoino reported freezing more than 1.567 billion USDT, while Circle's Jeremy Allaire confirmed freezing over 800 million USDC alongside law enforcement. Both amounts are included in Binance's total.

Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation. — Jeremy Allaire (@jerallaire) October 29, 2026 (post on X)

However, freezing stolen assets only prevents further transfers. It does not automatically return the money.

The timing of the asset freezes was critical. Data from blockchain analytics firm Bitquery showed that Ethereum wallets whose assets were frozen within a week kept 59% of their USDT. After half a year, only 12% of the USDT is left.

The limits of asset freezes were clearly exposed during the Bitget hack in September. As Cryptopolitan reported at the time, Circle and Tether managed to freeze only $318,000 out of $387.5 million that had been stolen. By then, the money had already been converted into other cryptocurrencies.

The clues investigators will weigh

Investigators have two main questions to answer: first, how the hacker was able to authorize the withdrawals, and second, what has happened to the rest of the money.

The suspicion that a Binance laptop was compromised to open the door for the attacker gives investigators a place to start. But they still have to prove how the hacker managed to gain access to the device.

Another possibility worth examining relates to EIP-7702. This Ethereum feature, which went live with the Pectra upgrade in May 2025, gives regular accounts the right to assign transactions to smart contracts. As Binance Academy points out, hackers can take advantage of these permissions to empty wallets. However, Binance has not connected EIP-7702 to the hack and has not confirmed whether or not it was used.

Prices slid as the news broke

The uncertainty quickly spread to cryptocurrency markets. Reuters reported that Bitcoin fell to a six-week low of $77,646. Ether dropped to $2,238.76, its lowest level in two months. BNB also lost more than 8% over 24 hours, falling to $694.

The breach has also pushed this year's security losses sharply higher. According to CertiK's dashboard, cryptocurrency losses reached $8.98 billion across 748 incidents in 2026. Binance alone accounted for $6.07 billion, or 67.6% of the total. Private key compromise remained the costliest attack category at $6.22 billion, although other exploits occurred more frequently.

The figures show how a single major breach can dominate annual losses. TRM Labs recorded $2.87 billion stolen across nearly 150 hacks in 2025. The $1.46 billion Bybit breach alone accounted for 51% of that total.

Will SAFU and proof of reserves reassure?

Binance insists that user funds remain safe and has promised to cover losses through its SAFU reserve and company funds. But restoring confidence will take more than that assurance. Customers will be looking for answers in the promised technical report and the updated proof of reserves. They will also want to know how much of the frozen $3 billion Binance can actually recover. On-chain behavior of the stolen funds offers another signal that analysts and customers can track directly.

The hacker who perpetrated the alleged theft of $1.5 billion from Binance spread the 18,270 BTC taken in the hack across 19 wallets within a matter of minutes, after which the cryptocurrency was not moved. On-chain analysis has found that 17 of these wallets currently hold precisely 1,000 BTC each, while the other two hold 832.5 BTC and 437.7 BTC, respectively. The distribution was carried out through a peel chain, in which portions of the stolen cryptocurrency were moved via new addresses. None of the 19 wallets had made an outbound transaction as of 04:23 UTC on Friday.