Live coverage has ended. The updates below preserve Cointelegraph’s reporting on the record $6.3 billion Binance hack as the events unfolded. The figures remained subject to change as investigators traced assets, while Binance’s withdrawal status, reserve disclosures, recovery efforts and the reopening of affected protocols were the main developments to watch.

What we know about the Binance hack

Binance estimates that the incident had a total impact of approximately $6.3 billion. The exchange said the verified value of frozen cryptocurrency had reached $3 billion, with the figure potentially increasing as investigators trace additional assets.

Binance said deposits were operating normally and that withdrawals were expected to resume as scheduled. The assets frozen in connection with the attack include Tether USDt (USDT), USDC, Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB).

Cybersecurity analysts suspect the North Korean-linked TraderTraitor group was responsible. Binance said investigators found additional breach points after initially identifying a potentially compromised engineer’s laptop as a possible entry point.

The exchange said it had allocated more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens stolen in the attack.

Oct. 30, 2:34 p.m. UTC: Binance targets withdrawals within 40 hours and plans reserves report by Monday

Binance is aiming to restore withdrawals within 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng said in an X post.

Teng said the exchange hoped to restore access before its Sunday deadline and provide an initial snapshot of its reserves ahead of Monday’s report.

He also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation. The attacker used an EIP-7702 delegation to gain execution authority over a hot wallet, Teng said. That delegation “did not pass through our normal approval controls.”

Oct. 30, 1:57 p.m. UTC: Aave lifts precautionary freeze across V3 and V4 markets

New deposits and borrowing resumed across all Aave V3 and V4 markets after the lending protocol imposed a precautionary freeze following the Binance hack, Aave said in an X post.

Withdrawals and repayments remained available during the freeze, and Aave said its smart contracts were unaffected by the incident. Founder Stani Kulechov confirmed that lending and borrowing had been re-enabled, adding that all positions remained overcollateralized in a separate post.

Oct. 30, 1:11 p.m. UTC: Binance works with FBI to recover assets

Binance is working with the FBI to help recover some of the funds stolen in the record $6.3 billion exploit, according to a source familiar with the matter. The exchange disclosed its cooperation with law enforcement in an X post, without specifying the agencies involved.

Oct. 30, 12:41 p.m. UTC: Binance says it holds $5B in matching tokens

A Binance spokesperson told Cointelegraph that the $5 billion in matching tokens was held in the exchange’s custody. The spokesperson declined to disclose wallet addresses, citing security reasons, and Binance did not say when it acquired the assets.

The exchange also said it submits weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority under a requirement that predates the hack.

Oct. 30, 11:07 a.m. UTC: Yi He says Binance is buying altcoins to replace stolen tokens

Binance is buying altcoins in quantities matching those stolen in the hack while preparing an updated proof-of-reserves report, co-CEO Yi He said in an X post.

The purchases are being made through over-the-counter transactions and on exchanges, she said. Binance’s SAFU fund and company holdings include substantial amounts of Bitcoin and Ether, Yi He added. The exchange said it would provide another update after the purchases were completed.

Oct. 30, 11:00 a.m. UTC: EIP-7702 may have helped attackers bypass security checks

Attackers could have stolen Binance’s funds without Ethereum’s EIP-7702 upgrade, but the upgrade may have helped them bypass security checks, Blockaid CEO Ido Ben-Natan told Cointelegraph in a report on the role of EIP-7702.

Ben-Natan said compromised signing systems likely enabled the attack. EIP-7702 provided “a way to do this in one sweep,” he said, whereas attackers otherwise might have needed multiple transactions.

Ambire CEO Ivo Georgiev said the funds could also have been stolen through other methods. He warned that exchange engineers could overlook the need to revoke malicious EIP-7702 delegations after regaining control of their systems.

Oct. 30, 10:55 a.m. UTC: Binance reserves $6.34B for hack losses

Binance said it had set aside more than $6.34 billion in company funds to cover losses from the hack. Of that amount, $5 billion was already held in the same tokens affected by the attack. The exchange was purchasing the remaining assets through market and over-the-counter transactions to address token shortfalls.

Some purchases could take longer because of low liquidity and OTC settlement times, Binance said. The allocation excludes frozen or protected assets. Approximately $3 billion remained frozen, while efforts to recover those funds continued with law enforcement and industry partners.

Oct. 30, 10:09 a.m. UTC: Chainalysis says attackers may be automating laundering

The attackers may be using automation to move and redistribute stolen funds, blockchain analytics company Chainalysis said in an X update.

“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”

Chainalysis said the funds repeatedly circulated among addresses and sometimes returned to wallets used earlier in the sequence.

Oct. 30, 8:37 a.m. UTC: Binance finds additional breach points

Binance said its investigation had uncovered “additional points of breach” after the exchange initially pointed to a potentially compromised laptop. The exchange said it was continuing to gather facts in coordination with law enforcement.

Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected. Outflows from the exchange stopped when withdrawals were paused, it said.

Oct. 30, 7:37 a.m. UTC: Teng says the hack was not a single “one-click” action

The attacker did not simply use one engineer’s permissions to carry out the breach, co-CEO Richard Teng said in an X post.

Teng said the incident involved “a more complex attack process” and was not a single “one-click” action. “Our investigation has not attributed responsibility to any individual,” he wrote.

Teng reiterated that preliminary findings pointed to a compromised DevOps engineer’s laptop, which may have allowed the attacker to access an internal service and submit unauthorized withdrawals. He said investigators had found no evidence of a wallet private-key leak.

Binance would cover all losses using its SAFU fund and company funds, Teng said.

Oct. 30, 5:01 a.m. UTC: Analysts suspect North Korean group

Chainalysis co-founder and CEO Jonathan Levin said the hack was likely carried out by the North Korean hacking group TraderTraitor, citing links to an earlier attack. In a post on X, Levin estimated the theft at $6.4 billion, slightly above Binance’s $6.3 billion estimate. He said industry partners had frozen approximately $3 billion and that Chainalysis was continuing to track the funds.

In a separate post, onchain investigator ZachXBT said funds stolen in the Binance attack and the earlier Bitget exploit had been commingled in the same address on Friday after arriving through THORChain. “This indicates the same actor is likely behind both incidents,” he said. He added that the Bitget exploit had been attributed to DPRK-linked TraderTraitor, which overlapped with previous exploits such as Kelp DAO.

The related THORChain address was identified as 0x15104a9ce0f08a8f0075a0869ae80e795fe0feb7.

Speaking to Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan said the attack resembled the work of North Korea, or DPRK, based on sophisticated onchain preparations, a customer sweeper contract and multiple authorizations.

TRM Labs also attributed the attack to TraderTraitor with “high confidence,” saying its assessment was “based on robust on and off-chain intelligence.” TraderTraitor has also been named by the FBI as the group responsible for the ByBit hack in February of the previous year. TRM Labs published its assessment in a report.

Oct. 30, 4:17 a.m. UTC: Binance expects withdrawals within 48 hours

Binance said withdrawals remained paused while it completed a security overhaul of its withdrawal service and related addresses. The exchange expected service to resume within 48 hours, while deposits were operating normally.

Binance said the incident involved multiple factors and that its security team was tracing the full attack path through a compromised computer believed to be the entry point.

Oct. 30, 3:49 a.m. UTC: Standard Chartered says hack could accelerate shift to DEXs

The hack could push more crypto trading toward decentralized exchanges and benefit Uniswap over the longer term, according to Geoffrey Kendrick, Standard Chartered’s global head of digital assets research.

In an email shared with Cointelegraph, Kendrick maintained his $100 price target for Uniswap’s UNI token by 2030, saying the breach was “another reason why that forecast may end up being too low.”

CoinGecko research showed that the top-10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, up 2.1 percentage points from the first quarter. “I would encourage investors to re-engage with Uniswap,” Kendrick said. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.”

Oct. 30, 2:25 a.m. UTC: Binance points to compromised engineer laptop

Binance said its initial investigation into the multibillion-dollar breach pointed to a compromised DevOps engineer’s laptop. The compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions.

The exchange said it had found no evidence of a wallet private-key leak, although the investigation remained ongoing. Binance also disclosed that the estimated total impact was $6.3 billion.

Oct. 30, 2:21 a.m. UTC: First Digital freezes FDUSD

First Digital CEO Vincent Chok said the company had frozen FDUSD stolen in the Binance attack.

“We’re working alongside the Binance team and will share updates as we have them,” Chok told Cointelegraph in a written statement. “Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds. Protecting users is a responsibility we all share.”

Oct. 30, 1:19 a.m. UTC: Bitcoin trades below $77,000 as BNB falls 8%

Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to approximately $693, while Ether declined 5.7% to about $2,211.

DeFi tokens also declined. AAVE was down 11.3% and Uniswap’s UNI had fallen 10.7% over the same period.

The Bitcoin Fear and Greed Index fell into “fear” territory with a score of 30, a level it had not reached since August.

Oct. 30, 12:52 a.m. UTC: Binance says $3B is frozen

Binance said the verified value of assets frozen in connection with the hack had reached $3 billion.

The update followed a statement from the Arbitrum Security Council that it had executed a transaction freezing $30.5 million from the Binance exploit. The frozen assets comprised 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH).

“The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” the council said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet.”

The funds would no longer be accessible to the address that originally held them and could be moved only through further action by the Security Council or a vote of Arbitrum DAO governance, it added.

Oct. 30, 12:26 a.m. UTC: Chainalysis estimates $5.912B stolen

Chainalysis estimated that the amount stolen from Binance was $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025. Binance had earlier said that the verified total frozen was $2.54 billion.

Oct. 30, 12:26 a.m. UTC: Blockaid suspects private-key “misuse”

The suspected multibillion-dollar hack may have involved attackers manipulating the exchange’s transaction-signing system, according to Blockaid co-founder and CEO Ido Ben-Natan.

In a Cointelegraph interview, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse.” In this type of incident, attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said. Ben-Natan emphasized that the assessment was preliminary and based on Blockaid’s experience with similar attacks and observations of the onchain activity.

Arkham CEO Miguel Morel said the attack appeared to be ongoing. Blockaid’s assessment was also reported in Cointelegraph’s coverage.

Oct. 30, 12:07 a.m. UTC: Binance temporarily suspends deposits

Binance said it had temporarily suspended deposits while conducting security checks, freezing funds and coordinating with law enforcement. The exchange had previously confirmed that withdrawals were suspended.

“We are working around the clock and will share a full post-mortem once the investigation is complete,” Binance said, adding that it would “cover all losses.” The exchange had also temporarily suspended Binance Alpha trading.

Oct. 30, 12:07 a.m. UTC: Wintermute and GSR disclose Binance exposure

Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses.

Both firms are market makers, placing buy and sell orders on exchanges to help other traders complete transactions. A disruption to their operations could make trading harder or more expensive across crypto markets.

GSR CEO Xin Song said the firm’s Binance exposure was less than 5% of its net equity, defined as the value of its assets minus its liabilities. He said GSR was working with Binance to understand the incident and identify ways to help.

Wintermute CEO Evgeny Gaevoy said his firm’s exposure was less than 20% of net equity and that he did not expect operational disruption. Neither executive disclosed a dollar amount for the exposure or confirmed financial losses.

Oct. 29, 11:40 p.m. UTC: Ripple freezes RLUSD linked to hack

Ripple was freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins.

McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.

Oct. 29, 11:35 p.m. UTC: Binance says $2.54B is frozen

Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.

The exchange said the total could increase as its teams worked with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. Binance said it would publish further figures once they were verified.

Oct. 29, 10:36 p.m. UTC: World Liberty Financial freezes $27M in USD1

World Liberty Financial froze $27 million in the U.S.-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He.

“USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff.

World Liberty Financial said it worked with BitGo to freeze the stolen WLFI and USD1 funds. “We will cooperate fully with the ongoing investigation and support efforts to hold those responsible accountable. Protecting our users remains a top priority,” the organization said in an X post.

Oct. 29, 10:33 p.m. UTC: Binance says withdrawals will resume after issues are resolved

Binance said its team was conducting security checks and would resume withdrawals as soon as the “security issue” was resolved.

Oct. 29, 10:32 p.m. UTC: Aave freezes markets after exploiter borrows $44.6M

Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack. In a governance forum update, risk service provider LlamaRisk said the Binance exploiter had deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth approximately $44.6 million at the time.

The borrowing occurred between 8:58 p.m. and 9:01 p.m. UTC on Oct. 29, about 40 minutes before the first freeze. It was the exploiter’s only Aave position across all networks and versions, and no further interactions were detected after 9:01 p.m. UTC.

At the snapshot in LlamaRisk’s update, the position was backed by $59.9 million in USDT collateral against $43.8 million in debt. LlamaRisk said the position remained subject to normal liquidation procedures and did not put Aave suppliers at risk.

The freezes covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks. Users could still withdraw funds and repay loans, and liquidations continued. However, the freeze prevented new deposits and borrowing, including additional collateral deposits, leaving repayment as the only way to improve an existing position’s health factor.

LlamaRisk said the markets would remain frozen until the exploiter’s funds stopped moving and Binance provided greater clarity on containment, after which Aave would stage a reopening. The provider warned that a prolonged freeze could push borrowing rates higher as withdrawals reduced available liquidity.

Oct. 29, 9:15 p.m. UTC: Binance investigates multibillion-dollar security breach

Binance began investigating a potential multibillion-dollar security breach involving one of its Ethereum wallets after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions of dollars in assets.

A Binance spokesperson told Cointelegraph on Thursday that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds. The spokesperson said security teams were reviewing the activity and would provide updates once more information had been verified.

Blockchain researcher Spreek first raised concerns in an X post, saying that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash. Spreek later reported that wallets connected to the transfers had begun selling Tether USDt (USDT) through decentralized exchanges.

Blockchain analytics platform Arkham Intelligence later identified a group of wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets. That figure represented the wallets’ reported holdings and was not a confirmed estimate of stolen funds.

Binance co-founder Changpeng Zhao said the activity appeared to be a hack. He added that Tether and Circle had frozen approximately $971 million and $823 million, respectively, and said he expected all user funds to be fully covered.

Tether and Circle freeze more than $2.36B

Blockchain security firm Blockaid said it had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

Shortly after news of the hack emerged, Tether and Circle, the two largest stablecoin issuers by market capitalization, said they had frozen a combined $2.36 billion in tokens linked to the suspected incident.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation. A few minutes later, Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.

“Protecting the industry and our partners is our main priority,” Ardoino wrote.

The Binance hack came hours after Polymarket temporarily halted trading following a compromise at a third-party provider. The prediction market platform said it had fixed the issue and pledged to reimburse affected users. It reported that all systems were operational by 7:05 p.m. UTC Thursday.

Reporting by Felix Ng, Bryan O’Shea, Nate Kostar and Yohan Yun.