Binance, the world’s largest cryptocurrency exchange by trading volume, reported a major security incident involving an estimated $6.3 billion in digital assets. According to its October 30 security incident update, the suspected attack occurred on October 29, 2026, and affected cryptocurrency withdrawal systems. Binance said approximately $3 billion in affected assets had already been frozen with help from blockchain partners.
In its October 30 update, Binance said about $3 billion of the affected assets had been frozen on-chain with industry partners. The remaining estimated $3.3 billion was not included in that frozen total at the time of the announcement. Investigators were still tracing the transactions, and the final amount that cannot be recovered may change as the investigation continues.
Binance’s initial investigation suggested that attackers may have compromised a laptop belonging to one of its DevOps engineers. This could have allowed unauthorized access to an internal service container and enabled cryptocurrency withdrawal transactions. However, Binance later reported discovering additional points of breach, meaning the compromised laptop has not been established as the only way the attackers entered its systems.
Binance said it had found no evidence that its cryptocurrency wallet private keys were leaked during the incident. However, the complete method used to authorize the suspicious transactions remains under investigation. The company has not yet published its final technical findings, so the exact security weaknesses involved have not been fully established.
The suspected attack has attracted major attention because of its unusually large financial impact. If the estimated scale is confirmed, it could exceed previous cryptocurrency thefts, including the approximately $1.5 billion Bybit hack in February 2025. However, the final financial loss will depend partly on how much of the affected cryptocurrency can be frozen or recovered.
A blockchain investigation by TRM Labs traced approximately $6.36 billion in cryptocurrency transfers from Binance-linked wallets across ten blockchains. TRM Labs also attributed the attack to TraderTraitor, a North Korea-linked hacking group, based on its blockchain analysis and other intelligence. However, this remains the security firm’s assessment, and Binance has not publicly confirmed the attackers’ identities.
Major stablecoin issuers also moved to restrict cryptocurrency linked to the incident. According to Reuters’ reporting on the asset freezes, Tether said it had frozen approximately $1.57 billion in USDT, while Circle reported freezing more than $800 million in USDC. These actions formed part of the wider effort to prevent suspicious assets from being transferred. However, frozen cryptocurrency has not necessarily been recovered or returned to its original owners.
Binance initially suspended cryptocurrency deposits and withdrawals while its security teams investigated the incident. According to a later official Binance service update, deposits had returned to normal, while withdrawals remained temporarily paused as the exchange reviewed and strengthened its withdrawal systems. Binance said it expected withdrawals to resume within 48 hours, although the exact restoration time depended on the completion of its security checks.
Binance has told customers that their funds remain safe and has promised to cover losses resulting from the incident. The exchange said it would use its Secure Asset Fund for Users (SAFU), an emergency reserve designed to help protect eligible users during certain security incidents, together with company funds. However, this is Binance’s stated commitment, and the final compensation process has not yet been fully detailed.
Cryptocurrency prices declined after news of the Binance security incident emerged. During early trading on October 30, Bitcoin and Ether both fell by more than 3%, while Binance-linked BNB also recorded losses. The market reaction reflected concerns about the scale of the incident and the security of funds held by major cryptocurrency exchanges, although other market conditions may also have influenced prices.
The Binance incident highlights the security challenges faced by cryptocurrency exchanges that manage large amounts of digital assets. A separate Bitget cryptocurrency exchange security breach reported in September 2026 also demonstrated the risks associated with exchange wallet infrastructure and unauthorized transactions. Although the circumstances of the two incidents were different, both highlight the importance of strong transaction approvals, internal access controls, and rapid security responses.
Binance users should also be cautious about scammers attempting to exploit interest in the security incident. Fake customer-support accounts, urgent recovery messages, and lookalike websites may be used to trick people into sharing passwords, verification codes, or cryptocurrency wallet information. TechBonafide’s guide to checking whether a website is trustworthy explains how to recognize suspicious domains and misleading pages before entering sensitive account details.
Users should access Binance through its official app or a trusted bookmarked website, review their account activity, and enable two-factor authentication (2FA). Binance’s official phishing-prevention guidance also recommends checking the authenticity of suspicious messages and using an anti-phishing code for account emails. Customers should never share login passwords, verification codes, or wallet recovery phrases with anyone claiming to provide security assistance.
Users should also avoid approving unexpected or repeated login verification requests. Some attackers use repeated authentication prompts to pressure people into allowing unauthorized access. TechBonafide’s guide to MFA fatigue attacks explains how these scams work and why users should verify every authentication request before approving it.
Binance is continuing its investigation with law enforcement agencies, blockchain intelligence companies, and other cryptocurrency industry partners to identify the attackers and trace the affected assets. The exchange has promised to publish a detailed technical report after completing its investigation. It also plans to release an updated Proof of Reserves report following its security improvements, which could help customers review its reported asset holdings.
The Binance crypto hack is a major security incident for the cryptocurrency industry, raising questions about exchange infrastructure, transaction approvals, and customer asset protection. While Binance has promised to cover losses, the investigation is still ongoing. The final amount recovered, the confirmed cause of the attack, and the effectiveness of Binance’s security improvements will be important in determining the incident’s long-term impact.
