By Binance has disclosed an estimated $6.3 billion security incident, potentially the largest cryptocurrency exchange hack on record, after unauthorized withdrawals triggered emergency asset freezes and a temporary suspension of deposits and withdrawals.
In an official update published October 30, 2026, the exchange said approximately $3 billion in affected cryptocurrency assets had been frozen on-chain through cooperation with blockchain networks, token issuers and security partners.
The remaining $3.3 billion has not been confirmed as recovered or frozen. Binance said its preliminary investigation identified a possible compromise of a DevOps engineer’s laptop, which may have allowed attackers to access an internal service container and initiate unauthorized withdrawal transactions.
The company emphasized that investigators had found no evidence of leaked wallet private keys. Binance pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds, maintaining that customer balances would remain protected.
However, the exchange has not published a completed technical investigation or updated proof-of-reserves report.
Compromised Laptop Suspected as Stablecoin Issuers Freeze Billions
Suspicious transfers emerged on October 29, when blockchain investigators identified large cryptocurrency movements from Binance-controlled wallets. Early estimates placed the affected assets between $3.5 billion and $5.8 billion before Binance confirmed an estimated $6.3 billion impact.
The exchange subsequently revoked affected address authorizations and suspended deposits and withdrawals while conducting security checks. Stablecoin issuers played a significant role in limiting further transfers.
Tether froze approximately $1.57 billion in USDT linked to the incident, while Circle restricted more than $800 million in USDC. Other token issuers and industry participants also assisted, bringing the combined on-chain freeze to approximately $3 billion. However, frozen tokens are not equivalent to recovered funds. Their eventual disposition may depend on technical procedures, investigations and legal requirements.
Binance has engaged law enforcement and blockchain intelligence companies to trace the remaining assets. The company has not confirmed the attackers’ identities or established whether compromised credentials, infrastructure permissions or other vulnerabilities enabled the unauthorized transactions.
Cybersecurity firms have reportedly examined possible connections to North Korean-linked hacking operations, but Binance has not confirmed an attribution. The exchange said it would publish a detailed technical post-mortem after completing its investigation.
Reserve Questions and Market Reaction Intensify Scrutiny
The breach has raised questions about Binance’s ability to maintain full backing of customer balances while replacing affected assets. CoinDesk reported that one compromised wallet, identified as Binance 14, appeared in the exchange’s October 1 proof-of-reserves disclosures.
Its analysis estimated that approximately 204,500 ETH had been removed from wallets associated with customer backing. Based on the earlier reserve snapshot, the withdrawal could temporarily reduce Ethereum backing to approximately 94% if Binance had not replaced the assets. That estimate is not evidence of a confirmed current reserve shortfall, because it does not account for subsequent transfers, additional collateral or replenishment.
Binance has promised an updated proof-of-reserves report after remediation. The incident also triggered selling across cryptocurrency markets. Reuters reported Bitcoin falling to approximately $76,470 on October 30, while Ethereum declined toward $2,186. Shares of cryptocurrency-related companies also weakened as investors reassessed exchange custody risks.
Institutional investors reportedly began transferring assets away from centralized exchanges following the disclosure, adding to concerns about confidence in custodial infrastructure. The estimated $6.3 billion impact exceeds the approximately $1.5 billion stolen from Bybit in February 2025, previously the largest widely reported cryptocurrency theft. Nevertheless, the final economic loss could be substantially lower if frozen assets are recovered.
The immediate priorities are restoring normal withdrawal operations, determining the precise cause of the breach and confirming that customer assets remain fully backed. Until Binance publishes its technical findings and updated reserves, the $6.3 billion figure should be treated as the estimated incident impact rather than a finalized unrecoverable loss.