The Binance hack that drained an estimated $6.3 billion from the exchange on Thursday was more complicated than first described. On Friday, October 30, 2026, Binance said its investigation ha
The Binance hack that drained an estimated $6.3 billion from the exchange on Thursday was more complicated than first described. On Friday, October 30, 2026, Binance said its investigation has uncovered “additional points of breach” beyond the compromised engineer’s laptop it initially flagged. Withdrawals remain suspended.
Binance first pointed to a compromised engineer's laptop.
Binance called it “a complex attack” in its latest update and said it is still gathering the facts, Decrypt reported. Binance CEO Richard Teng wrote that the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” He added that the investigation “has not attributed responsibility to any individual.” Our earlier report covered the initial DevOps laptop breach theory.
The size of the theft depends on who is counting. Binance says $6.3 billion. Arkham puts it at $6.01 billion and TRM Labs at about $6.36 billion. Before the incident, Binance held about $144 billion in assets on its platform, CoinDesk reported, citing DefiLlama data.
Of the roughly $3 billion frozen, $2.3 billion was in USDT and USDC, according to CoinDesk. Reported freeze amounts per issuer vary. TechCrunch cited about $1.56 billion frozen by Tether and about $800 million by Circle, while Decrypt counted 975.1 million USDT and 823 million USDC in the main receiving wallet. Arkham estimated that $2.9 billion in ETH, BTC, TRX, SOL and other tokens could still be moved.
Binance hasn’t said what the additional breach points are, how the attack unfolded beyond the laptop, or whether any internal systems remain exposed. Technology.org noted that TRM Labs and Chainalysis linked the attack to TraderTraitor, the group previously tied to the $1.5 billion Bybit theft in February 2025, but no government has backed that finding.
Binance co-founder Changpeng “CZ” Zhao thanked Tether and Circle for their “quick freeze.” In DeFi, Aave froze markets on its V3 and V4 deployments as a precaution. According to LlamaRisk, cited in Cointelegraph’s live coverage, the exploiter had deposited 60 million USDT and borrowed 19,762 WETH, worth about $44.6 million.
Prices slid. CoinDesk reported on October 29 that bitcoin fell back to about $77,000, BNB dropped about 8% and AAVE lost 11%. The CoinGecko figures below cover the 24 hours to 10:47 UTC on October 30, so they are not directly comparable. Our separate report looks at liquidations after the Binance hack. The Crypto Fear & Greed Index stood at 30 (“Fear”) on October 30.
Asset Price (USD) 24h change Bitcoin (BTC) $77,571 -3.29% Ethereum (ETH) $2,240.88 -3.56% BNB $702.55 -5.28% Solana (SOL) $96.87 -3.59% XRP $1.25 -2.88%Prices from CoinGecko as of October 30, 2026, 10:47 UTC.
Markets slipped as the scale of the theft became clear.
The first test is the withdrawal restart. Binance said it remains on track to reopen withdrawals in about 45 hours. Teng said withdrawals stay suspended while the exchange completes “a security revamp of the withdrawal service and its related addresses.” Teng also promised a detailed technical post-mortem once the investigation is finished and an updated Proof of Reserves after remediation. For background on the reserve fund, see our explainer on whether funds are SAFU after the record heist.
Onchain, the roughly $2.9 billion that Arkham says is still movable matters most. The attacker keeps shifting assets. On Friday, a Tron address tagged by Arkham sent about $2.1 million in TRX to nine new addresses in 14 transfers. Further freezes, any attempt to launder funds through mixers or bridges, or an official attribution could all change the picture.
For users, the risks are concrete. Funds held on any centralized exchange depend on that platform’s security and solvency. A pledge to cover losses is a company commitment, and how it plays out depends on Binance following through. High-profile hacks also attract scammers posing as support staff or “recovery” services. Never share a seed phrase with anyone who contacts you offering help.
Binance estimates around $6.3 billion. Arkham counts $6.01 billion and TRM Labs about $6.36 billion. Roughly $3 billion has been frozen onchain.
In its October 30 update, Binance said it expected to resume withdrawals in about 45 hours. The timing could change as the investigation continues.
TRM Labs and Chainalysis have linked it to North Korea’s TraderTraitor group. Binance hasn’t attributed responsibility, and no government had confirmed the link as of October 30, 2026.
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
