Binance Halts Withdrawals After $6.3 Billion Hack, It Says

Binance has estimated the impact of a security breach at about $6.3 billion, a potential record crypto theft that has halted withdrawals and triggered an international effort to freeze stolen assets. ^[1]

Blockchain tracing firm Elliptic put the amount taken higher, at $6.43 billion across 11 blockchains. By its latest update on October 30, it had independently verified that about $2.84 billion had been frozen, mostly in stablecoins, tokens pegged to a currency such as the dollar. ^[2]

Either loss estimate would exceed four times the previous record, the $1.46 billion stolen from the crypto exchange Bybit in February 2025. Binance, which holds customers' digital assets and processes their trades, has suspended deposits and withdrawals while it investigates. ^[1][2]

The exchange says it will cover losses, including with company funds, and has reserved more than $6.34 billion for that purpose. Its immediate task is to make its systems safe enough to reopen while investigators and token issuers try to stop more of the money moving. ^[1][2]

The breach is confirmed through Binance's statements, but the final loss, the full method of attack and responsibility remain unsettled. TRM Labs and Chainalysis have linked the attack to North Korean hackers. Binance co-CEO Richard Teng said the company's investigation had not attributed responsibility to anyone. ^[1][3][4]

Billions frozen, billions still being tracked

The recovery effort has already stopped a substantial share of the stolen assets. Binance said about $3 billion had been frozen, compared with Elliptic's independently verified estimate of $2.84 billion. The figures reflect different estimates in a fast-moving operation. ^[1][2]

On Elliptic's numbers, roughly 44 percent of the stolen value had been frozen, leaving about $3.6 billion outside those freezes at the time of its update. That is still more than twice the value of the previous record theft. ^[2]

The type of asset matters. Stablecoins such as Tether's USDT and Circle's USDC have issuers that can freeze tokens in some circumstances. Both companies froze assets linked to the Binance incident. Elliptic also reported freezes by other token issuers and emergency action by the Arbitrum Security Council, a body with emergency powers on the Arbitrum blockchain network. ^[1][2][4]

Bitcoin and Ether work differently. Neither has a central issuer able to freeze the assets, and Elliptic said the remaining funds included both. Investigators were tracking their movement, according to Wired.

Seeing where money goes does not itself stop it from going somewhere else. ^[2][3]

A freeze also does not mean money has already been returned to Binance. The figures measure assets prevented from moving, rather than a completed recovery. The eventual financial damage will depend partly on how much of that frozen value can be recovered. ^[2]

For customers, Binance's promise to absorb losses addresses one immediate fear. The suspension creates another practical problem: they cannot withdraw assets while the exchange keeps that service closed. ^[1][2]

Access without stolen keys

Elliptic traced the first wave of withdrawals to around 20:05 UTC on October 29, 2026, across multiple Binance wallets. A second wave followed shortly after 23:00 UTC. Its analysis followed transactions across 11 blockchains, the separate networks on which the assets moved. ^[2]

Binance initially said the breach might have involved a compromised engineer's laptop. It later said investigators had found additional points of breach and described a complex attack. That account has widened the investigation beyond a single compromised device. ^[1][2][3]

The company said it had found no evidence that wallet private keys had leaked. Those keys are the digital credentials used to authorize transfers. Elliptic's analysis instead suggests that the attacker gained access to systems capable of making Binance wallets authorize transactions. ^[1][2][4]

That would explain how funds could leave without the attacker necessarily possessing the keys themselves. It also puts the focus on the systems that approve transfers, alongside the protection of the keys. Binance is working with law enforcement and industry partners as it investigates. ^[1][2][4]

The scale makes restoring service a demanding decision. Binance says it holds about $140 billion in digital assets. Reopening withdrawals requires confidence that the route used to drain its wallets has been closed. ^[1]

A sanctions investigation as well as a theft

TRM Labs and Chainalysis linked the attack to TraderTraitor, a North Korean hacking unit. Elliptic assessed that North Korea-linked actors were likely responsible, but Wired reported that Elliptic had not specifically attributed the attack to TraderTraitor. North Korea denies involvement in crypto theft. ^[2][3][4]

If that assessment is established, the consequences extend beyond Binance's balance sheet. Elliptic said the US government has linked North Korean crypto thefts to funding the country's weapons programs. Freezing the proceeds would then serve a sanctions-enforcement purpose as well as helping recover stolen property. ^[2]

Markets initially reacted sharply. Al Jazeera reported that Bitcoin reached a six-week low of $76,368 and Ether fell more than three percent before markets steadied. The Ars Technica account recorded a roughly four percent Bitcoin decline followed by a recovery above $78,000. ^[1][4]

Binance also faces this crisis with an existing compliance burden. Co-founded in 2017, it pleaded guilty to US criminal charges related to anti-money-laundering failures in 2023 and paid a $4.3 billion fine. ^[1]

The next operational milestone is the return of withdrawals. Teng said Binance hoped to restore them within about 48 hours, while a later company update described the target as before Sunday. ^[1][2]