Table of contents
On October 29, 2026, Binance suffered a major security breach involving unauthorised cryptocurrency transfers worth an estimated $6.3 billion. The incident affected multiple blockchain networks and triggered an industry-wide effort to trace and freeze the stolen assets.
Binance’s preliminary investigation points to a potentially compromised DevOps engineer’s laptop as the entry point. The exchange has reported no evidence of a wallet private key leak and has committed to covering all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
1. How Did the Incident Begin?
Blockchain monitoring systems detected suspicious movements from Binance-linked wallets on October 29. Initial investigations focused on Ethereum-based transfers, but subsequent analysis identified activity across Bitcoin, Tron, Solana, XRP Ledger and other networks.
As investigators traced additional transactions, the estimated impact increased, with Binance’s own estimate of $6.3 billion.
The incident quickly developed into a major cross-chain investigation, with blockchain intelligence firms and cryptocurrency companies working to identify the affected wallets and prevent further movement of the assets.
2. How the Attackers Allegedly Hacked Binance
The suspected entry point
Binance’s preliminary investigation suggests that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access an internal service container. This access may have been used to submit unauthorised withdrawal transactions.
The exact method used to compromise the device has not been publicly established. Binance has also reported no evidence that wallet private keys were leaked.
How unauthorised withdrawals were possible
The preliminary findings suggest that the attacker may have exploited access to an authorised internal service rather than directly extracting wallet private keys.
This distinction is important because cryptocurrency withdrawals depend on several connected systems, including internal services, access permissions and transaction-signing infrastructure. Compromising one of these systems may create an opportunity to misuse legitimate transaction processes.
The full sequence of how the attacker gained access and obtained sufficient permissions remains under investigation.
The Ethereum wallet technique
Independent blockchain security analysis identified the use of Ethereum’s EIP-7702 account-delegation mechanism in the attack involving Binance’s Ethereum hot wallet.
EIP-7702 allows externally owned Ethereum accounts to delegate certain execution functions to smart-contract code. The reported activity suggests that this mechanism may have been abused to facilitate unauthorised asset transfers.
This does not indicate that Ethereum itself was compromised. The precise role of the mechanism and how it was exploited will need to be established through Binance’s technical post-mortem.
3. The Scale and Timeline of the Attack
Blockchain analysis published on October 30 provides a preliminary picture of the incident’s development.
| Date and time (UTC) | Development |
| October 28 | Preliminary on-chain activity linked to wallets later associated with the incident was identified. |
| October 29, | Major suspicious transfers appeared on the XRP Ledger. |
| October 29, | Additional activity was detected on Solana and other networks. |
| October 29, | Significant transfers involving Bitcoin, Tron and Ethereum-linked wallets followed. |
| October 29, | A major Ethereum transaction moved substantial amounts of ETH, USDT and other tokens. |
| October 29, later evening | Tether, Circle and other ecosystem participants began freezing or restricting affected assets. |
| October 30 | Binance identified a potentially compromised DevOps laptop as a possible entry point and reported approximately $3 billion in frozen assets. |
| October 30, later update | Binance confirmed that deposits were operating normally, while withdrawals remained paused during a security overhaul. |
The timeline reflects reported blockchain activity and company updates. The final sequence of events remains subject to forensic investigation.
4. Which Cryptocurrencies Were Affected?
The incident involved multiple cryptocurrencies, stablecoins and smaller digital assets across several blockchain networks.
Major assets identified in blockchain analysis
| Asset | Reported amount | Approximate value |
| Bitcoin (BTC) | 18,270 BTC | $1.47 billion |
| Ethereum (ETH) | 200,630 ETH | Included in Ethereum-network total |
| Tether (USDT) | 1.875 billion on Ethereum and 612.7 million on Tron | More than $2.4 billion combined |
| USD Coin (USDC) | Approximately 823 million | Approximately $823 million |
| Ripple USD (RLUSD) | Approximately 88.5 million | Included in Ethereum-network total |
| XRP | 233.46 million XRP | Approximately $296 million |
| Solana (SOL) | Approximately 970,500 SOL | Approximately $96 million |
| TRX | Approximately 46.4 million directly identified | Additional TRX acquired through subsequent swaps |
| Arbitrum (ARB) | Approximately 74.6 million ARB | Part of the wider cross-chain total |
Other tokens involved
Additional assets identified across the affected wallets included Wrapped Beacon ETH (wBETH), Tether Gold (XAUt), Uniswap (UNI), Ethena (ENA), Pepe (PEPE), World Liberty Financial USD (USD1), Chainlink (LINK), Aave (AAVE), Avalanche (AVAX), Optimism (OP), USDT0, Paxos Gold (PAXG), Zama (ZAMA) and Lagrange, alongside several smaller tokens.
Arkham Intelligence has labelled multiple addresses associated with the suspected attacker, helping investigators monitor subsequent movements. The token list remains subject to change as additional transactions are identified.
5. Who Hacked Binance?
The North Korean connection
On October 30, blockchain analytics firm Chainalysis said it had a high degree of confidence that North Korea was responsible for the Binance incident. Its investigators reported identifying funds from a previous Bitget exploit being mixed with funds associated with the Binance theft.
These assessments point towards a possible North Korean connection, but the identities of the individuals responsible have not been publicly established. Binance has said it is working with law enforcement to identify those involved and bring them to justice.
The attribution should therefore be treated as an intelligence assessment rather than a final legal finding.
6. How Much Money Has Been Frozen and Recovered?
Binance initially reported that approximately $3 billion in affected assets had been frozen through coordination with blockchain partners, token issuers and other industry participants.
Several companies and networks contributed to the effort:
- Tether (USDT): Reported freezing more than $1.567 billion linked to the incident, with subsequent analysis identifying additional restricted USDT across multiple addresses.
- Circle (USDC): Froze approximately $823 million in USDC associated with the incident.
- Ripple (RLUSD): Confirmed that it was monitoring the incident and actively freezing affected funds.
- Arbitrum: Its Security Council executed an action to freeze approximately $30.5 million associated with the exploit.
- Other issuers and partners: Additional assets, including USD1, FDUSD and gold-backed tokens, were subject to freezing or other restrictions.
Why freezing matters
Stablecoins such as USDT and USDC can be frozen by their issuers, which have the ability to restrict transfers from specific addresses. This helped prevent the suspected attacker from moving some of the affected assets.
Bitcoin and Ether do not have a central issuer with the same ability to blacklist addresses. Their recovery depends more heavily on transaction tracking, cooperation with exchanges and intermediaries, and legal action.
It is important to distinguish frozen assets from recovered funds. Frozen cryptocurrency may remain inaccessible while investigators establish ownership and determine how it can legally be returned.
7. What Happened to the Stolen Funds?
Blockchain investigators traced funds moving across Ethereum, Bitcoin, Tron, Solana, XRP Ledger and several layer-2 networks.
Some assets were converted into other cryptocurrencies through swaps and moved across multiple addresses. Reported activity included transactions involving Ether and TRX, alongside interactions with decentralised exchanges and other blockchain services.
These movements complicate recovery, although public blockchain records allow investigators to track transactions and identify connections between wallets.
The movement of funds does not necessarily mean that the attacker successfully cashed out. The final destination of all affected assets had not been established as of October 30.
8. What Happened to Binance Customers?
Were customer funds lost?
Binance stated that customer funds remain safe and committed to covering all losses through its SAFU fund and corporate funds. Also, the exchange has reportedly reserved $6.34 billion in company funds to cover losses arising from the incident, reinforcing its commitment to protecting customers.
The commitment is important for customers, but its implementation will need to be assessed through the exchange’s promised updated proof of reserves and subsequent disclosures.
Were withdrawals affected?
Binance temporarily suspended deposits and withdrawals while conducting security checks.
In its October 30 update, the exchange said deposits were operating normally, while withdrawals remained paused during a security overhaul of the withdrawal service and related addresses. It expected withdrawals to resume within 48 hours.
What about trading?
Binance Alpha trading and certain related instant-purchase and prediction-marketing services using funds from spot wallets were also temporarily suspended.
The exchange said these services would resume once the security issue was resolved. The restrictions formed part of its wider precautionary response.
9. Binance’s Response and Industry-Wide Support
Binance’s response involved both internal security measures and cooperation with companies across the cryptocurrency industry.
Changpeng Zhao (CZ), Binance’s co-founder and former chief executive, reassured users that their funds were safe. He also acknowledged employees who worked overnight to address the incident and thanked industry participants, including competitors, for their assistance.
Yi He, Binance’s co-founder and co-CEO, thanked the community for its support and said the team was conducting security checks before restoring withdrawals.
The exchange’s response has focused on:
- Revoking authorisation associated with the affected address.
- Temporarily restricting affected services.
- Working with law enforcement and blockchain intelligence firms.
- Coordinating with token issuers and industry partners to freeze assets.
- Strengthening the withdrawal service and related addresses.
- Preparing a detailed technical post-mortem.
- Publishing an updated proof of reserves after remediation.
Tether, Circle, Ripple and Arbitrum also contributed to the response through asset restrictions and freezing measures. Blockchain intelligence firms continued tracking transactions and identifying related addresses.
The coordinated effort demonstrates how exchanges, token issuers, blockchain networks and investigators can work together during a major security incident.
10. Why the Incident Matters for the Wider Crypto Industry
The incident highlights the risks associated with privileged employee access and internal withdrawal systems.
Even when wallet private keys remain secure, compromised internal services may create opportunities for unauthorised transactions. This makes employee device security, access permissions and withdrawal approval systems just as important as protecting private keys.
The incident also raises questions about the safeguards exchanges use to prevent a compromised internal system from independently approving large withdrawals.
Stronger employee access controls, independent transaction validation, withdrawal limits and real-time monitoring may help reduce the risk of similar incidents.
For the wider industry, the incident is a reminder that exchange security remains a major risk even when the underlying blockchain networks continue to operate normally.
11. Market Impact and Outstanding Questions
The incident increased uncertainty across cryptocurrency markets, with contemporary reporting indicating that Bitcoin fell below $77,000 alongside declines in Ether and other assets. Although security concerns may have contributed to market pressure, the price movements cannot be attributed entirely to the Binance incident.
Several important questions also remain unanswered:
- How was the DevOps engineer’s laptop compromised?
- How did the attacker obtain sufficient access to the withdrawal system?
- How much of the affected cryptocurrency will ultimately be recovered?
- What will the final technical investigation reveal about the attack?
- Will the updated proof of reserves demonstrate that customer assets remain adequately backed?
- When will all affected services return to normal?
Binance’s immediate priorities are to complete its security overhaul, restore withdrawals safely, continue coordinating with investigators and publish its technical post-mortem.
12. Final Assessment
The Binance incident represents a major exchange security failure, with an estimated impact of approximately $6.3 billion. Preliminary findings suggest that compromised internal infrastructure may have allowed unauthorised withdrawals without a direct wallet private key leak.
The coordinated freezing of approximately $3 billion in assets demonstrates the importance of industry-wide cooperation in cryptocurrency investigations. However, the final recovery amount, the identities of the perpetrators and the precise attack method remain subject to investigation.
Binance’s commitment to cover all losses provides reassurance to customers, but the exchange’s long-term credibility will depend on restoring withdrawals safely, publishing an updated proof of reserves and providing a transparent technical explanation.
The incident should be viewed as a major security breach under investigation, rather than proof that customer funds have been permanently lost or that all affected assets have been recovered. The final technical report, independently verifiable recovery figures and the restoration of normal services will be the most important developments to watch.
