Overview Binance lost control of assets held in its hot wallets on October 29, 2026, in an incident the exchange estimates at around $6.3 billion, the largest crypto theft on public record. As of 07:0Overview Binance lost control of assets held in its hot wallets on October 29, 2026, in an incident the exchange estimates at around $6.3 billion, the largest crypto theft on public record. As of 07:0

Binance Security Incident: $6.3B Funds Flow, Confirmed Facts, and Withdrawal Status

#Trending Topics

NOT$0.0003544-6.54%

FLOW$0.023-9.66%

MOVE$0.006134-6.87%

Author: James Mitchell

2026/10/30 16:10

Overview

Binance lost control of assets held in its hot wallets on October 29, 2026, in an incident the exchange estimates at around $6.3 billion, the largest crypto theft on public record. As of 07:00 UTC on October 30, withdrawals remain suspended, with Binance saying it expects to begin restoring them within 48 hours, while deposits are operating normally according to the exchange's latest service update. Roughly $3 billion in related assets has been frozen on-chain, and no assets have been publicly recorded as recovered and returned to the exchange. Binance has said it will cover all losses from its SAFU fund and company funds.

The technical path differs from most exchange thefts. On Ethereum, the outflow ran through a single EIP-7702 delegation: the attacker never obtained the wallet's private key, but instead made the hot wallet execute a sweep under a contract of the attacker's own deployment. Binance's initial investigation reports no evidence of a private key leak and points instead to a compromised DevOps engineer's laptop.

Key Takeaways

Item	Status
Official estimate of impact	About $6.3 billion, per Binance's statement at 02:25 UTC on October 30
Frozen on-chain	About $3 billion, per Binance's update at 00:52 UTC on October 30
Recovered and returned to the exchange	No public record as of 07:00 UTC on October 30
Still under the attacker's control	About $2.4 billion, mostly BTC and ETH, per TRM Labs as of 00:30 UTC
Withdrawals	Suspended, with Binance's 04:17 UTC update expecting resumption to begin within 48 hours
Deposits	Unaffected and operating normally, per Binance's 04:17 UTC update
Loss coverage	Binance says the SAFU fund and company funds will cover all losses
Initial official finding	Possibly involving a compromised DevOps engineer's laptop, with no evidence of a wallet private key leak
Attribution	TRM Labs points with high confidence to the North Korean group TraderTraitor; no law enforcement determination has been made

Incident Timeline

On-chain records, research-firm assessments and official statements advanced at different speeds through this incident. The table below places them on one clock and labels what each entry is. All times are UTC.

Time (UTC)	Development	Nature
10/29 20:05	First anomalous transfers appear on the XRP Ledger	On-chain record
10/29 20:20	A Bitcoin wallet is emptied; an EIP-7702 delegation transaction carrying 50 authorizations is submitted on Ethereum	On-chain record
10/29 20:24	About 3 minutes 24 seconds after the delegation takes effect, the main wallet is swept, moving 167,464 ETH and 63 tokens including 1.615 billion USDT in a single transaction	On-chain record
10/29 21:01	Tether freezes 971.1 million USDT	Issuer action
10/29 21:04	Circle freezes 823 million USDC	Issuer action
10/29 22:01	Ripple begins freezing RLUSD tied to the incident	Issuer action
10/29 22:10	World Liberty Financial freezes 27.8 million USD1	Issuer action
10/29 22:15	Binance suspends withdrawals	Exchange action
10/29 22:32	Aave freezes its V3 and V4 markets after the attacker borrows about $44.6 million against stablecoin collateral	Protocol action
10/29 23:05	A second wave of transfers appears on Avalanche and Polygon	On-chain record
10/29 23:35	Binance reports $2.54 billion in verified frozen assets	Official figure
10/30 00:07	Binance suspends deposits and says it will cover all losses	Exchange action
10/30 00:08	The Arbitrum Security Council forces assets out of the attacker's wallet	On-chain governance action
10/30 00:26	Blockaid assesses the cause as key misuse within signing infrastructure rather than a leaked private key; Chainalysis estimates about $5.912 billion stolen at the time of theft	Research assessment
10/30 00:52	Binance reports verified frozen assets of about $3 billion	Official figure
10/30 02:21	First Digital freezes the FDUSD taken in the incident, without disclosing an amount	Issuer action
10/30 02:25	Binance publishes initial findings pointing to a compromised DevOps engineer's laptop and states it found no evidence of a wallet private key leak	Official figure
10/30 04:17	Binance issues a service update saying withdrawals stay paused until its team completes a security revamp of the withdrawal service and related addresses, that it expects resumption to begin within 48 hours, and that deposits remain unaffected and are operating normally	Official figure

Two threads in that sequence deserve separate attention. Issuer freezes preceded the exchange's service suspension: Tether and Circle completed their first round within roughly forty minutes of the main sweep, while withdrawals were not halted until 22:15 UTC. And the language used by Binance executives shifted over the first hours, with co-CEO Yi He becoming the first senior figure to use the word exploit in a post at 00:24 UTC on October 30, while the corporate account had until then described a potential security issue.

The Figures: Outflow, Frozen, Unfrozen and Recovered

Published totals run from $3.3 billion to $6.36 billion. Three things account for the spread: how many chains a tally covers, what price the assets were valued at, and whether the number measures outflow or the balance sitting in the attacker's wallets.

Basis	Amount	Source and timestamp
Official estimate of impact	About $6.3 billion	Binance statement, 02:25 UTC October 30
Outflow across ten chains, priced at the time of transfer	About $6.36 billion	TRM Labs, October 29
The same assets revalued at prevailing market prices	About $6.23 billion	TRM Labs, October 29
Estimated stolen, priced at the time of theft	About $5.912 billion	Chainalysis, 00:26 UTC October 30
Estimated outflow	About $5.3 billion	Glassnode
Combined outflow across Ethereum, Bitcoin and Tron	At least $5.57 billion	Decrypt tally
Suspicious transfers across Ethereum, Arbitrum and Avalanche	About $3.3 billion	Blockaid
Value held in the attacker's wallets at one point	More than $5.84 billion	Arkham Intelligence, 21:19 UTC October 29
Frozen on-chain	About $3 billion	Binance update, 00:52 UTC October 30
Still under the attacker's control	About $2.4 billion, including more than 420,000 ETH and 18,270 BTC	TRM Labs, as of 00:30 UTC October 30
Recovered and returned to the exchange	No public record	As of 07:00 UTC October 30

How the frozen assets break down

TRM Labs' tally as of 00:30 UTC on October 30 splits the frozen total into about 1.77 billion USDT at Tether, about 825 million USDC at Circle, 40.5 million RLUSD at Ripple, 27.8 million USD1 at World Liberty Financial, and 8,426 ETH plus 74.6 million ARB handled by the Arbitrum Security Council, coming to roughly $2.7 billion. Binance's verified figure of about $3 billion was published twenty-two minutes later, so the gap between the two reflects the timestamp rather than a conflict in basis. First Digital froze the FDUSD involved at 02:21 UTC without disclosing an amount, and that portion is not included in the breakdown above.

Frozen is not recovered

Frozen assets sit on an issuer's contract blacklist. They are out of the attacker's reach and also absent from the exchange's books. Returning them requires the issuer to reissue the tokens or a court-ordered transfer, a step that took months in the February 2025 Bybit case, where $48.4 million of a $1.5 billion theft was ultimately recovered. On Binance's own figures, the frozen amount equals roughly 48% of the estimated impact, and the remainder is concentrated in Bitcoin and Ether, assets with no central issuer and therefore no comparable freeze mechanism.

What the attacker did before the freezes landed

TRM Labs recorded the attacker selling about 325 million USDT to market makers at a discount of more than 10% for roughly 122,300 ETH before issuer freezes took effect, borrowing ETH against USDT collateral on Aave, and moving funds through Tron lending markets and Uniswap swaps. That sequence converted freezable centralized stablecoins into native assets that cannot be frozen, which is the direct reason the remaining $2.4 billion sits in BTC and ETH.

The Attack Path

The EIP-7702 delegation on Ethereum

EIP-7702 arrived with Ethereum's Pectra upgrade in May 2025 and lets an ordinary account authorize a smart contract to act on its behalf. According to analysis from TRM Labs and Blockaid, the attacker's delegation transaction carried 50 pre-signed authorizations covering 50 consecutive transaction counts, ensuring one would be valid at execution. Once the delegation took effect, Binance's hot wallet performed the sweep under the attacker's contract logic, with the whole process completing about three and a half minutes later. The contract had been deployed earlier the same day, and an associated address was funded through small withdrawals from a mixing service.

That mechanism explains how no private key leak and an emptied wallet can both be true. The delegation itself requires a valid signature from the wallet, but the attacker needed only to have a signature request approved, never to touch the key. Blockaid characterized the incident on that basis as key misuse within signing infrastructure.

The other nine chains cannot be explained by the same mechanism

TRM Labs' tally covers ten chains: about $3.79 billion on Ethereum, comprising 200,630 ETH and about 1.875 billion USDT; 18,270 BTC worth about $1.47 billion; about $628 million on Tron; 233.46 million XRP worth about $296 million on the XRP Ledger; 970,500 SOL worth about $96 million on Solana; about $39 million across Arbitrum, Optimism and Base; about $28 million on Avalanche; and about $10 million on Polygon. Outside Ethereum, every transfer was an ordinary signed transaction, and EIP-7702 does not apply on those chains. TRM Labs assesses the more likely explanation to be a compromise of Binance's hot wallet signing infrastructure as a whole.

The initial official finding

In its statement at 02:25 UTC on October 30, Binance said its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to reach a service container and submit unauthorized withdrawal transactions, and that it has found no evidence of any wallet private key leak. Binance said it has revoked the affected address authorization and will publish updated proof of reserves data after remediation, along with a full technical post-mortem. As of 07:00 UTC on October 30, that post-mortem has not been released.

Attribution

TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean group, citing on-chain and off-chain intelligence along with similarities to the February 2025 Bybit incident and the April 2026 KelpDAO incident in the use of small mixer withdrawals for funding and in pre-signed transactions. On-chain investigator ZachXBT and Blockaid have also pointed toward North Korea. No law enforcement agency has issued a formal determination.

What This Means for Users

Service status

Binance suspended withdrawals at 22:15 UTC on October 29 and deposits at 00:07 UTC on October 30. In a service update at 04:17 UTC on October 30, the exchange said withdrawals will stay paused until its team completes a security revamp of the withdrawal service and its related addresses, that it expects to begin resuming withdrawals within 48 hours, a window ending around 04:17 UTC on November 1, and that deposits remain unaffected and are operating normally. Binance's own notices at 00:07 UTC and 02:25 UTC had listed deposits as suspended, and the company has not addressed the difference between those statements and the 04:17 UTC update. As of 07:00 UTC on October 30, the withdrawal interruption has run about nine hours, and meeting the 48-hour window would put the total interruption at roughly 54 hours from the original suspension. Spot and futures trading have not been the subject of a suspension notice over the same period.

Loss coverage

Binance has said the SAFU fund and company funds will cover all losses and that user assets are safe. Founder Changpeng Zhao said on social media that as a shareholder he expects user funds to be fully covered, and that the loss may be somewhat higher than first reported. DefiLlama data put Binance's platform assets at about $144 billion before the incident, making the estimated impact roughly 4.4% of that. Wintermute chief executive Evgeny Gaevoy said Binance could absorb three to four times the current figure. Both Wintermute and GSR disclosed exposure to Binance, with GSR putting it below 5% of net equity and Wintermute below 20%, neither giving a dollar amount.

Market reaction

The market fell to a six-week low on the night of the incident. As of 01:19 UTC on October 30, Bitcoin traded at about $76,937, down 4.9% over twenty-four hours, Ether fell 5.7% to about $2,211, BNB fell about 8% to roughly $693, AAVE fell 11.3% and UNI fell 10.7%. Bitcoin touched an intraday low of about $76,650. Prices then recovered part of the decline, and CoinGecko data put Bitcoin at $78,518 as of 06:35 UTC on October 30, narrowing the twenty-four hour loss to 1.78%, with Ether at $2,245.53, down 2.79%, and BNB at $715.24, down 4.83%. CoinGlass recorded about $1.4 billion in leveraged liquidations across the market in the twenty-four hours after the incident, a figure that includes routine liquidations unrelated to it.

What Can Be Checked From Here

What proof of reserves answers

Proof of reserves uses a Merkle tree to let a user verify that their own balance is included in the liabilities an exchange reports, and sets those reported liabilities against assets visible on-chain. It answers a question about the correspondence between assets and liabilities at one point in time. It does not describe how signing permissions over hot wallets are managed, how operational endpoints are isolated, or when assets are replenished after an incident. Binance has said it will update its proof of reserves data once remediation is complete, and the timing and content of that update is the most direct checkable item to come out of this event. Readers who want to see how such disclosures are structured can look at the proof of reserves page published by MEXC.

Authorization attacks versus key leaks

For anyone holding an on-chain wallet, the detail worth carrying away is the separation between authorization and the key itself. Once an EIP-7702 delegation is signed, the contract can move assets under its established logic while the private key never leaves its original location. Reviewing a wallet for historical delegations and revoking those no longer needed is something a user can do independently of any exchange's internal controls.

Where funds sit

An exchange cannot process withdrawals while the service is suspended, which in this case has meant an interruption running about nine hours since 22:15 UTC on October 29, and potentially close to 54 hours on the resumption window the exchange has given. Separating holdings by purpose and location reduces the liquidity effect of any single platform's service interruption. This month's earn and campaign schedule is available on the MEXC campaign page.

Exclusive View from James Mitchell

What this incident changes is not the general knowledge that exchange hot wallets carry risk, but the specific shape of that risk. Most exchange thefts of the past decade reduce to mishandled private keys, which is why defensive work concentrated on key sharding, cold and hot separation, and multisignature thresholds. Here Binance reports no private key leak while the wallet was still emptied, because what the attacker obtained was the ability to have a signature request approved rather than the key. A system that is compliant on key management can still be penetrated in full through one compromised operational endpoint.

The point I think the industry should take more seriously is how decisively asset composition determined what could be salvaged. On figures from Binance and TRM Labs, the roughly $3 billion frozen was almost entirely centrally issued stablecoins, while the roughly $2.4 billion left with the attacker is concentrated in Bitcoin and Ether. The attacker's decision to dump USDT at a discount of more than 10% for ETH before freezes landed was a direct play on that asymmetry. Stablecoin issuers' freeze capability has become a substantive part of incident response, and that capability does not extend to native assets at all. The ratio of stablecoins to native assets in an exchange's hot wallets is therefore both a liquidity question and a question about what can be done after a breach.

One distinction should stay clear through the coming weeks: freezing is not recovery. The Bybit incident ended with $48.4 million of a $1.5 billion theft back on the platform, after months of issuer and judicial process. The amount frozen here is far larger than in any previous case, but moving assets from a blacklist back onto an exchange's books still requires reissuance or a court-ordered transfer. The right basis for judging the outcome of this event is Binance's updated proof of reserves data and its full technical post-mortem, not today's frozen total.

FAQ

When will Binance withdrawals resume?

In a service update at 04:17 UTC on October 30, Binance said it expects to begin resuming withdrawal services within 48 hours, a window ending around 04:17 UTC on November 1, and that withdrawals stay paused until its team completes a security revamp of the withdrawal service and related addresses. Withdrawals have been suspended since 22:15 UTC on October 29. As of 07:00 UTC on October 30 they have not resumed, and no staged reopening by network or asset has been announced.

Are deposits working now?

Binance's service update at 04:17 UTC on October 30 said deposits remain unaffected and are operating normally. The exchange's earlier notices at 00:07 UTC and 02:25 UTC had listed deposits as suspended, and Binance has not addressed the difference. Users should check the status on Binance's official announcement page before depositing.

Will users lose funds in this incident?

Binance has said the SAFU fund and company funds will cover all losses and that user assets are safe, and founder Changpeng Zhao said he expects user funds to be fully covered. DefiLlama data put platform assets at about $144 billion before the incident, making the estimated impact roughly 4.4% of that. Binance has not published details of the compensation mechanism or its timing.

Why do the reported theft figures differ so much?

Three reasons. Coverage differs, with Blockaid's $3.3 billion spanning only Ethereum, Arbitrum and Avalanche while TRM Labs' $6.36 billion covers ten chains. Pricing differs, with the same assets valued at $6.36 billion at the time of transfer and $6.23 billion at prevailing market prices. And the measured object differs, since Arkham Intelligence's $5.84 billion was the balance in the attacker's wallets at a moment in time rather than total outflow.

Does the $3 billion frozen mean it has been recovered?

No. Freezing places assets on an issuer's contract blacklist, where they cannot be moved but are also not back on the exchange's books. Returning them requires reissuance by the issuer or a court-ordered transfer. In the Bybit case, $48.4 million of a $1.5 billion theft was recovered, over a period of months.

What is EIP-7702, and are ordinary wallets exposed?

EIP-7702 arrived with Ethereum's Pectra upgrade in May 2025 and lets an ordinary account authorize a smart contract to act on its behalf. It is a protocol feature rather than a vulnerability. The risk is that an authorization stays effective once signed, allowing an attacker to move assets later under the contract's logic. Wallet holders can review and revoke delegations they no longer need.

Who carried out the attack?

TRM Labs points with high confidence to TraderTraitor, a North Korean group, citing on-chain and off-chain intelligence and similarities in method to the February 2025 Bybit incident and the April 2026 KelpDAO incident. On-chain investigator ZachXBT and Blockaid have also pointed toward North Korea. As of 07:00 UTC on October 30, no law enforcement agency has made a formal determination.

How much did this move crypto prices?

Bitcoin touched an intraday low of about $76,650 on the night of the incident, a six-week low. CoinGecko data put Bitcoin back at $78,518 as of 06:35 UTC on October 30, down 1.78% over twenty-four hours, with Ether at $2,245.53, down 2.79%, and BNB at $715.24, down 4.83%. CoinGlass recorded about $1.4 billion in leveraged liquidations across the market in the twenty-four hours after the incident, including routine liquidations unrelated to it.

Can proof of reserves show that an exchange has not been breached?

No. Proof of reserves verifies the correspondence between an exchange's reported liabilities and its on-chain assets at a point in time, and lets a user check that their own balance is included. It does not cover internal controls such as hot wallet signing permissions or endpoint isolation, and it does not show when assets were replenished after an incident.

Disclaimer

This article is for general information only and does not constitute investment, financial, legal or tax advice. Figures are current as of 07:00 UTC on October 30, 2026, and the incident is still developing, so amounts, service status and investigative conclusions may change with subsequent official disclosures. Crypto assets and leveraged products are highly volatile and can produce losses exceeding the initial outlay. Readers should verify the original disclosures and judge independently, consulting a qualified professional where appropriate.

About the Author

James Mitchell specializes in technical analysis, market trends, and trading strategies for both Bitcoin and altcoins. Based in London, he has over 10 years of experience in financial markets. Before joining MEXC Learn, James worked as a senior analyst at a leading European investment firm, where he developed expertise in risk management and quantitative trading. His transition to cryptocurrency markets began in 2017, and he has since become recognized for his data-driven approach. He holds a Master's degree in Financial Economics from the London School of Economics. His analytical approach combines traditional technical analysis with on-chain metrics to provide readers with actionable insights.

Areas of Expertise: Technical Analysis, Market Trends and Cycles, Trading Strategies, Bitcoin and Altcoin Analysis, Risk Management.

Research References

MEXC

Binance Official Statement on Initial Investigation Findings

TRM Labs North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History

CoinDesk Binance Loses Billions in Largest Crypto Hack to Date

Cointelegraph Live Updates Binance Hit by Largest Crypto Hack in History

Bitcoin.com Binance Releases First 6.3B Hack Findings Reports No Key Leak Evidence

Bitcoin.com Inside the 5.8B Binance Hack What Is Confirmed and What Is Not

TechCrunch Binance Pauses Withdrawals as Hackers Suspected of Stealing Billions in Crypto

FinanceFeeds Binance Withdrawals Expected Back Within 48 Hours

FinanceFeeds Binance Hack 6.3 Billion Traced to DevOps Laptop

FinanceFeeds Binance Hack 3 Billion Now Frozen

Want the fastest access to MEXC's latest updates? Join our official Telegram group now!

MEXC Platform: Download App | Zero Fee Trading | Buy USDT Now

Join MEXC Community: X (Twitter) | Telegram | Discord

Get Insights: MEXC Learn | Terms of Service | MEXC Blog | MEXC News

Account Verification: Understand KYC | How to Complete KYC

External Content Platforms: Substack | Medium | Paragraph | LinkedIn | X(News)

Market Opportunity

Notcoin Price(NOT)

$0.0003545

$0.0003545$0.0003545

USD

Notcoin (NOT) Live Price Chart

The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to James Mitchell. If you believe any content infringes upon the rights of a third party, please contact service@support.mexc.com for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.