Binance Freezes $3B After Hack as Withdrawals Stay Halted

Binance said a cyberattack against its systems resulted in an estimated $6.3 billion in economic impact, with roughly $3 billion in related assets frozen and withdrawals suspended as a precaution while security reviews proceed. The company confirmed the figure in an update dated Friday, October 30, 2026.

Tether CEO Paolo Ardoino said his firm froze about $1.6 billion tied to a possible attack on Binance. Circle CEO Jeremy Allaire said Circle blocked more than $800 million in USDC. Binance has frozen roughly $3 billion and is working with blockchain analytics firms, digital asset issuers and authorities to track more funds. Bitcoin fell to its lowest level in six weeks before recovering part of the decline, Ether hit its lowest quote in two months, and BNB dropped about 6.1%.

Binance stated that customer funds are secure and that the company will absorb all losses from the incident using resources from the SAFU protection fund and company capital. The exchange also said it will publish an updated Proof of Reserves once the process of correcting vulnerabilities is finished. Withdrawals remain suspended while checks continue.

The initial investigation points to the compromise of a DevOps engineer's laptop. According to Binance, that access would have allowed entry to a services container and the submission of withdrawal transactions without authorization. The company said it has found no evidence that private keys for its wallets were exposed. The investigation continues and has identified additional points of vulnerability, which expanded the scope of the inquiry beyond the initial account of a compromised computer.

TRM Labs found a high level of confidence that the operation would have been organized by TraderTraitor, a hacking group linked to North Korea. The firm pointed to similarities with other cryptocurrency thefts attributed to that country, based on on-chain and off-chain data. TraderTraitor has been connected to the Lazarus Group, which has been linked to various high-profile cyberattacks. The identity of those responsible for the Binance incident has not been officially confirmed.

Binance said it is working with law enforcement agencies and blockchain intelligence companies to trace the assets and identify those responsible. The exchange has suspended withdrawals to complete security checks, revoke authorizations tied to affected addresses and prevent new unauthorized operations. Withdrawals were expected to resume within 48 hours, a timeline communicated during the incident and not a guarantee of restoration. Binance stated it will cover all losses from company resources and the SAFU fund, so clients will not bear the cost of the incident. No public accounting of all assets involved exists yet.