What we all know concerning the Binance hack:
- Binance says the estimated complete impression is round $6.3 billion and the verified complete worth of crypto frozen is $3 billion. This might improve as investigators hint further belongings.
- Binance says deposits are working usually, and withdrawals are anticipated to renew inside 48 hours.
- Property frozen embrace Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Monetary USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Greenback (USDP) and Arbitrum (ARB).
- Cybersecurity analysts suspect North Korea’s TraderTraitor is behind the assault.
- Binance says investigators have uncovered further factors of breach after initially pointing to a doubtlessly compromised engineer’s laptop computer.
- Binance says it has put aside greater than $6.34 billion in firm funds to cowl losses, together with $5 billion already held in the identical tokens stolen.
Oct. 30 at 2:34 pm UTC
Binance targets withdrawals inside 40 hours, reserves report by Monday
Binance is aiming to renew withdrawals inside 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng mentioned.
Teng mentioned the trade hopes to revive entry earlier than its Sunday deadline and supply an preliminary reserves snapshot forward of Monday’s report.
Teng additionally disclosed that the attacker used a “self-destruct mechanism” to destroy instruments and traces in the course of the breach, complicating the investigation.
The attacker used an EIP-7702 delegation to achieve execution authority over a sizzling pockets, Teng mentioned. That delegation “didn’t move via our regular approval controls.”
Oct. 30 at 1:57 pm UTC
Aave lifts precautionary freeze throughout all V3 and V4 markets
New deposits and borrowing have resumed throughout all Aave V3 and V4 markets after a precautionary freeze following the Binance hack, the lending protocol mentioned.
Withdrawals and repayments remained accessible all through the freeze. Aave mentioned its contracts had been unaffected by the incident.
Founder Stani Kulechov confirmed that lending and borrowing had been re-enabled, saying all positions remained overcollateralized.
Oct. 30 at 1:11 pm UTC
Binance working with FBI to get well belongings following $6.3B hack
Binance is working with the FBI to assist get well a number of the funds stolen within the report $6.3 billion exploit, in line with a supply acquainted with the matter mentioned.
The cryptocurrency trade revealed its cooperation with legislation enforcement in an X put up, with out specifying the companies concerned.
Oct. 30 at 12:41 pm UTC
Binance says it holds $5B in matching tokens to cowl hack losses
A Binance spokesperson instructed Cointelegraph that the $5 billion in matching tokens is held within the trade’s custody.
The spokesperson declined to reveal pockets addresses, citing safety causes. Binance didn’t disclose when it acquired the belongings.
The trade additionally mentioned it submits weekly studies on firm funds to Abu Dhabi’s Monetary Providers Regulatory Authority beneath a requirement that predated the hack.
Oct. 30 at 11:07 am UTC
Yi He says Binance is shopping for altcoins to switch stolen tokens
Binance is shopping for altcoins in portions matching these stolen within the hack because it prepares up to date proof of reserves, co-CEO Yi He mentioned.
The purchases are being made via over-the-counter offers and on exchanges, she mentioned.
Binance’s SAFU fund and firm holdings embrace substantial quantities of Bitcoin and Ether, Yi He mentioned. The trade would offer one other replace as soon as the purchases had been full.
Oct. 30 at 11:00 am UTC
EIP-7702 might have helped Binance hackers bypass safety checks
Attackers may have stolen Binance’s funds with out Ethereum’s EIP-7702 improve, however it might have helped them bypass safety checks, Blockaid CEO Ido Ben-Natan instructed Cointelegraph.
Ben-Natan mentioned compromised signing methods doubtless enabled the assault. EIP-7702 supplied “a manner to do that in a single sweep,” whereas attackers in any other case would have wanted a number of transactions.
Ambire CEO Ivo Georgiev additionally mentioned the funds may have been stolen via different strategies. He warned that trade engineers may overlook the necessity to revoke malicious EIP-7702 delegations after regaining management of their methods.
Oct. 30 at 10:55 am UTC
Binance says it reserved $6.34B in firm funds for hack losses
Binance has set apart greater than $6.34 billion in firm funds to cowl losses from the hack, the trade mentioned.
The corporate mentioned $5 billion of these funds had been already held in the identical tokens affected by the assault. It was buying the remaining belongings via market and over-the-counter transactions to deal with token shortfalls.
Some purchases may take longer due to low liquidity and OTC settlement instances, Binance mentioned.
The allocation excludes frozen or protected belongings. About $3 billion remained frozen, with efforts to get well these funds persevering with alongside legislation enforcement and business companions.
Oct. 30 at 10:09 am UTC
Binance hackers could also be automating laundering, Chainalysis says
The attackers behind Binance’s hack could also be utilizing automation to maneuver and redistribute stolen funds, blockchain analytics firm Chainalysis mentioned.
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the corporate mentioned.
“Hundreds of transactions in a brief interval recommend that the attackers are utilizing automation to obscure the path of funds.”
Chainalysis mentioned funds repeatedly circulated amongst addresses, generally returning to wallets used earlier within the sequence.
Oct. 30 at 08:37 am UTC
Binance finds further breach factors in hack investigation
Binance’s investigation into its $6.3 billion hack has uncovered “further factors of breach,” the trade mentioned, after initially pointing to a doubtlessly compromised laptop computer.
The trade mentioned it was nonetheless gathering information in coordination with legislation enforcement.
Binance mentioned it remained on observe to renew withdrawals in 45 hours, whereas deposits remained unaffected. Outflows from the trade stopped when it paused withdrawals, it mentioned.
Oct. 30 at 07:37 am UTC
Teng says Binance hack was not a single “one-click” motion
The attacker behind Binance’s $6.3 billion hack didn’t merely use one engineer’s permissions to hold out the breach, co-CEO Richard Teng mentioned.
In an X put up, Teng mentioned the incident concerned “a extra advanced assault course of” and was not a single “one-click” motion.
“Our investigation has not attributed accountability to any particular person,” he wrote.
Teng reiterated that preliminary findings pointed to a compromised DevOps engineer’s laptop computer, which can have allowed the attacker to entry an inner service and submit unauthorized withdrawals. He mentioned investigators had discovered no proof of a pockets private-key leak.
Binance would cowl all losses utilizing its SAFU fund and firm funds, he mentioned.
Oct. 30 at 05:01 am UTC
Analysts suspect North Korean group behind Binance hack
Chainalysis co-founder and CEO Jonathan Levin mentioned the Binance hack was doubtless carried out by North Korean hacking group TraderTraitor, citing hyperlinks to a earlier hack.
In a put up on X, Levin put the theft at $6.4 billion, barely above Binance’s estimated $6.3 billion impression. He mentioned business companions had frozen roughly $3 billion and Chainalysis was persevering with to trace the funds.
In a separate put up, onchain investigator ZachXBT mentioned the stolen funds from the Binance assault and the sooner Bitget exploit had been commingled in the identical deal with on Friday, after arriving through THORChain.
“This means the identical actor is probably going behind each incidents,” he mentioned.
“The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with different earlier exploits comparable to Kelp DAO,” he added.
Chatting with Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan additionally mentioned the assault resembled the work of North Korea, or DPRK, primarily based on the delicate onchain preparations, buyer sweeper contract and a number of authorizations.
TRM Labs has additionally attributed the assault to TraderTraitor with “excessive confidence,” which it mentioned is “primarily based on sturdy on and off-chain intelligence.”
TraderTraitor has additionally been named by the FBI as the identical group chargeable for the ByBit hack in February final yr.
Oct. 30 at 4:17 am UTC
Binance expects withdrawals to renew inside 48 hours
Binance mentioned withdrawals stay paused whereas it completes a safety revamp of its withdrawal service and associated addresses, with service anticipated to renew inside 48 hours. Deposits are working usually.
The trade mentioned the incident concerned a number of elements and that its safety staff was tracing the complete assault path via a compromised laptop, which they believe to be the entry level.
Oct. 30 at 03:49 am UTC
Binance hack may speed up shift to DEXs: Normal Chartered
The Binance hack may push extra crypto buying and selling towards decentralized exchanges and profit Uniswap over the long run, in line with Normal Chartered’s world head of digital belongings analysis, Geoffrey Kendrick.
In an electronic mail shared with Cointelegraph, Kendrick retained his $100 worth goal for Uniswap’s UNI token by 2030, saying the breach was “another excuse why that forecast might find yourself being too low.”
CoinGecko analysis exhibits that the highest 10 spot DEX-to-CEX ratio was 23.5% within the second quarter of 2026, climbing 2.1 share factors from the primary quarter of 2026.
“I might encourage buyers to re-engage with Uniswap,” mentioned Kendrick. “The decentralized trade (DEX) has by no means had any exploits, and the hack of the biggest centralized trade (CEX), in Binance, ought to see the ratio of DEX to CEX buying and selling proceed to extend.”
Oct. 30 at 02:25 am UTC
Binance factors to engineer’s hacked laptop computer in $6.3B breach
Binance mentioned its preliminary investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop computer.
The trade mentioned the laptop computer compromise might have allowed an attacker to entry a service container and submit unauthorized withdrawal transactions. It mentioned it had discovered no proof of a pockets private-key leak, although its investigation stays ongoing.
The crypto trade has additionally disclosed that the estimated complete impression of the hack is $6.3 billion.
Oct. 30 at 02:21 am UTC
First Digital confirms it has frozen FDUSD concerned in assault
First Digital CEO Vincent Chok mentioned it has frozen the FDUSD stolen within the assault on Binance.
“We’re working alongside the Binance staff and can share updates as we now have them,” Chok instructed Cointelegraph in a written assertion.
“Our precedence is defending FDUSD holders and stopping dangerous actors from transferring stolen funds. Defending customers is a accountability all of us share.”
Oct. 30 at 01:19 am UTC
Bitcoin trades under $77,000 as BNB falls 8%
Bitcoin traded close to $76,937, down 4.9% over 24 hours, in line with CoinGecko. BNB fell 8% to about $693, whereas Ether declined 5.7% to about $2,211.
DeFi tokens additionally fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the identical interval.
The Bitcoin Concern and Greed Index, which tracks Bitcoin market sentiment, fell to “concern” with a rating of 30, which it has not seen since August.
Oct. 30 at 12:52 am UTC
Binance says $3 billion frozen from hack
Binance mentioned the present verified quantity of belongings frozen from the hack is now $3 billion.
The replace got here after the Arbitrum Safety Council mentioned it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and eight,425 Ether (ETH).
“The Safety Council acted by weighing its dedication to the safety and integrity of the Arbitrum group and Arbitrum governance with out impacting any Arbitrum customers or purposes,” it mentioned.
“As of October 30, 2026 time, the funds have been efficiently transferred to an middleman frozen pockets,” it mentioned.
The funds will not be accessible to the deal with that initially held the funds and might solely be moved by additional motion of the Safety Council or a vote of Arbitrum DAO governance, it added.
Oct. 30 at 12:26 am UTC
Chainalysis estimates $5.9 billion stolen from Binance
Chainalysis mentioned its present estimate of the quantity stolen from Binance is $5.912 billion on the time of theft, 4 instances the quantity stolen from crypto trade Bybit in 2025.
Binance earlier mentioned the verified complete frozen is $2.54 billion.
Oct. 30 at 12:26 am UTC
Blockaid suspects Binance hack concerned personal key “misuse”
The suspected multi-billion-dollar Binance hack might have concerned attackers manipulating the trade’s transaction-signing signature, in line with Blockaid co-founder and CEO Ido Ben-Natan.
Chatting with Cointelegraph, Ben-Natan mentioned Blockaid’s preliminary evaluation pointed to “key misuse,” during which attackers trick or compromise a signing system into authorizing malicious transactions with out extracting the underlying personal key.
“It appears to be… a compromise of signing infrastructure. We don’t assume a key was leaked,” he mentioned.
Ben-Natan mentioned this was a preliminary evaluation, drawing on their expertise with related assaults and their observations of the onchain exercise.
Arkham CEO Miguel Morel mentioned the assault seems to be ongoing.
Oct. 30 at 12:07 am UTC
Binance says deposits briefly suspended
Binance mentioned it has briefly suspended deposits because it conducts safety checks, freezes funds and coordinates with legislation enforcement. It beforehand confirmed it had suspended withdrawals.
“We’re working across the clock and can share a full autopsy as soon as the investigation is full,” the corporate mentioned, including it can “cowl all losses.”
Earlier, Binance additionally mentioned it had briefly suspended Binance Alpha buying and selling.
Oct. 30 at 12:07 am UTC
Wintermute and GSR disclose Binance publicity
Crypto buying and selling companies Wintermute and GSR disclosed publicity to Binance however mentioned they didn’t count on main disruption to their companies.
The companies are market makers, which place purchase and promote orders on exchanges to assist different merchants full transactions. A disruption to their operations may make buying and selling tougher or costlier throughout crypto markets.
GSR CEO Xin Track mentioned its Binance publicity was lower than 5% of its web fairness, which means the worth of its belongings minus its liabilities. He mentioned GSR was working with Binance to know the incident and establish methods to assist.
Wintermute CEO Evgeny Gaevoy mentioned his agency’s publicity was lower than 20% of web fairness and that he didn’t count on operational disruption.
Neither government disclosed a greenback quantity for the publicity or confirmed monetary losses.
Oct. 29 at 11:40 pm UTC
Ripple freezes RLUSD linked to Binance hack
Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, in line with Jack McDonald, the corporate’s senior vice chairman of stablecoins.
McDonald mentioned Ripple was “actively freezing affected funds” and coordinating with related events to assist the investigation. He didn’t disclose the quantity frozen.
Oct. 29 at 11:35 pm UTC
Binance says $2.54 billion frozen after hack
Binance mentioned the verified complete of belongings frozen in reference to the hack had reached $2.54 billion, clarifying differing figures circulating publicly, together with references to $1.8 billion.
The trade mentioned the entire may improve as its groups work with legislation enforcement, issuers, blockchain intelligence companies and business companions to hint and freeze further belongings. Binance mentioned it will publish additional figures as soon as verified.
Oct. 29 at 10:36 pm UTC
World Liberty Monetary freezes $27 million in USD1
World Liberty Monetary has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million value of WLFI, in line with Binance co-founder Yi He.
“USD1 has taken proactive steps to freeze the $27 million in USD1 related to the Binance hack,” mentioned World Liberty Monetary co-founder and CEO Zach Witkoff.
World Liberty Monetary mentioned it labored with BitGo to freeze the stolen WLFI and USD1 funds.
“We’ll cooperate totally with the continuing investigation and assist efforts to carry these accountable accountable. Defending our customers stays a high precedence,” mentioned World Liberty in a put up on X.
Oct. 29 at 10:33 pm UTC
Binance says withdrawals will resume as soon as points resolved
Binance says its staff is conducting safety checks and can resume withdrawals as quickly because the “safety problem” is resolved.
Oct. 29 at 10:32 pm UTC
Aave freezes markets after Binance exploiter borrows $44.6 million
Decentralized lending protocol Aave froze markets throughout its V3 and V4 deployments as a precaution following the Binance hack.
In a governance discussion board replace posted after the freeze, threat service supplier LlamaRisk mentioned the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), value about $44.6 million on the time.
The borrowing occurred between 8:58 pm and 9:01 pm UTC on Oct. 29, about 40 minutes earlier than the primary freeze. It was the exploiter’s solely Aave place throughout all networks and variations, with no additional interactions detected after 9:01 pm UTC.
The place remained backed by $59.9 million in USDT collateral in opposition to $43.8 million in debt on the replace’s snapshot. LlamaRisk mentioned it remained topic to regular liquidation and didn’t put Aave suppliers in danger.
The freezes coated 175 reserves on V3 throughout 16 networks and 117 reserves on V4 throughout 4 networks.
Customers can nonetheless withdraw funds and repay loans, and liquidations proceed. Nonetheless, the freeze prevents new deposits and borrowing, together with further collateral deposits, leaving compensation as the one manner to enhance an current place’s well being issue.
LlamaRisk mentioned markets would stay frozen till the exploiter’s funds stopped transferring and Binance supplied higher readability on containment, adopted by a staged reopening. It warned {that a} extended freeze may push borrowing charges increased as withdrawals scale back accessible liquidity.
Oct. 29 at 9:15 pm UTC
Binance investigates multibillion-dollar safety breach
Binance is investigating a possible multibillion-dollar safety breach involving certainly one of its Ethereum wallets, after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions in belongings.
A Binance spokesperson instructed Cointelegraph on Thursday that the trade was investigating studies of a possible safety problem however had not confirmed any impression on person funds. The spokesperson mentioned its safety groups had been reviewing the exercise and would offer updates as soon as extra data was verified.
Considerations had been first raised by blockchain researcher Spreek, who posted on X that belongings from a Binance-linked Ethereum pockets had been transferred to a newly created deal with via a contract name allegedly funded by Twister Money. Spreek later reported that wallets related to the transfers had begun promoting Tether USDt (USDT) via decentralized exchanges.
Blockchain analytics platform Arkham Intelligence later recognized a group of wallets labeled “binance-hacker-1029” holding roughly $5.84 billion in digital belongings. The determine represents the wallets’ reported holdings moderately than a confirmed estimate of stolen funds.
Binance co-founder Changpeng Zhao mentioned the exercise gave the impression to be a hack, including that Tether and Circle had frozen roughly $971 million and $823 million, respectively. Zhao mentioned he anticipated all person funds to be totally coated.
Tether, Circle freeze over $2.36 billion
Blockchain safety agency Blockaid mentioned its staff had recognized roughly $3.3 billion in suspicious transfers involving Binance-linked wallets throughout Ethereum, Arbitrum and Avalanche.
Shortly after information of the hack emerged, Tether and Circle, the 2 largest stablecoin issuers by market capitalization, mentioned that they had frozen a mixed $2.36 billion in tokens linked to the suspected incident.
Circle CEO Jeremy Allaire mentioned the corporate had frozen greater than $800 million in USDC in coordination with legislation enforcement and would proceed supporting the investigation.
A couple of minutes later, Tether CEO Paolo Ardoino mentioned the corporate had frozen greater than $1.567 billion in USDT linked to the potential exploit.
“Defending the business and our companions is our important precedence,” Ardoino wrote.
The Binance hack got here hours after Polymarket briefly halted buying and selling following a compromise at a third-party supplier. The prediction market platform mentioned it had fastened the problem and pledged to reimburse affected customers, with all methods reported operational by 7:05 p.m. UTC Thursday.
Reporting by Felix Ng, Bryan O’Shea and Nate Kostar.
