Binance has disclosed an estimated $6.3 billion security incident, potentially the largest cryptocurrency exchange hack on record, after unauthorized withdrawals triggered emergency asset freezes and a temporary suspension of deposits and withdrawals.
In an official update on October 30, 2026, Binance said its preliminary investigation suggested a compromised DevOps engineer's laptop allowed an attacker to access an internal service container and submit unauthorized withdrawal transactions. The company found no evidence of leaked wallet private keys. Approximately $3 billion in affected assets had been frozen on-chain through cooperation with blockchain networks, token issuers and security partners. Binance pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company funds, maintaining that user funds are safe.
Suspicious transfers emerged on October 29, when blockchain investigators identified large cryptocurrency movements from Binance-controlled wallets. Tether froze about $1.57 billion in USDT linked to the incident, while Circle restricted more than $800 million in USDC. Binance revoked affected address authorizations, suspended deposits and withdrawals, and engaged law enforcement and blockchain intelligence firms to trace the remaining assets. The exchange has not confirmed the attackers' identities, though cybersecurity firms reportedly examined possible connections to North Korean-linked hacking operations.
Market reaction was sharply negative. Bitcoin fell to around $76,470 and Ethereum declined toward $2,186 on October 30, according to Reuters. CoinDesk reported that one compromised wallet, identified as Binance 14, had appeared in Binance's October 1 proof-of-reserves disclosures, with roughly 204,500 ETH removed from wallets associated with customer backing. Based on that earlier snapshot, Ethereum backing could temporarily fall to about 94% if Binance had not replaced the assets.
The estimated impact exceeds the roughly $1.5 billion stolen from Bybit in February 2025. Frozen tokens are not equivalent to recovered funds, and Binance has promised an updated proof-of-reserves report after remediation. The immediate priorities are restoring normal withdrawal operations, determining the precise cause of the breach and confirming that customer assets remain fully backed.
