Summary
Binance security incident updates (Oct 30-31);SecurityWeek. Information only — not investment advice.
What this means for you
Binance says it will cover all losses from its SAFU fund and company funds, that user funds are safe, and that deposits are operating normally while withdrawals remain paused for a security revamp. On Oct 31 it said about 90% of the stolen crypto had been replenished, with a new proof-of-reserves snapshot showing coverage of 100% or more for the main assets. Stablecoin issuers froze about $2.7 billion in stolen stablecoins, and Arbitrum's Security Council froze ETH and ARB — roughly $3 billion frozen in total by Binance's later count. The attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond the reach of issuer freezes. Binance's initial finding is narrower: the incident "may involve a compromised DevOps engineer's laptop," which let the attacker reach a service container and submit unauthorized withdrawal transactions.
An attacker drained about $6.36 billion from Binance hot wallets on Thursday, October 29, in what blockchain intelligence firm TRM Labs calls the largest crypto theft on record — roughly four times the $1.5 billion Bybit hack of February 2025. Binance's own estimate of the total impact is about $6.3 billion.
Most of the money moved within about 20 minutes starting at 20:05 UTC, across ten blockchains including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana. On Ethereum, TRM says, the attacker used a single transaction carrying 50 pre-signed EIP-7702 authorizations to hand a Binance hot wallet over to a sweeper contract it controlled. In TRM's assessment, the pattern points to a compromise of Binance's hot wallet signing infrastructure.
Binance's initial finding is narrower: the incident "may involve a compromised DevOps engineer's laptop," which let the attacker reach a service container and submit unauthorized withdrawal transactions. The exchange says it has found no evidence that any wallet private key leaked. In a later update, Binance said investigators had found additional breach points, and co-CEO Richard Teng stressed the attacker "did not simply use one engineer's permissions." A full technical post-mortem has been promised but not yet published.
TRM Labs attributes the theft to TraderTraitor, North Korea's state hacking unit, with high confidence, and Chainalysis reached the same assessment. Binance has not named a culprit, and no government has formally attributed the attack. Asked about North Korea on Oct 31, President Trump said "we don't know" and that the government is "looking at that."
Stablecoin issuers moved fast: Tether, Circle, Ripple and World Liberty Financial froze about $2.7 billion in stolen stablecoins, and Arbitrum's Security Council froze ETH and ARB — roughly $3 billion frozen in total by Binance's later count. The attacker still holds more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond the reach of issuer freezes. Binance says it will cover all losses from its SAFU fund and company funds, that user funds are safe, and that deposits are operating normally while withdrawals remain paused for a security revamp. On Oct 31 it said about 90% of the stolen crypto had been replenished, with a new proof-of-reserves snapshot showing coverage of 100% or more for the main tokens; the full cryptographic proof is expected Nov 3.
What ordinary users should do: if you hold funds on any exchange, turn on withdrawal address allowlisting and app- or hardware-key two-factor authentication, and expect a wave of phishing riding this news — Binance will not email you asking for credentials. If you run servers or deployment pipelines, this is the lesson of the incident: the machines and people with deployment access are the highest-value target. Separate admin devices, hardware security keys and no shared credentials are the baseline.
This is a developing story. Figures are as of Oct 31, 2026, per the sources below, and may change.
Sources: TRM Labs; Binance security incident updates (Oct 30-31); CoinDesk; SecurityWeek. Information only — not investment advice.
Join the discussion
Have you ever had withdrawals paused on an exchange you use, and how did it affect your ability to access funds?
