Key Notes
- TRM estimates $6.36 billion was stolen across ten blockchains, making the Binance incident the largest crypto theft on record.
- Binance puts the impact at around $6.3 billion, says about $3 billion is frozen and promises to cover all losses using SAFU and company funds.
- Withdrawals remain paused with a 45-hour reopening target in the latest update, as Binance identifies additional breach points while deposits operate normally.
Binance faces the biggest cryptocurrency theft on record after blockchain investigator TRM Labs estimated that attackers drained $6.36 billion from its wallets. The exchange puts the impact at around $6.3 billion and says it will cover all losses using its SAFU emergency fund and company funds.
The incident dwarfs the approximately $1.5 billion Bybit theft of February 2025. At Binance’s rounded estimate, it is about 4.2 times that earlier attack, turning a security alert into an exceptional test of exchange custody, liquidity and customer confidence.
Binance’s newest investigation update says additional breach points have emerged beyond the initially suspected laptop compromise. Withdrawals remain paused, deposits are unaffected, and the company says it is working toward reopening withdrawals in 45 hours. That is its stated target, rather than confirmation that access has been restored.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
— Binance (@binance) October 30, 2026
A $6.3 Billion Attack Rewrites Crypto’s Record Books
TRM’s analysis traces outflows across ten blockchains at transfer-time prices. It says most were taken in about 20 minutes on October 29.
The firm’s $6.36 billion estimate and Binance’s $6.3 billion impact figure describe the same incident. They are not separate losses to add together, and subsequent movements in token prices can change the value of the assets being tracked.
The comparison with Bybit uses the approximately $1.5 billion theft documented by the FBI. That agency attributed the February 21, 2025 attack to North Korean cyber activity it calls TraderTraitor. Its finding concerned Bybit, rather than a completed law-enforcement attribution of this Binance incident.
The record is about the gross scale of the theft. It does not mean the entire amount will remain unrecovered or become a permanent loss for Binance customers.
Frozen Funds Are Not the Same as Recovered Funds
Binance’s statement puts affected assets frozen onchain at roughly $3 billion. The exchange says it has revoked affected address authorization and is working with law enforcement, issuers and blockchain intelligence partners.
Those efforts mark a substantial change from the initial issuer announcements we reported, when direct Tether and Circle statements established combined freeze thresholds above $2.3 billion. The evolving figures are successive snapshots, rather than additional pools to total up.
Freezing prevents an affected asset from moving under the relevant issuer or network controls. It does not automatically return it to the exchange, complete a recovery process or establish a final reimbursement bill.
Binance’s promise to cover losses also remains distinct from assets frozen. It identifies both SAFU and corporate funds as resources; it does not say SAFU alone holds $6.3 billion or provide a completed accounting of customer compensation.
Withdrawals Stay Paused as More Breach Points Emerge
In its latest update, Binance says outflows stopped when it paused the withdrawal service. It reiterates the approximately $3 billion frozen figure and its loss-coverage commitment while investigators gather further facts.
The statement says additional breach points have been uncovered after the preliminary focus on a compromised DevOps engineer’s laptop. Binance has not yet published the comprehensive root-cause report needed to explain the full attack path.
The distinction between deposits and withdrawals matters for customers. An earlier precautionary suspension covered both, but Binance subsequently said deposits operate normally. Its latest statement keeps withdrawals paused and gives the 45-hour reopening target, rather than announcing a restart.
CoinScreamer reported the coverage pledge and earlier service update. The new investigation statement adds another development: the potential entry points extend beyond the first laptop-based explanation.
TRM Links the Theft to North Korea
TRM attributes the attack to TraderTraitor with high confidence, citing onchain and offchain intelligence. That is the investigator’s assessment. Binance says it is working with law enforcement to establish the criminals’ identity.
Its reconstruction points to compromised signing infrastructure. On Ethereum, pre-signed EIP-7702 authorizations enabled repeated hot-wallet sweeps; other networks saw ordinary signed transfers.
Binance’s initial investigation found no evidence of wallet private-key leakage. The two descriptions are not inherently incompatible: obtaining unauthorized access to a signing process is different from proving that underlying private keys were extracted.
The Next Test Is Restoring Access and Trust
The immediate milestones are a confirmed withdrawal restart, a reconciled asset-recovery tally and the promised technical post-mortem. Binance also says it will publish updated Proof of Reserves once remediation is complete.
For the wider financial market, the episode highlights the operational risks of keeping assets with a centralized trading venue. A reassurance about balances, a commitment to absorb losses and the practical ability to withdraw are separate questions.
The current record-setting estimate makes this more than another isolated wallet alert. What determines the lasting financial damage will be how much can be recovered, how Binance funds its commitment and whether it can restore services without exposing customers to another breach.
