On October 29, 2026, Binance suffered a major security breach involving unauthorised cryptocurrency transfers worth an estimated $6.3 billion. The incident affected multiple blockchain networks and triggered an industry-wide effort to trace and freeze the stolen assets.
Binance’s preliminary investigation points to a potentially compromised DevOps engineer’s laptop as the entry point. The exchange has reported no evidence of a wallet private key leak and has committed to covering all losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
Blockchain monitoring systems detected suspicious movements from Binance-linked wallets on October 29. Initial investigations focused on Ethereum-based transfers, but subsequent analysis identified activity across Bitcoin, Tron, Solana, XRP Ledger and other networks.
As investigators traced additional transactions, the estimated impact increased, with Binance’s own estimate of $6.3 billion.
The incident quickly developed into a major cross-chain investigation, with blockchain intelligence firms and cryptocurrency companies working to identify the affected wallets and prevent further movement of the assets.
Binance’s preliminary investigation suggests that a DevOps engineer’s laptop may have been compromised, allowing the attacker to access an internal service container. This access may have been used to submit unauthorised withdrawal transactions.
The exact method used to compromise the device has not been publicly established. Binance has also reported no evidence that wallet private keys were leaked.
The preliminary findings suggest that the attacker may have exploited access to an authorised internal service rather than directly extracting wallet private keys.
This distinction is important because cryptocurrency withdrawals depend on several connected systems, including internal services, access permissions and transaction-signing infrastructure. Compromising one of these systems may create an opportunity to misuse legitimate transaction processes.
The full sequence of how the attacker gained access and obtained sufficient permissions remains under investigation.
Independent blockchain security analysis identified the use of Ethereum’s EIP-7702 account-delegation mechanism in the attack involving Binance’s Ethereum hot wallet.
EIP-7702 allows externally owned Ethereum accounts to delegate certain execution functions to smart-contract code. The reported activity suggests that this mechanism may have been abused to facilitate unauthorised asset transfers.
This does not indicate that Ethereum itself was compromised. The precise role of the mechanism and how it was exploited will need to be established through Binance’s technical post-mortem.
Blockchain analysis published on October 30 provides a preliminary picture of the incident’s development.
| Date and time (UTC) | Development |
| October 28 | Preliminary on-chain activity linked to wallets later associated with the incident was identified. |
| October 29, | Major suspicious transfers appeared on the XRP Ledger. |
| October 29, | Additional activity was detected on Solana and other networks. |
| October 29, | Significant transfers involving Bitcoin, Tron and Ethereum-linked wallets followed. |
| October 29, | A major Ethereum transaction moved substantial amounts of ETH, USDT and other tokens. |
| October 29, later evening | Tether, Circle and other ecosystem participants began freezing or restricting affected assets. |
| October 30 | Binance identified a potentially compromised DevOps laptop as a possible entry point and reported approximately $3 billion in frozen assets. |
| October 30, later update | Binance confirmed that deposits were operating normally, while withdrawals remained paused during a security overhaul. |
The timeline reflects reported blockchain activity and company updates. The final sequence of events remains subject to forensic investigation.
The incident involved multiple cryptocurrencies, stablecoins and smaller digital assets across several blockchain networks.
| Asset | Reported amount | Approximate value |
| Bitcoin (BTC) | 18,270 BTC | $1.47 billion |
| Ethereum (ETH) | 200,630 ETH | Included in Ethereum-network total |
| Tether (USDT) | 1.875 billion on Ethereum and 612.7 million on Tron | More than $2.4 billion combined |
| USD Coin (USDC) | Approximately 823 million | Approximately $823 million |
| Ripple USD (RLUSD) | Approximately 88.5 million | Included in Ethereum-network total |
| XRP | 233.46 million XRP | Approximately $296 million |
| Solana (SOL) | Approximately 970,500 SOL | Approximately $96 million |
| TRX | Approximately 46.4 million directly identified | Additional TRX acquired through subsequent swaps |
| Arbitrum (ARB) | Approximately 74.6 million ARB | Part of the wider cross-chain total |
Additional assets identified across the affected wallets included Wrapped Beacon ETH (wBETH), Tether Gold (XAUt), Uniswap (UNI), Ethena (ENA), Pepe (PEPE), World Liberty Financial USD (USD1), Chainlink (LINK), Aave (AAVE), Avalanche (AVAX), Optimism (OP), USDT0, Paxos Gold (PAXG), Zama (ZAMA) and Lagrange, alongside several smaller tokens.
Arkham Intelligence has labelled multiple addresses associated with the suspected attacker, helping investigators monitor subsequent movements. The token list remains subject to change as additional transactions are identified.
On October 30, blockchain analytics firm Chainalysis said it had a high degree of confidence that North Korea was responsible for the Binance incident. Its investigators reported identifying funds from a previous Bitget exploit being mixed with funds associated with the Binance theft.
These assessments point towards a possible North Korean connection, but the identities of the individuals responsible have not been publicly established. Binance has said it is working with law enforcement to identify those involved and bring them to justice.
The attribution should therefore be treated as an intelligence assessment rather than a final legal finding.
Binance initially reported that approximately $3 billion in affected assets had been frozen through coordination with blockchain partners, token issuers and other industry participants.
Several companies and networks contributed to the effort:
Stablecoins such as USDT and USDC can be frozen by their issuers, which have the ability to restrict transfers from specific addresses. This helped prevent the suspected attacker from moving some of the affected assets.
Bitcoin and Ether do not have a central issuer with the same ability to blacklist addresses. Their recovery depends more heavily on transaction tracking, cooperation with exchanges and intermediaries, and legal action.
It is important to distinguish frozen assets from recovered funds. Frozen cryptocurrency may remain inaccessible while investigators establish ownership and determine how it can legally be returned.
Blockchain investigators traced funds moving across Ethereum, Bitcoin, Tron, Solana, XRP Ledger and several layer-2 networks.
Some assets were converted into other cryptocurrencies through swaps and moved across multiple addresses. Reported activity included transactions involving Ether and TRX, alongside interactions with decentralised exchanges and other blockchain services.
These movements complicate recovery, although public blockchain records allow investigators to track transactions and identify connections between wallets.
The movement of funds does not necessarily mean that the attacker successfully cashed out. The final destination of all affected assets had not been established as of October 30.
Binance stated that customer funds remain safe and committed to covering all losses through its SAFU fund and corporate funds.
The commitment is important for customers, but its implementation will need to be assessed through the exchange’s promised updated proof of reserves and subsequent disclosures.
Binance temporarily suspended deposits and withdrawals while conducting security checks.
In its October 30 update, the exchange said deposits were operating normally, while withdrawals remained paused during a security overhaul of the withdrawal service and related addresses. It expected withdrawals to resume within 48 hours.
Binance Alpha trading and certain related instant-purchase and prediction-marketing services using funds from spot wallets were also temporarily suspended.
The exchange said these services would resume once the security issue was resolved. The restrictions formed part of its wider precautionary response.
Binance’s response involved both internal security measures and cooperation with companies across the cryptocurrency industry.
Changpeng Zhao (CZ), Binance’s co-founder and former chief executive, reassured users that their funds were safe. He also acknowledged employees who worked overnight to address the incident and thanked industry participants, including competitors, for their assistance.
Yi He, Binance’s co-founder and co-CEO, thanked the community for its support and said the team was conducting security checks before restoring withdrawals.
The exchange’s response has focused on:
Tether, Circle, Ripple and Arbitrum also contributed to the response through asset restrictions and freezing measures. Blockchain intelligence firms continued tracking transactions and identifying related addresses.
The coordinated effort demonstrates how exchanges, token issuers, blockchain networks and investigators can work together during a major security incident.
The incident highlights the risks associated with privileged employee access and internal withdrawal systems.
Even when wallet private keys remain secure, compromised internal services may create opportunities for unauthorised transactions. This makes employee device security, access permissions and withdrawal approval systems just as important as protecting private keys.
The incident also raises questions about the safeguards exchanges use to prevent a compromised internal system from independently approving large withdrawals.
Stronger employee access controls, independent transaction validation, withdrawal limits and real-time monitoring may help reduce the risk of similar incidents.
For the wider industry, the incident is a reminder that exchange security remains a major risk even when the underlying blockchain networks continue to operate normally.
The incident increased uncertainty across cryptocurrency markets, with contemporary reporting indicating that Bitcoin fell below $77,000 alongside declines in Ether and other assets. Although security concerns may have contributed to market pressure, the price movements cannot be attributed entirely to the Binance incident.
Several important questions also remain unanswered:
Binance’s immediate priorities are to complete its security overhaul, restore withdrawals safely, continue coordinating with investigators and publish its technical post-mortem.
The Binance incident represents a major exchange security failure, with an estimated impact of approximately $6.3 billion. Preliminary findings suggest that compromised internal infrastructure may have allowed unauthorised withdrawals without a direct wallet private key leak.
The coordinated freezing of approximately $3 billion in assets demonstrates the importance of industry-wide cooperation in cryptocurrency investigations. However, the final recovery amount, the identities of the perpetrators and the precise attack method remain subject to investigation.
Binance’s commitment to cover all losses provides reassurance to customers, but the exchange’s long-term credibility will depend on restoring withdrawals safely, publishing an updated proof of reserves and providing a transparent technical explanation.
The incident should be viewed as a major security breach under investigation, rather than proof that customer funds have been permanently lost or that all affected assets have been recovered. The final technical report, independently verifiable recovery figures and the restoration of normal services will be the most important developments to watch.
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
All opinions and insights shared represent the author's own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Story Highlights The current price of Waves is . Based on Coinpedia’s formulated forecast, WAVES…
Chevron and Exxon Mobil both topped third-quarter forecasts on Friday, powered by US refineries running…
Former Binance CEO Changpeng Zhao (CZ) says the exchange could use its stake in Elon…
A bruising week for Big Tech earnings ended on a sour note Friday, with Nasdaq-100…
Amazon's latest earnings report delivered strong growth in its cloud business but failed to ease…
David Schwartz, chief architect of the XRP Ledger and Ripple’s CTO Emeritus, has firmly rejected…
