Binance says $6.3bn in crypto left its wallets as withdrawals stay suspended

• Blockchain trackers estimate transfers worth $6.36bn to $6.43bn across multiple networks. ^{1 2}
• Binance says about $3bn has been frozen; those assets have not necessarily been returned. ³
• A review of Binance’s October reserves data found the drained wallet listed among assets backing customer balances. ⁴

Binance says attackers moved crypto worth about $6.3bn from its hot wallets on 29 October, prompting the exchange to suspend cryptocurrency withdrawals while it investigates. Deposits remained operational on 30 October, the company said. Hot wallets are internet-connected wallets used to process withdrawals. ³

The $6.3bn figure is an estimate of the incident’s impact, not a final tally of losses. Blockchain analysis firms TRM Labs and Elliptic traced gross outflows of about $6.36bn and $6.43bn respectively, using different methods and numbers of networks. Binance said about $3bn had been frozen with partners’ help; that does not mean the money has been recovered or returned. ^{1 2 3}

Binance co-chief executive Richard Teng said the affected wallet belonged to the company and customer balances were safe. But a CoinDesk review found that a wallet drained in the attack was included in Binance’s 1 October reserves data, which lists assets backing customer balances. That earlier snapshot showed the wallet held 89,475 ether and 1.26bn USDT. It predates the breach and does not establish Binance’s current overall reserves; the company has promised an updated proof-of-reserves report, which had not appeared in the updates examined. ^{5 4 3}

Teng said investigators had found additional breach points beyond an initially suspected compromised employee laptop. He said the attackers used Ethereum’s EIP-7702 feature, which lets a wallet delegate certain actions to software, and a mechanism to erase traces. Binance has not published its full technical account of how the attackers gained access and bypassed normal approval checks. ^{5 6}

Binance said it was working with law-enforcement partners. Reuters, citing a person familiar with the matter, reported that the FBI and US Secret Service were involved; the agencies had not publicly confirmed their role in the reports examined. TRM assessed with high confidence that North Korea-linked group TraderTraitor was responsible, while Elliptic also linked the attack to North Korean actors. No government or law-enforcement agency had confirmed that attribution. ^{3 7 2}

Crypto withdrawals remained suspended as Binance rebuilt and tested its systems. Teng said the exchange hoped to restore them before Sunday, 1 November, subject to those checks. ⁶

Footnotes

1. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history ↩ ↩²

2. https://www.elliptic.co/insights/binance-largest-hack-in-history/ ↩ ↩² ↩³

3. https://www.binance.com/en-AU/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7 ↩ ↩² ↩³ ↩⁴ ↩⁵

4. https://www.coindesk.com/business/2026/10/30/binance-hack-drained-wallets-backing-customer-assets-reserve-data-shows ↩ ↩²

5. https://www.binance.com/en/square/post/10-30-2026-binance-news-update-richard-teng-binance-will-cover-all-hacked-losses-with-company-funds-6-34-billion-reserved-and-5-billion-already-held-in-the-affected-tokens-382915452773295 ↩ ↩²

6. https://www.coindesk.com/tech/2026/10/30/binance-uncovers-wider-breach-in-usd6-3-billion-exploit-targets-sunday-withdrawal-restart ↩ ↩²

7. https://www.investing.com/news/stock-market-news/fbi-and-us-secret-service-working-withbinance-after63-billion-hack-source-says-4987288 ↩