Binance hack: $6.3B impact and withdrawals suspended

Binance, the world’s largest crypto exchange by volume, has suspended deposits and withdrawals after a security incident detected on Thursday 29 October 2026. The company estimates the impact at around $6.3 billion, which would make it the largest crypto theft on record. At the time of writing, withdrawals remain suspended and Binance has not given a reopening date.

Key takeaways

• Estimated impact: around $6.3 billion according to Binance; Chainalysis puts it at about $5.9 billion and other estimates sit near $5.7 billion.
• Frozen funds: close to $3 billion, including more than $1.56 billion in USDT (Tether) and more than $800 million in USDC (Circle).
• Preliminary cause: a DevOps engineer’s compromised laptop gave access to a service container that submitted unauthorised withdrawals. Binance says it will cover all losses.

What happened: the timeline

On Thursday 29 October, users and on-chain analysts spot large outflows from Binance’s hot wallets. The company confirms to TechCrunch that it is investigating a potential security issue and suspends withdrawals «on multiple networks» as a precaution, according to spokesperson Ross O’Leary. Hours later, according to NBC News, Binance extends the pause to all deposits and withdrawals while it secures its infrastructure and works with law enforcement.

Changpeng Zhao (CZ), founder and largest shareholder, though no longer running the company, writes on X that the exchange was probably hacked and that he expects user funds to be «fully covered». Co-CEO Yi He says the platform will cover «all hacking losses», according to CoinDesk. Binance has also temporarily paused trading on Binance Alpha.

The numbers and who reports what

Figures vary by source, and Binance warns they may change:

• Binance: «the estimated total impact sits at around $6.3B» (NBC News, CoinDesk), with about $3 billion already identified and frozen.
• Chainalysis: roughly $5.9 billion at the time of the theft (CoinDesk).
• Arkham: the attacker’s wallets at one point held more than $5.7 billion, including about $1.5 billion in BTC, $900 million in ETH, $1.5 billion in USDT and over $800 million in USDC (CoinDesk).
• Tether: CEO Paolo Ardoino says Tether froze more than $1.56 billion in USDT.
• Circle: CEO Jeremy Allaire puts frozen USDC at more than $800 million (CoinDesk).

For reference, the previous record is the Bybit theft of February 2025, roughly $1.4–1.5 billion. Markets react with losses: according to CoinDesk, Bitcoin falls 4.8% to below $77,000, Ether 5.7% and BNB 8%.

How it happened: from laptop to container

According to Binance’s initial findings posted on X, the incident may involve a DevOps engineer’s compromised laptop, which let the attacker reach a service container and submit unauthorised withdrawal transactions. Binance says it has found no evidence of a wallet private key leak, has revoked the affected authorisations and promises a detailed post-mortem and updated proof of reserves.

The technical lesson is uncomfortable: no cryptography was broken; compromising one device with internal permissions was enough. Binance has not named a perpetrator. According to CoinDesk, TRM Labs attributes the attack «with high confidence» to the North Korean group TraderTraitor, and investigator ZachXBT names Lazarus Group as the «likely attacker». These are third-party attributions, not officially confirmed.

Tether and Circle freeze funds: the centralisation debate

A significant share of what has been recovered is frozen because stablecoin issuers can block tokens at specific addresses. That power limits the damage in a theft like this, but it also shows that USDT and USDC have a central issuer deciding which balances get blocked. It is the familiar trade-off: faster response to crime in exchange for less censorship resistance. No freeze applies to the stolen BTC or ETH, which can only be traced.

What Binance users should do now

1. Don’t rush. While withdrawals are suspended you cannot move funds off the exchange; avoid impulsive decisions in a volatile market.
2. Watch out for phishing. Every hack brings fake «refunds», compensation forms and bogus support agents. Binance asks users to avoid unofficial links and never share account details, 2FA codes or seed phrases.
3. Rely on official channels only: Binance’s announcements page and its verified accounts.
4. Review your account security: app-based or hardware-key 2FA, withdrawal address whitelists and an anti-phishing code.
5. Understand self-custody. A hardware wallet gives you control of your keys, and full responsibility for keeping them safe.
6. Check the CNMV register. In Spain and the EU, MiCA requires crypto-asset service providers to be authorised. Our guide to authorised crypto exchanges in Spain under MiCA explains how to check.

Why security and regulation are core to DEXT FORCE

This incident shows that crypto risk no longer sits only in code, but in people, devices and internal processes. Operational security, custody, stablecoins and MiCA regulation are core topics at DEXT FORCE, the Barcelona congress bringing together finance, AI, startups and crypto.

Frequently asked questions

Are Binance users’ funds safe?

Binance says they are and that it will cover losses with its SAFU fund and company funds. Exchange accounts are not protected by deposit guarantees like bank accounts, so compensation depends on the company itself.

When will withdrawals resume?

At the time of writing, Binance has not given a date. It says it will resume them once the security issue is resolved.

Who is behind the attack?

There is no official confirmation. According to CoinDesk, TRM Labs attributes it to the North Korean group TraderTraitor and ZachXBT points to Lazarus Group.

This article is for information only and does not constitute investment advice.