Binance Investigates Suspected Hack as Billions Leave Hot Wallets in Unconfirmed Outflows

Updated 16:14 UTC: Binance says 90 percent of the stolen funds are replenished and withdrawals stay on track for Sunday

Updated 16:14 UTC, Oct. 31, 2026. Binance said on Saturday that it has replenished 90 percent of the assets stolen in the $6.3 billion hack, up from about 80 percent in its Friday update, Reuters reported. The remaining 10 percent consists of tokens that are less liquid and may take longer to source in the required amounts, the exchange said. Binance said it has set aside about $6.34 billion of company funds internally to cover the losses, and that the replenishment involved a partial deployment of its $1 billion Secure Asset Fund for Users, known as SAFU. The exchange said it took a new proof of reserves snapshot of assets held on the platform as of 00:00 GMT on Oct. 31, and that users holding any of the 10 listed tokens, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, will be able to verify that their assets are backed at a minimum 1 to 1 ratio once the full proof is available, CryptoBriefing reported. Binance said it remains on track to resume withdrawal services on Sunday, Nov. 1, within its previously stated timeframe.

Updated 10:45 UTC: Binance says 80 percent of the stolen funds are replenished and withdrawals restart in phases

Updated 10:45 UTC, Oct. 31, 2026. Binance said in its second security incident update, published on Friday, Oct. 30 and signed by co-chief executives Yi He and Richard Teng, that it has set aside more than $6.34 billion in company funds to cover the theft. More than $5 billion of that is already in place in the same tokens that were taken, including USDC, USDT, bitcoin, ether and BNB. The exchange said about 80 percent of the stolen funds have been replenished, and that it is buying the rest through market and over the counter channels.

Withdrawals, paused since Thursday, are set to restart in phases by token within about 34 hours of the update, once security checks finish. Binance said about $3 billion of the stolen assets has been frozen on chain with help from partners. Elliptic, a blockchain analysis firm, put verified freezes at $2.84 billion as of 08:00 UTC on Oct. 30, most of it in USDT and USDC. The exchange said it has found no evidence that wallet private keys leaked. It plans a first proof of reserves snapshot within 12 hours of the update, publication of the results by Monday, Nov. 2, and further technical findings in about 48 hours. Forbes reported on Saturday, Oct. 31 that the phased restart is planned for this weekend.

Updated 16:42 UTC: FBI and Secret Service join the Binance investigation as the exchange finds more breach points

Updated 16:42 UTC, Oct. 30, 2026. The FBI said in a statement on Friday that it is "aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps," CNN reported. A spokesperson for the US Secret Service said the agency's investigators are "working around the clock with our private-sector partners, including Circle, to identify, freeze, trace, and recover funds stolen from Binance on Thursday," and are coordinating with the United States Attorney's Office for the District of Columbia, CNN reported.

Binance said its investigation has found additional points of breach beyond the compromised DevOps engineer laptop it first named, Decrypt reported. Co-chief executive Richard Teng described the attack as a more complex process and not a one-click action, and said no individual has been named as responsible, CNN and Decrypt reported. Binance said it remains on track to resume withdrawals within 45 hours, by Sunday morning, while deposits remain unaffected, MarketWatch reported. Arkham data cited in the same reporting put about 2.9 billion dollars of the stolen funds as not frozen, with the attacker still moving funds.

Updated 03:45 UTC: Binance puts the impact at about $6.3 billion and points to a compromised DevOps laptop

Binance has released its first findings on the security incident and has given its own total for the first time. The exchange said the estimated total impact sits at around $6.3 billion and that it has worked with blockchain partners to freeze affected assets, with about $3 billion frozen on chain so far, according to its statement reported by PANews, Bitcoin.com and The Wall Street Journal.

The initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions, Binance said. The exchange said, in its statement: "We have found no evidence of any wallet private key leak." It said it will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.

Binance said it will cover all losses from the SAFU fund and the company's funds and that user funds are safe. Co-founder Yi He said, in the Reuters account of the statement: "Binance will cover all hacking losses." Deposits and withdrawals remain suspended while security checks continue, and Yi He said withdrawals will be enabled as soon as the security scan is complete. Binance also said it will publish an updated Proof of Reserves once remediation is complete.

The Wall Street Journal reported that cybersecurity firms TRM Labs and Pangolin Intelligence said the theft appears to have been conducted by North Korea's TraderTraitor hacking group. Nick Carlsen, a senior investigator on the Global Investigations team at TRM, told the Journal: "This was absolutely North Korea." That is the firms' assessment as reported by the Journal. Binance has not confirmed who carried out the attack.

Crypto prices fell further late Thursday. Bitcoin dropped 4.5 percent over 24 hours to trade at $76,664 as of 10:00 p.m. ET, according to The Block. BNB lost 7.1 percent to $698.65, ether slid 5.2 percent to $2,190 and XRP fell 7 percent to $1.21. Crypto liquidations totaled $1.55 billion over the past 24 hours, with 246,482 traders liquidated, according to CoinGlass data reported by The Block. Chainalysis estimated that roughly $5.9 billion was stolen at the time of the theft. That tracker estimate is separate from Binance's own $6.3 billion impact figure and the two must not be added together.

The original report follows. Its figures are the earlier attributed tallies published before Binance released its findings, at a time when the exchange had not confirmed a theft total.

Update: Binance suspends withdrawals, Aave freezes markets and Ripple freezes $200 million in RLUSD

Binance has temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure, spokesperson Ross O'Leary told TechCrunch, and the exchange confirmed to TechCrunch that it is dealing with a security incident after users reported funds being drained from its wallets. The suspension changes the position in the original report below, which was written before any withdrawal halt had been announced.

Co-founder Yi He said on X that, out of security concerns, Binance has suspended withdrawals until the environment is confirmed safe and that user funds are safe (SAFU), PANews reported. She thanked Ripple for freezing about $200 million in related assets and the World Liberty Financial team for freezing $27 million in USD1 and 48 million WLFI, worth about $2 million.

Wallets tied to the suspected hack used decentralized exchanges as exit ramps, receiving tens of thousands of ETH from Uniswap contracts and borrowing 19,762 ETH on Aave against about $60 million in USDT, with no sign of a flaw in either app, according to Etherscan records for 10 wallets, eight of them labelled as exploiters, Decrypt reported. Between 20:57 and 21:01 UTC, one wallet deposited $10 million and then $50 million in USDT on Aave and borrowed 3,271 ETH, worth about $7.43 million, and then 16,491 ETH, worth about $37.47 million, against it. Phylax Systems founder Odysseas Lamtzidi warned of contagion in full effect.

Aave has since frozen its V3 markets on Ethereum mainnet, which blocks new deposits and borrowing, Decrypt reported. Aave also froze its lending markets on Avalanche to stop the suspected hacker using about 1.81 million AVAX and $8.4 million in USDT linked to the incident as collateral, CryptoBriefing reported. The Block reported that Aave froze lending markets to prevent the Binance hacker from borrowing, based on onchain data, and that the BNB token was down more than 5.5 percent at publication time, 21:49 UTC. Kamino, a decentralized finance protocol on Solana, temporarily paused borrowing in its Solana and Bitcoin markets as a precaution and said it is currently unaffected by the Binance situation, Decrypt reported.

Ripple has frozen about $200 million in RLUSD linked to the incident, according to Yi He, on top of the more than $2 billion in USDT and USDC frozen by Tether and Circle. InvestingLive reported that Tether and Circle together froze about $2.4 billion using later issuer figures, and that about $700 million in USDT left the receiving address before Tether blacklisting took effect and was partly swapped into ether. The freeze figures come from different issuers at different times and must not be added together. Binance still has not confirmed a theft total.

About 253,000 ETH, roughly $570 million, sat in two wallets with no outgoing transfers as of 22:07 UTC, and ETH has no issuer that can freeze it, Decrypt and CoinTurk reported. A wallet labelled Exploiter 8 held 195,460 ETH, worth about $444.2 million, at 22:03 UTC, and Exploiter 11 held 57,892 ETH, worth about $131.6 million, at 22:07 UTC.

Crypto markets steadied after the initial drop, InvestingLive reported. BNB fell from about $739 to a low near $692 before recovering to about $704 by 22:15 GMT, Bitcoin was near $78,800 and ether was around $2,265, and about $628 million in leveraged positions were liquidated within an hour, mostly longs.

Binance, the world's largest cryptocurrency exchange, said on Thursday it was investigating a potential security issue after billions of dollars in crypto left its hot wallets for a new address. It has not confirmed a hack or any impact to user funds. Every total so far is an on-chain tally from a tracker or an outlet. The tallies differ because they count different scopes, and an outflow on its own is not proof of theft.

"Our teams are aware of reports of a potential security issue and are actively investigating," Binance said on X, in a statement reported by Decrypt. "At this stage, we have not confirmed any impact to user funds."

What left the wallets

The first large movement began at 20:24 UTC on Thursday, October 29. A wallet labelled Binance 14 sent 167,464 ether, worth about $388 million, plus 63 token transfers including 1.615 billion USDT, to a brand-new address, according to Etherscan data reported by Decrypt. About 28,000 ether then left the Binance 16 wallet for the same address 24 seconds later, and a third hot wallet sent out $823 million in USDC. Cyprus Inform, citing Etherscan and researchers, reported the main wave was over by 21:04 UTC.

FXStreet reported about $2.77 billion leaving across five blockchain networks to unconfirmed addresses. Decrypt put the total at at least $5.57 billion across three blockchains: $3.51 billion on Ethereum, $1.44 billion in bitcoin (18,270 BTC) and $630 million on Tron. The Block put suspicious outflows at up to $5.8 billion. None is an official Binance figure, and they must not be added together.

Freezes and an early clue

Tether froze 975.1 million USDT and Circle froze 823 million USDC in the main receiving wallet, about $1.8 billion total, according to Decrypt. CoinEdition later reported Tether chief executive Paolo Ardoino saying over $1.567 billion in USDT was frozen, and Circle chief executive Jeremy Allaire confirming over $800 million in USDC frozen with law enforcement support. The final total remains unsettled.

Three minutes before the principal outflow, an address funded via Tornado Cash issued an EIP-7702 delegation targeting a Binance hot wallet, Decrypt reporting summarised by BasisDesk said. Phylax Systems founder Odysseas Lamtzidi noted that the mechanism lets standard accounts execute delegated code that can approve future transactions without later wallet signatures. How the authorising signature was obtained remains unknown. The receiving address was created hours earlier, was funded through Tornado Cash, and forwarded about $450 million onward within 15 minutes, investigators reported.

Founder says funds are safe as markets fall

Binance founder Changpeng Zhao, known as CZ, posted on X: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered."

Bitcoin fell below $79,000 and BNB dropped about 7 percent, according to Decrypt. Liquidations reached roughly $600 million within one hour on Coinglass data reported by FXStreet, with other CoinGlass tallies at $620 million to $627.7 million, about 97 percent long positions. If confirmed as a hack, this would be the biggest crypto hack on record, ahead of the $1.5 billion Bybit theft in February 2025. As of 22:00 UTC, Binance had announced no withdrawal halt and confirmed no hack, loss figure or impact on user funds.