Binance has confirmed a security incident with an estimated impact of about $6.3 billion, prompting a temporary withdrawal suspension and a wider investigation. This report covers Friday, 30 October 2026 updates on an attack whose major transfers began on Thursday evening, 29 October. It separates the exchange’s statements from blockchain investigators’ estimates and questions that remain unresolved.
Editorial review: 30 October 2026 at 15:27 Saudi time, equivalent to 12:27 UTC. In the latest service information reviewed, Binance says deposits are operating normally, while withdrawals remain paused during security work. Its expectation of resumption within 48 hours is measured from the service update, not from when you read this article. We have not verified a subsequent announcement confirming that withdrawals have reopened.
What has Binance confirmed?
The exchange’s official security incident update gives the initial financial estimate and says investigators suspect a compromised DevOps engineer’s laptop. Binance reports finding no evidence of wallet private-key leakage. It has pledged to cover losses using SAFU and company funds and to publish a technical account and updated Proof of Reserves after remediation. These are company statements, not the outcome of a completed independent audit.
| Issue | Information available | Important distinction |
|---|---|---|
| Financial impact | About $6.3 billion, according to Binance | An estimate, not a final net-loss calculation |
| Frozen assets | About $3 billion, according to the company | Frozen does not mean returned to the exchange |
| Withdrawals | Paused in the latest reviewed update | A reopening expectation is not confirmation of reopening |
| Deposits | Operating in the later service update | This differs from the initial announcement |
| Investigation | Ongoing | The complete cause and final responsibility remain unresolved |
When did the attack begin?
TRM Labs’ investigation places the main initial movement at approximately 20:05 UTC on 29 October, or 23:05 that evening in Saudi Arabia. The firm says most of the large transfers occurred in roughly twenty minutes and affected wallets across ten blockchains. Subsequent statements and Friday coverage explain why many readers are searching for a Binance hack “today.”
The beginning of suspicious transfers, their detection, the public announcement and the publication of a loss estimate are different milestones. A report appearing later does not establish that the attack began at its publication time. Equally, a fresh update can reflect better information about an existing transfer rather than a new theft. Readers should preserve dates and time zones when comparing screenshots.
How did the breach happen?
Initial findings suggested that a compromised employee device may have provided access to an internal service and enabled unauthorised withdrawal requests. However, a later Binance explanation of the attack path described multiple stages and additional entry points. It said a single engineer’s permissions could not have moved the funds in one simple action. Calling one laptop the complete, proven cause would therefore go beyond the available findings.
TRM assesses that the hot-wallet signing infrastructure was compromised. In general terms, a hot wallet supports operations connected to online systems, while a digital signature authorises a transaction or permission. Abusing an authorisation process is not necessarily the same as extracting a private key. This distinction helps explain the discussion without treating an analyst’s technical assessment as the exchange’s final forensic conclusion.
The information reviewed does not establish a leak of every customer’s password or identity documents. Conversely, the absence of evidence for private-key leakage is not proof that examination of every system has finished. A complete technical report is still needed to determine the attack path, the controls involved and the verified scope. This article does not provide exploit instructions or claim access to internal forensic evidence.
Why do estimates range from $6.3 billion to $6.43 billion?
TRM values the transferred assets at approximately $6.36 billion at the time they moved. Elliptic’s analysis, updated at 08:00 UTC on 30 October, gives a $6.43 billion estimate and says it verified $2.84 billion in frozen funds. These are separate assessments at stated moments, not amounts to add together or evidence of separate incidents.
Differences can arise from the wallets included, the time used to convert token quantities into dollars and transfers identified later. For that reason, the approximate company figure is used in the headline while independent estimates remain attributed. A final loss also cannot be calculated simply by subtracting frozen assets from an outflow estimate. Traced, frozen, recovered and reimbursed describe different stages.
Who is suspected of being responsible?
TRM attributes the attack with high confidence to TraderTraitor, a North Korea-linked hacking group. Elliptic also considers a North Korean connection likely. These are assessments by specialist investigators. They should not be presented as a court finding or an announcement that official authorities have completed attribution for this incident.
Binance says it is working with law enforcement and industry partners to identify those responsible. The distinction matters because tracing a flow of assets and establishing an attacker’s identity involve different evidence. Similar behaviour or links to earlier addresses can inform an assessment without replacing a completed investigation. Readers do not need to interact with suspected attacker addresses to follow the story.
Deposits and withdrawals: the later update matters
The initial statement described a precautionary suspension of both deposits and withdrawals. Later Binance service reporting says deposits are operating normally and withdrawals remain suspended while the withdrawal service and address controls undergo security improvements. The same operational position is reported by Hong Kong broadcaster RTHK. Binance’s stated expectation is restoration within 48 hours of the service update.
That window is not a guaranteed reopening time or a fresh countdown starting whenever an article is shared. Check a new official announcement and the status of the particular service and network in your account. A statement that deposits work also does not prove that every trading, conversion or withdrawal product operates without restrictions. We have not tested every product or regional platform.
A subsequent Binance update on coverage and frozen assets referred to about 45 hours remaining in the expected schedule and said incident-related outflows stopped after withdrawals were suspended. This updates the company’s operational estimate; it is not independent confirmation that all assets have been recovered or services restored.
Are customer funds safe, and what does SAFU mean?
The assurance that customer funds are safe and the commitment to cover losses come from Binance. They are important statements, but they do not constitute an independent verification of current reserves or evidence that every recovery process has finished. A withdrawal pause alone does not establish insolvency, just as a reassurance alone cannot conclusively resolve every question about financial condition.
SAFU is Binance’s user-protection fund. For this incident, the exchange has said company resources will also be used. It would be misleading to describe SAFU as the only source of coverage or as a government deposit-insurance scheme. At the review time, this report does not have a final independently verified timetable explaining settlement of every potential claim. No reader needs to send crypto to an outsider to activate the company’s announced protection.
What can users do to avoid a second loss?
A major incident can create opportunities for fake support messages and fraudulent recovery services. Binance’s account-security guidance recommends a unique password, strong authentication, account-activity reviews and care with API permissions and the linked email account. These measures address personal account security; they do not repair the exchange’s internal infrastructure or guarantee protection from every risk.
- Open the official app or website directly rather than logging in through an urgent message or comment.
- Keep passwords, authentication codes, private keys and wallet recovery phrases private.
- Review devices, login history and unnecessary API access through official account settings.
- If your own account shows unauthorised activity, contact official support and follow the platform’s published account-security process.
- Keep transaction references and timestamps for a report, without publicly posting account identifiers or secret codes.
Binance’s withdrawal anti-scam guidance specifically describes the “safe wallet” impersonation tactic: an unsolicited caller provides a destination supposedly intended to protect funds. Do not pay someone claiming they can bypass the suspension or release a refund. Reading an incident update does not require a wallet signature or a token approval.
For related Saudi coverage of digital awareness, see our report on Madar and cybersecurity awareness. That is educational background, not a suggestion that the event continues beyond its announced dates. The broader lesson is to verify a request through a channel you opened yourself, especially when a message combines urgency with a demand for access or payment.
Market reaction and the information still missing
Reuters reported falling cryptocurrency prices following the security announcement. That describes market conditions during its coverage, not a live price feed or a forecast. This report does not recommend buying or selling. A token’s rebound or decline cannot establish whether the underlying security problem has been fully resolved.
The most useful next milestones are confirmed withdrawal restoration, the networks and services included, the completed technical report, updated reserve evidence and actual recovery of frozen assets. Descriptions of the event as a record cryptocurrency theft come from investigators’ estimates and should remain attributed. Final attribution, financial totals and remediation details may change as verifiable information emerges.
Editorial note: This is news and security-awareness reporting based on information available at the review time above. It does not claim to contain the findings of an unfinished investigation. The cover is an original conceptual cybersecurity illustration without text, not documentary evidence or an official Binance graphic.
