Live updates: Binance $6.3B hack linked to North Korea’s TraderTraitor

What we know about the Binance hack:

Binance says the estimated total impact is around $6.3 billion and the verified total value of crypto frozen is $3 billion. This could increase as investigators trace additional assets.

Binance says deposits are operating normally, and withdrawals are expected to resume within 48 hours.

Assets frozen include Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB).

Cybersecurity analysts suspect North Korea’s TraderTraitor is behind the attack.

Analysts suspect North Korean group behind Binance hack

Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor, citing links to a previous hack.

In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. He said industry partners had frozen approximately $3 billion and Chainalysis was continuing to track the funds.

In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.

“This indicates the same actor is likely behind both incidents,” he said.

“The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO,” he added.

Speaking to Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan also said the attack resembled the work of North Korea, or DPRK, based on the sophisticated onchain preparations, customer sweeper contract and multiple authorizations.

TRM Labs has also attributed the attack to TraderTraitor with “high confidence,” which it said is “based on robust on and off-chain intelligence.”

TraderTraitor has also been named by the FBI as the same group responsible for the ByBit hack in February last year.

Binance expects withdrawals to resume within 48 hours

Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours. Deposits are operating normally.

The exchange said the incident involved multiple factors and that its security team was tracing the full attack path through a compromised computer, which they suspect to be the entry point.

Binance hack could accelerate shift to DEXs: Standard Chartered

The Binance hack could push more crypto trading toward decentralized exchanges and benefit Uniswap over the longer term, according to Standard Chartered’s global head of digital assets research, Geoffrey Kendrick.

In an email shared with Cointelegraph, Kendrick retained his $100 price target for Uniswap’s UNI token by 2030, saying the breach was “another reason why that forecast may end up being too low.”

CoinGecko research shows that the top 10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, climbing 2.1 percentage points from the first quarter of 2026.

“I would encourage investors to re-engage with Uniswap,” said Kendrick. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.”

Binance points to engineer’s hacked laptop in $6.3B breach

Binance said its initial investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop.

The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak, though its investigation remains ongoing.

The crypto exchange has also disclosed that the estimated total impact of the hack is $6.3 billion.

First Digital confirms it has frozen FDUSD involved in attack

First Digital CEO Vincent Chok said it has frozen the FDUSD stolen in the attack on Binance.

“We’re working alongside the Binance team and will share updates as we have them,” Chok told Cointelegraph in a written statement.

“Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds. Protecting users is a responsibility we all share.”

Bitcoin trades below $77,000 as BNB falls 8%

Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211.

DeFi tokens also fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the same period.

The Bitcoin Fear and Greed Index, which tracks Bitcoin market sentiment, fell to “fear” with a score of 30, which it has not seen since August.

Binance says $3 billion frozen from hack

Binance said the current verified amount of assets frozen from the hack is now $3 billion.

The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH).

“The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said.

“As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.

The funds will no longer be accessible to the address that originally held the funds and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, it added.

Chainalysis estimates $5.9 billion stolen from Binance

Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.

Binance earlier said the verified total frozen is $2.54 billion.

Blockaid suspects Binance hack involved private key “misuse”

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature, according to Blockaid co-founder and CEO Ido Ben-Natan.

Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.

“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.

Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.

Arkham CEO Miguel Morel said the attack appears to be ongoing.

Binance says deposits temporarily suspended

Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals.

“We are working around the clock and will share a full post-mortem once the investigation is complete,” the company said, adding it will “cover all losses.”

Earlier, Binance also said it had temporarily suspended Binance Alpha trading.

Wintermute and GSR disclose Binance exposure

Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses.

The firms are market makers, which place buy and sell orders on exchanges to help other traders complete transactions. A disruption to their operations could make trading harder or more expensive across crypto markets.

GSR CEO Xin Song said its Binance exposure was less than 5% of its net equity, meaning the value of its assets minus its liabilities. He said GSR was working with Binance to understand the incident and identify ways to help.

Wintermute CEO Evgeny Gaevoy said his firm’s exposure was less than 20% of net equity and that he did not expect operational disruption.

Neither executive disclosed a dollar amount for the exposure or confirmed financial losses.

Ripple freezes RLUSD linked to Binance hack

Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins.

McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.

Binance says $2.54 billion frozen after hack

Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.

The exchange said the total could increase as its teams work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. Binance said it would publish further figures once verified.

World Liberty Financial freezes $27 million in USD1

World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He.

“USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff.

World Liberty Financial said it worked with BitGo to freeze the stolen WLFI and USD1 funds.

“We will cooperate fully with the ongoing investigation and support efforts to hold those responsible accountable. Protecting our users remains a top priority,” said World Liberty in a post on X.

Binance says withdrawals will resume once issues resolved

Binance says its team is conducting security checks and will resume withdrawals as soon as the “security issue” is resolved.

Aave freezes markets after Binance exploiter borrows $44.6 million

Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.

In a governance forum update posted after the freeze, risk service provider LlamaRisk said the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time.

The borrowing occurred between 8:58 pm and 9:01 pm UTC on Oct. 29, about 40 minutes before the first freeze. It was the exploiter’s only Aave position across all networks and versions, with no further interactions detected after 9:01 pm UTC.

The position remained backed by $59.9 million in USDT collateral against $43.8 million in debt at the update’s snapshot. LlamaRisk said it remained subject to normal liquidation and did not put Aave suppliers at risk.

The freezes covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks.

Users can still withdraw funds and repay loans, and liquidations continue. However, the freeze prevents new deposits and borrowing, including additional collateral deposits, leaving repayment as the only way to improve an existing position’s health factor.

LlamaRisk said markets would remain frozen until the exploiter’s funds stopped moving and Binance provided greater clarity on containment, followed by a staged reopening. It warned that a prolonged freeze could push borrowing rates higher as withdrawals reduce available liquidity.

Binance investigates multibillion-dollar security breach

Binance is investigating a potential multibillion-dollar security breach involving one of its Ethereum wallets, after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions in assets.

A Binance spokesperson told Cointelegraph on Thursday that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds. The spokesperson said its security teams were reviewing the activity and would provide updates once more information was verified.

Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash. Spreek later reported that wallets connected to the transfers had begun selling Tether USDt (USDT) through decentralized exchanges.

Blockchain analytics platform Arkham Intelligence later identified a collection of wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets. The figure represents the wallets’ reported holdings rather than a confirmed estimate of stolen funds.

Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.

Tether, Circle freeze over $2.36 billion

Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.

Shortly after news of the hack emerged, Tether and Circle, the two largest stablecoin issuers by market capitalization, said they had frozen a combined $2.36 billion in tokens linked to the suspected incident.

Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.

A few minutes later, Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.

“Protecting the industry and our partners is our main priority,” Ardoino wrote.

The Binance hack came hours after Polymarket temporarily halted trading following a compromise at a third-party provider. The prediction market platform said it had fixed the issue and pledged to reimburse affected users, with all systems reported operational by 7:05 p.m. UTC Thursday.