Live updates: Binance says $6.34B set aside to cover hack losses

Binance says the estimated total impact is around $6.3 billion and the verified total value of crypto frozen is $3 billion. This could increase as investigators trace additional assets.

Binance says deposits are operating normally, and withdrawals are expected to resume within 48 hours.

Assets frozen include Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB).

Cybersecurity analysts suspect North Korea’s TraderTraitor is behind the attack.

Binance says investigators have uncovered additional points of breach after initially pointing to a potentially compromised engineer’s laptop.

Yi He says Binance is buying altcoins to replace stolen tokens. Binance is buying altcoins in quantities matching those stolen in the hack as it prepares updated proof of reserves, co-CEO Yi He said. The purchases are being made through over-the-counter deals and on exchanges, she said. Binance’s SAFU fund and company holdings include substantial amounts of Bitcoin and Ether, Yi He said. The exchange would provide another update once the purchases were complete.

EIP-7702 may have helped Binance hackers bypass security checks. Attackers could have stolen Binance’s funds without Ethereum’s EIP-7702 upgrade, but it may have helped them bypass security checks, Blockaid CEO Ido Ben-Natan told Cointelegraph. Ben-Natan said compromised signing systems likely enabled the attack. EIP-7702 provided “a way to do this in one sweep,” while attackers otherwise would have needed multiple transactions. Ambire CEO Ivo Georgiev also said the funds could have been stolen through other methods. He warned that exchange engineers could overlook the need to revoke malicious EIP-7702 delegations after regaining control of their systems.

Binance has set aside more than $6.34 billion in company funds to cover losses from the hack, the exchange said Friday. The company said $5 billion of those funds were already held in the same tokens affected by the attack. It was purchasing the remaining assets through market and over-the-counter transactions to address token shortfalls. Some purchases could take longer because of low liquidity and OTC settlement times, Binance said. The allocation excludes frozen or protected assets. About $3 billion remained frozen, with efforts to recover those funds continuing alongside law enforcement and industry partners.

Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said, after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected. Outflows from the exchange stopped when it paused withdrawals, it said.

The attacker behind Binance’s $6.3 billion hack did not simply use one engineer’s permissions to carry out the breach, co-CEO Richard Teng said Friday. In an X post, Teng said the incident involved “a more complex attack process” and was not a single “one-click” action. “Our investigation has not attributed responsibility to any individual,” he wrote. Teng reiterated that preliminary findings pointed to a compromised DevOps engineer’s laptop, which may have allowed the attacker to access an internal service and submit unauthorized withdrawals. He said investigators had found no evidence of a wallet private-key leak. Binance would cover all losses using its SAFU fund and company funds, he said.

Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor, citing links to a previous hack. In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. He said industry partners had frozen approximately $3 billion and Chainalysis was continuing to track the funds. In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain. “This indicates the same actor is likely behind both incidents,” he said. “The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO,” he added. Speaking to Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan also said the attack resembled the work of North Korea, or DPRK, based on the sophisticated onchain preparations, customer sweeper contract and multiple authorizations. TRM Labs has also attributed the attack to TraderTraitor with “high confidence,” which it said is “based on robust on and off-chain intelligence.” TraderTraitor has also been named by the FBI as the same group responsible for the ByBit hack in February last year.

Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours. Deposits are operating normally. The exchange said the incident involved multiple factors and that its security team was tracing the full attack path through a compromised computer, which they suspect to be the entry point.

The Binance hack could push more crypto trading toward decentralized exchanges and benefit Uniswap over the longer term, according to Standard Chartered’s global head of digital assets research, Geoffrey Kendrick. In an email shared with Cointelegraph, Kendrick retained his $100 price target for Uniswap’s UNI token by 2030, saying the breach was “another reason why that forecast may end up being too low.” CoinGecko research shows that the top 10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, climbing 2.1 percentage points from the first quarter of 2026. “I would encourage investors to re-engage with Uniswap,” said Kendrick. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.”

Binance said its initial investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop. The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak, though its investigation remains ongoing. The crypto exchange has also disclosed that the estimated total impact of the hack is $6.3 billion.

First Digital CEO Vincent Chok said it has frozen the FDUSD stolen in the attack on Binance. “We’re working alongside the Binance team and will share updates as we have them,” Chok told Cointelegraph in a written statement. “Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds. Protecting users is a responsibility we all share.”

Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211. DeFi tokens also fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the same period. The Bitcoin Fear and Greed Index, which tracks Bitcoin market sentiment, fell to “fear” with a score of 30, which it has not seen since August.

Binance said the current verified amount of assets frozen from the hack is now $3 billion. The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH). “The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said. The funds will no longer be accessible to the address that originally held the funds and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, it added.

Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025. Binance earlier said the verified total frozen is $2.54 billion.

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature, according to Blockaid co-founder and CEO Ido Ben-Natan. Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said. Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity. Arkham CEO Miguel Morel said the attack appears to be ongoing.

Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals. “We are working around the clock and will share a full post-mortem once the investigation is complete,” the company said, adding it will “cover all losses.” Earlier, Binance also said it had temporarily suspended Binance Alpha trading.

Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses. The firms are market makers, which place buy and sell orders on exchanges to help other traders complete transactions. A disruption to their operations could make trading harder or more expensive across crypto markets. GSR CEO Xin Song said its Binance exposure was less than 5% of its net equity, meaning the value of its assets minus its liabilities. He said GSR was working with Binance to understand the incident and identify ways to help. Wintermute CEO Evgeny Gaevoy said his firm’s exposure was less than 20% of net equity and that he did not expect operational disruption. Neither executive disclosed a dollar amount for the exposure or confirmed financial losses.

Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins. McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.

Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion. The exchange said the total could increase as its teams work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. Binance said it would publish further figures once verified.

World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He. “USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff. World Liberty Financial said it worked with BitGo to freeze the stolen WLFI and USD1 funds. “We will cooperate fully with the ongoing investigation and support efforts to hold those responsible accountable. Protecting our users remains a top priority,” said World Liberty in a post on X.

Binance says its team is conducting security checks and will resume withdrawals as soon as the “security issue” is resolved.

Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack. In a governance forum update posted after the freeze, risk service provider LlamaRisk said the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time. The borrowing occurred between 8:58 pm and 9:01 pm UTC on Oct. 29, about 40 minutes before the first freeze. It was the exploiter’s only Aave position across all networks and versions, with no further interactions detected after 9:01 pm UTC. The position remained backed by $59.9 million in USDT collateral against $43.8 million in debt at the update’s start.