Binance allocated over $6.34 billion in corporate funds on October 30, 2026, to absorb losses from a major security exploit. The exchange placed the estimated total impact at $6.3 billion.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
— Binance (@binance) October 30, 2026
The company confirmed in an official statement on X that $5 billion was already held in the affected tokens. The remaining balance is being acquired via spot and over-the-counter purchases.
The capital allocation excludes inmovilized balances. $3 billion in crypto remains frozen across industry partners and law enforcement agencies. The frozen assets include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP, and ARB.
The rapid automated transactions during the exploit once again raise concerns regarding how automated cybercrime multiplies exploits across large digital asset architectures.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
— Binance (@binance) October 30, 2026
The exchange specified in an operational service update that deposits have resumed normal execution. Outflows remain halted while withdrawal service infrastructure is upgraded. Full withdrawal processing is scheduled to resume by November 1, 2026.
I want to speak to you directly about what happened.
Bottom line – your money is safe, and we're covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a…
— Richard Teng (@_RichardTeng) October 30, 2026
Co-CEO Richard Teng explained in a public social statement that the DevOps laptop compromise was not a single one-click breach. Teng reiterated that investigators detected no wallet private key leakage.
Subsequent internal technical reviews identified additional breach points within internal services. The intruder leveraged an internal container to issue unauthorized withdrawals without extracting root credentials.
On-chain laundering paths resemble established mixing mechanisms, including historical movements through Tornado Cash protocol pools, where non-custodial tools impede swift recovery.
Cybersecurity analytics firms attributed the attack to the North Korean group TraderTraitor. Chainalysis calculated the initial stolen volume at $5.912 billion at the precise time of the theft.
On-chain investigator ZachXBT observed that funds stolen from Binance commingled with Bitget exploit proceeds at a single address on Friday via THORChain. TRM Labs reported attributing the attack to the DPRK unit with high confidence based on on-chain signatures.
Ecosystem issuers acted quickly. First Digital halted transfer capabilities for FDUSD. Simultaneously, the Arbitrum Security Council executed an emergency transaction freezing 74.6 million ARB alongside 8,425 ETH in an intermediary wallet.
World Liberty Financial froze $27 million in USD1 and $2 million in WLFI in coordination with BitGo. Ripple took similar steps by freezing RLUSD holdings associated with the target addresses.
In decentralized lending markets, Aave froze 175 reserve pools on V3 and 117 on V4. The measure followed an exploit deposit of 60 million USDT used to borrow 19,762 WETH.
Market makers GSR and Wintermute disclosed operational exposures below 5% and 20% of their net equity, respectively, without signaling business interruptions.
Spot asset prices reacted negatively, with Bitcoin falling 4.9% to $76,937 on October 30, 2026. BNB dropped 8% to trade around $693.
Binance stated that a full post-mortem analysis will be published once joint technical investigations with law enforcement conclude.
This article is for informational purposes only and does not constitute financial advice.
