Binance Finds 'Additional Points of Breach' in $6.3B Hack

What it is

Binance's 30 October 2026 update on a hot-wallet theft it puts at about $6.3 billion. The exchange says its first explanation, a compromised DevOps engineer's laptop, was incomplete and that its investigation has found "additional points of breach." Binance has not yet named them.

How it works

Binance's first account was that the laptop gave an attacker access to a service container, from which the attacker submitted unauthorized withdrawal transactions. Binance said it found no evidence of a wallet private key leak. CEO Richard Teng now says the attacker "did not simply use one engineer's permissions" and that this was not a single "one-click" action. Teng has not attributed responsibility to any individual.

Arkham says the funds left Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on Thursday 29 October. It counts $6.01 billion taken. Binance says outflows stopped when it paused withdrawals.

Response and current state

• Binance revoked the affected address authorization and says it is rebuilding the withdrawal service and its related addresses. Deposits were operating normally by Friday morning, and withdrawals are still suspended.
• Binance says it remains on track to resume withdrawals in 45 hours.
• Binance says it will cover all losses from its SAFU fund and company funds.
• A detailed technical post-mortem and an updated Proof of Reserves are promised once the investigation and remediation finish.

Fund tracing

Arkham says issuers froze $2.80 billion, while $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens could still be moved. Tether froze about 975.1 million USDT and Circle about 823 million USDC in the main receiving wallet, about $1.8 billion in all.

The attacker is still moving funds. Early Friday, the wallets sent $38.82 million in ETH to a new address, and a Tron address tagged as the attacker's split about $2.1 million in TRX across nine addresses in 14 transfers. Arkham's attacker entity page showed about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, plus frozen stablecoins.

Caveats

The page gives no technical detail on the additional breach points, so there is nothing yet to check in your own environment. Binance's account and the $6.3 billion estimate are unverified and still changing. The $6.3 billion (Binance) and $6.01 billion (Arkham) figures come from different sources and are not reconciled. The Thursday tally of $5.57 billion shows the totals rose as counting continued.