Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen

What it is

Binance disclosed a suspected security incident on 29 October 2026 and estimates $6.3 billion in affected assets. About $3 billion has been frozen on-chain, and control of some assets was partially recovered with partners. Binance calls it a security incident under investigation. Changpeng Zhao, former CEO and major shareholder, said: "It does look like a hack on Binance."

How it works

Binance's initial finding is that a potentially compromised DevOps engineer's laptop let an attacker enter a service container and submit unauthorized withdrawal transactions. Binance says it found no evidence of a wallet private-key leak. The page gives no further technical detail, such as how the laptop was compromised or what the container could reach.

The article lists who froze what:

• Tether: about $1.6 billion in USDT (per CEO Paolo Ardoino).
• Circle: more than $800 million in USDC (per CEO Jeremy Allaire).
• Ripple: $200 million (per Yi He, Binance co-founder).
• World Liberty Financial with custodian BitGo: $27 million in stablecoins and about $2 million in World Liberty tokens (per Yi He).

Arkham Intelligence linked nearly $6 billion in bitcoin, ether, solana and stablecoins to 55 wallet addresses tied to the potential exploit.

Response and status

• Deposits and withdrawals were suspended from about 00:30 GMT on 30 October, along with Alpha trading and some other products.
• Binance revoked the affected address authorization and brought in law enforcement and blockchain intelligence firms.
• Yi He later said deposits were operating normally. Binance expected to begin restoring withdrawals within 48 hours.
• Binance will cover losses from its Secure Asset Fund for Users and company funds.
• A detailed technical report and an updated Proof of Reserves are promised after the investigation and remediation.

Caveats

• TRM Labs attributes the incident to TraderTraitor, the group linked to the February 2025 Bybit theft of $1.5 billion. TRM states high confidence, citing on-chain and off-chain intelligence. The article notes that this is TRM's assessment only.
• Chainalysis said that, if confirmed, this could be the largest cryptocurrency heist. At $6.3 billion it would be more than four times the Bybit loss.
• The entry point is described as "potentially" a compromised laptop. Binance has not yet published verified findings.
• Market effects reported: bitcoin fell 3.2% on 29 October and more than 4% on 30 October, and Circle shares fell about 5% after hours on 29 October.
• Binance held about $162.8 billion in custody and had 335 million registered users, per its 2025 annual report.