Biance says around $3 billion has been frozen and has pledged to cover all losses through its emergency user-protection fund and corporate resources.
BY PC Bureau
October 30: The world’s largest cryptocurrency exchange, Binance, is investigating a massive security breach estimated to have exposed $6.3 billion in digital assets, with preliminary findings pointing to a compromised laptop belonging to a DevOps engineer. The attackers allegedly used the access to infiltrate a service container and initiate unauthorised withdrawal transactions, triggering one of the biggest security crises in the cryptocurrency industry.
Binance said approximately $3 billion worth of assets had been frozen on-chain through coordination with blockchain partners and stablecoin issuers. Deposits and withdrawals were suspended as the exchange moved to contain the breach and secure its systems.
The company has pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and additional corporate resources. It has also maintained that customer funds remain safe and that investigators have found no evidence of wallet private keys being compromised.
The incident has sent fresh shockwaves through the cryptocurrency industry, already grappling with a series of security breaches and technical vulnerabilities. It has also raised questions about the risks posed by compromised employee devices and weaknesses in the infrastructure supporting major digital asset exchanges.
@WatcherGuru ‼️ Binance says $2.54 BILLION in crypto FROZEN after major hack
Working to ‘trace and freeze additional assets’
Trackers claim suspected hacker making off with up to $5.8 BILLION https://t.co/3X27lCDzMg
— KobeJordan (@timothybumper) October 30, 2026
How the Binance breach occurred
Binance’s preliminary investigation indicates that the attack originated with a compromised laptop belonging to one of its DevOps engineers. The attackers allegedly exploited the access to reach a service container and submit withdrawal transactions without authorisation.
The exchange has estimated the financial impact at approximately $6.3 billion, although the full extent of the breach and the number of affected users remain unclear.
Former Binance chief executive Changpeng Zhao, popularly known as CZ, who stepped down from management in 2023 but remains a major shareholder, described the activity as appearing to be a hack. He also reiterated that user funds would be protected.
Binance.US, the exchange’s US-based affiliate, was reportedly unaffected.
Millions of users await clarity
Binance has more than 300 million registered users worldwide, but the company has not disclosed how many accounts were directly affected by the incident.
There is also no official breakdown of the impact on Indian customers. The reported breach concerns the main Binance platform, and the exchange has yet to publish a detailed account of the transactions or users involved.
The absence of a user-wise breakdown has added to uncertainty as the investigation continues.
READ: Gandhi Grandson Wins 30-Acre Virginia Land Battle
No evidence of wallet private-key theft
According to Binance, the breach did not involve a direct compromise of wallet private keys. Instead, investigators believe the attackers exploited access obtained through the engineer’s laptop to gain entry to an internal service environment.
The company said it had found no evidence that wallet private keys had been leaked. It plans to release a detailed technical post-mortem after completing its investigation.
Blockchain intelligence firms have also been tracking the movement of funds. TRM Labs has attributed the operation, with a high degree of confidence, to a North Korean-linked hacking group. Binance has not officially confirmed the attribution.
The suspected involvement of North Korean-linked cybercriminals adds an international dimension to the incident, given the group’s history of targeting cryptocurrency exchanges and digital asset platforms.
Binance promises to cover all losses
Binance suspended deposits and withdrawals while it secured affected systems, revoked compromised authorisations and coordinated with law enforcement agencies and blockchain analytics firms.
The exchange has promised to compensate users for all losses through its Secure Asset Fund for Users (SAFU), an emergency reserve established to protect customers against extraordinary losses, alongside additional corporate funds.
Binance has also indicated that it will publish an updated Proof of Reserves following the security measures and remediation work. The disclosure is expected to provide users with additional information about the exchange’s asset backing.
Billions frozen as crypto markets react
Stablecoin issuers and blockchain partners moved to contain the damage by freezing assets identified as connected to the breach.
Tether chief executive Paolo Ardoino said the company had frozen approximately $1.55 billion to $1.6 billion in related tokens. Circle chief executive Jeremy Allaire reported the freezing of more than $800 million.
Together with interventions by other industry participants, the amount of assets frozen on-chain has reached approximately $3 billion, according to the reported figures.
The incident also triggered volatility in cryptocurrency markets. Bitcoin fell by several percentage points, briefly slipping below $77,000, while Ethereum and Solana also recorded declines.
The breach has added to a series of cybersecurity incidents and software vulnerabilities reported across the digital asset industry during October. The accumulation of these events has prompted some market observers to describe the period as a potential ‘Black October’ for cryptocurrency security.
Binance has said it is working continuously with blockchain partners and other industry participants to trace and recover the stolen assets. It has urged customers to follow updates only through its official communication channels and avoid suspicious messages or links claiming to offer assistance.
A comprehensive technical account of the breach is expected after the investigation is completed. Until then, the incident is likely to intensify scrutiny of cybersecurity practices at major cryptocurrency exchanges, particularly their internal access controls and safeguards against attacks targeting employees and developer infrastructure.
