Binance covers $6 billion of the $6.3 billion stolen in hack

Industry experts assert that the Binance hack, amounting to a record $6.3 billion and becoming the largest cryptocurrency theft globally, demonstrated operational weaknesses in crypto exchanges rather than any issues with the blockchain technology itself.

The world's largest cryptocurrency exchange estimated the total alleged damage at approximately $6.3 billion, which is four times the amount stolen during the previous record—the Bybit hack. About $3 billion in assets that passed through wallets linked to hackers were identified and frozen. The exchange promised to cover all incurred losses.

Binance reported that initial investigations pointed to a compromised DevOps engineer's laptop, which allowed the attacker access to a service container and sent unauthorized withdrawal transactions. Later, the exchange clarified that further study uncovered additional points of entry, contradicting the initial finding of a single compromised laptop. However, the exchange stated it found no evidence of private wallet key leakage.

The UAE financial services regulator overseeing the Abu Dhabi Global Market stated that it is aware of the incident and is monitoring the situation. Binance confirmed that it has allocated over $6.34 billion from its own funds to cover the consequences of this incident.

Georgy Kucherin, Senior Security Researcher at Kaspersky GReAT, noted that the attack on Binance and a separate incident on the Polymarket prediction platform involving a compromised script from third-party developer DebugBear prove that exchanges can be hacked both through internal systems and external dependencies. He added that technical personnel remain the weak link, as even experienced engineers can inadvertently upload malware.

Sandip Pyapali, founder and CEO of Mesta, suggested that the attacker likely used the exchange's own access channels. He believes that if the hacker gained privileges through an employee's device, the system might have accepted the withdrawals as legitimate. Pyapali characterized the event as a 'maturity test' for the crypto industry, not a catastrophe, noting that exchanges will now require more robust safeguards, deeper insurance, and larger reserves.

Karsten Menke, Head of Next Generation Research at Julius Baer, stated that this incident is a 'company problem, not a crypto problem,' thereby highlighting the risks of holding assets on centralized exchanges. He recommended using self-custody in offline cold storage to reduce risk exposure. Menke also mentioned that there is no evidence of AI involvement in the attack, but noted that AI reduces the cost and speed of sophisticated attacks. He cited industry estimates that one of four malicious attacks now utilizes AI, reiterating Julius Baer's constructive view on cybersecurity.

Vincent Choc, CEO and Founder of First Digital, noted that the past day showed how crucial coordination between exchanges, issuers, and networks is when they exchange information within hours. Sergey Kunts, co-founder of 1inch, reported that Tether and Circle froze over $2.4 billion in stablecoins, and other teams blocked addresses associated with the exploit. According to him, this 'significantly limited' the attackers' ability to move funds.

The global cryptocurrency exchange Binance has become the victim of a hack amounting to $6.3 billion, which analysts consider the largest crypto heist in history. This incident may prompt investors to reassess the risks associated with holding digital assets.

According to statements from American blockchain analysis firms TRM Labs and Chainalysis, the hackers behind the attack are allegedly from North Korea. The attackers targeted Binance wallets across 10 different blockchains and moved the majority of the funds in approximately 20 minutes, as reported by TRM Labs.

Binance stated that it cooperated with partners to freeze the affected assets, and about $3 billion has been recovered so far. The status of the remaining $3.3 billion has not been disclosed. Co-founder Yi He announced that the exchange will cover 'all losses from the hack.'

The exchange also assured users that deposits were unaffected and expected to resume withdrawals within 48 hours. TRM noted that some aspects of the attack align with previous North Korean heists, including the 2025 hack of the Bybit exchange, which was attributed to the US Federal Bureau of Investigation in Pyongyang. North Korean missions in Geneva and its embassy in China did not respond to requests for comment.

Aravind Srinivasan, Head of Systematic OTC Business at GSR, a major cryptocurrency market maker, called it the 'biggest hack in history.'

Market Reaction

Markets reacted immediately during Friday's trading in Asia. Bitcoin's price dropped by more than 3%, reaching a six-week low of $76,368, while Ethereum fell by over 3%, dropping to a two-month low of $2,178. The BNB token, originally launched as Binance Coin for paying Binance fees, lost 5% in 24 hours, settling at $709.70, according to the CoinGecko market aggregator.

Analysts believe this breach could have broader implications for the crypto industry, which is already facing pressure from rising interest rates in the US and weakening demand from ETF buyers. Tim Sun, a senior researcher at HashKey Group in Hong Kong, noted that this could further reduce risk appetite and prompt investors to re-evaluate the security of assets held on centralized exchanges, as well as counterparty, solvency, and liquidity risks.

Initial investigations suggested that the hack might have started with an infected laptop belonging to one of Binance's engineers, allowing the attacker to gain access to one of the systems and execute unauthorized withdrawals. Binance explained that the 'incident was caused by multiple factors,' and its security team is tracking the full attack path through the compromised computer that may have served as the entry point.

Binance, which allows users to buy, sell, and trade digital assets, has 335 million registered users and held assets under custody worth approximately $162.8 billion according to its 2025 annual report. The exchange stated that 'user funds remain safe.' Furthermore, it manages a user asset protection fund—a reserve composed entirely of Bitcoin—intended to protect user assets in case of a security breach.

Bernardo Brites, CEO of Trace Finance, a payment infrastructure and stablecoin company, stated: 'It is becoming very difficult to counter hacks because AI can find vulnerabilities faster than you can fix them.' He believes that users will start moving away from small and medium-sized exchanges as it becomes too risky to place money where the exchange cannot cover a significant hack.

Stablecoin issuer Tether reported freezing nearly $1.57 billion in assets related to the incident, while Circle froze over $800 million. Crypto company World Liberty Financial, associated with US President Donald Trump and his family, announced on Thursday that it had frozen funds stolen in the Binance hack, as they described it, jointly with cryptocurrency custodian BitGo. Yi reported that $27 million in stablecoins and about $2 million in World Liberty tokens were frozen.

Series of Heists

Yi also reported that the crypto company Ripple froze approximately $200 million. Jack McDonald, Vice President of Stablecoins at Ripple, stated that the company is closely monitoring reports of a potential exploit related to Binance and is freezing affected funds while coordinating with relevant parties.

The separate exchange Binance.US stated that it was unaffected. Coinbase also confirmed it was not affected and is monitoring the situation. Miguel Morel, CEO of blockchain intelligence firm Arkham, reported that data indicates billions of dollars were stolen from Binance by an unknown perpetrator.

This incident adds to a series of crypto thefts. According to TRM Labs researchers, hackers conducted nearly 150 attacks last year, resulting in the theft of $2.9 billion in cryptocurrency. In September, the exchange Bitget reported a theft of approximately $350 million in cryptocurrency from its platform.

Authorities warn that organized crime groups are increasingly using cryptocurrencies for cross-border fund transfers outside the traditional financial system. In an unrelated incident earlier on Thursday, the prediction market operator Polymarket temporarily suspended trading following a security incident involving a third-party provider but later resumed trading and promised to fully compensate affected traders.

The cryptocurrency exchange Binance has estimated the total damage from a major security incident to be approximately $6.3 billion. As part of coordination with blockchain partners, about $3 billion in digital assets has been frozen.

In an update published on October 30, 2026, the world's largest cryptocurrency exchange by trading volume reported that preliminary investigation suggests the incident may have originated from a compromised DevOps engineer's laptop. It is presumed that the attacker used this access to enter a service container and send unauthorized withdrawal transactions.

Binance stated that it found no evidence of private key wallet compromise. The company added that a detailed technical report following the incident will be published after the investigation and verification of results are complete.

As a precaution, the exchange temporarily suspended all deposit and withdrawal operations while security checks are underway. Furthermore, authorization for the affected address was revoked, and the company engaged law enforcement agencies and blockchain analysis firms to track and recover funds.

Binance assured clients of the safety of their assets, stating that it covers all losses resulting from the incident using its Secure Asset Fund for Users (SAFU) and its own corporate funds. An updated Reserve Confirmation is also planned for publication after the issues are resolved.

This incident triggered a wider industry reaction: blockchain partners and digital asset issuers froze funds related to the hack. Binance reported that approximately $3 billion has been frozen so far, and recovery efforts are ongoing.

The exchange is working with law enforcement to identify those responsible. The full scope of the hack and the final amount of losses remain subject to further investigation.