Binance has suffered a $6.3 billion cryptocurrency theft, described by Reuters as the largest crypto heist on record, prompting a withdrawal suspension and an international effort to trace and freeze stolen assets.
Blockchain analysis firms TRM Labs and Chainalysis attributed the attack to North Korean hackers with high confidence. Binance’s investigation remains ongoing, and the exchange has not independently confirmed that attribution.
In an updated statement dated October 30, Binance said it had set aside more than $6.34 billion in company funds to absorb the financial impact. It also reported that approximately $3 billion in stolen assets had been frozen on-chain with assistance from industry partners. Binance Support
Binance Says Customers Will Not Bear the Loss
Binance has pledged to cover the stolen funds through its Secure Asset Fund for Users, known as SAFU, and its corporate treasury.
The scale of the theft exceeds the exchange’s previously described $1 billion SAFU reserve, making the additional company resources central to its response.
In its latest update reviewed for this article, Binance said $5 billion was already held in the same types of token assets affected by the theft, with purchases underway for the remainder.
That is a statement from the company about its response, rather than independent confirmation that every financial consequence has been resolved.
The distinction between covering losses and restoring withdrawals also matters. An exchange may allocate replacement assets while continuing to restrict transfers during security checks.
Withdrawals Suspended Pending Security Reviews
Binance suspended withdrawals after discovering the breach.
Its October 30 update said withdrawals would restart in phases following security validation. The company gave an approximate 34-hour target from that update, rather than an unconditional reopening deadline.
The same statement said deposits and unaffected services were operational. Binance also planned to publish updated proof-of-reserves results by November 2, 2026. Binance Support
Customers should not interpret the earlier report’s “next 45 hours” as a fresh countdown. Such estimates are tied to the time of the original statement and can change as remediation progresses.
Around $3 Billion Frozen, but Recovery Is a Separate Step
Stablecoin issuers and other industry participants moved to restrict assets linked to the attack.
The original Reuters report cited freezes involving Tether, Circle, World Liberty Financial and Ripple, alongside coordination with custodians and other partners.
| Reported Financial Measure | Amount |
|---|---|
| Estimated assets stolen | $6.3 billion |
| Assets frozen, according to Binance’s update | Approximately $3 billion |
| Company funds allocated to cover losses | More than $6.34 billion |
| Replacement funds already held in affected token assets | Approximately $5 billion |
Frozen does not mean recovered. Restricting the movement of stolen tokens can prevent further transfers, but returning them involves additional technical, legal and operational steps.
Likewise, replacement assets funded by Binance are separate from stolen funds that may eventually be recovered. These figures should not be added together as though they represent a single recovery total.
Investigators Examine a Compromised Laptop and Other Breach Points
Binance’s preliminary account suggested that a compromised engineer’s laptop may have provided access to systems used to submit unauthorised withdrawals.
The exchange subsequently said it had identified additional breach points. It also stated that it had found no evidence of leaked wallet private keys at that stage.
That qualification is important because early outside commentary suggested attackers might have obtained keys to multiple wallets. Binance’s account instead leaves open the possibility that the attackers abused transaction-authorisation infrastructure without directly extracting those keys. The complete attack sequence has not been established publicly. Binance Announcement on Binance Square
According to the Reuters account supplied, most of the theft unfolded over roughly 20 minutes late on October 29.
Analysts Attribute the Attack to North Korea
TRM Labs and Chainalysis said they were highly confident that North Korean hackers were responsible.
Their assessment reportedly drew on similarities with earlier attacks, including the 2025 theft at Bybit that the FBI attributed to North Korea.
That remains an attribution by specialist investigation firms. It should not be presented as a completed finding from Binance or a final determination by law enforcement.
North Korea routinely denies involvement in cryptocurrency theft. Its diplomatic representatives did not immediately respond to Reuters’ requests for comment in the supplied report.
FBI Confirms Engagement With Partners
Reuters separately reported that Binance was working with law enforcement internationally, including the FBI and US Secret Service, citing a person familiar with the situation.
The FBI confirmed that it was aware of the incident and coordinating with relevant public and private partners. The Secret Service had not responded to Reuters’ request for comment in that report. reuters.com
The investigation will need to establish how access was obtained, which controls failed and how the proceeds moved after leaving the exchange.
Cryptocurrency Prices Fell Following the News
The breach unsettled digital-asset markets.
In the October 30 Reuters report, bitcoin reached $76,368, while ether fell more than 3% to $2,178. BNB was reported down approximately 5% over 24 hours at $709.70.
| Asset or Company | Movement Reported After the Attack |
|---|---|
| Bitcoin | Reached $76,368 |
| Ether | Fell more than 3% to $2,178 |
| BNB | Down about 5% over 24 hours at $709.70 |
| Coinbase shares | Fell 4.8% |
| Strategy shares | Fell nearly 6% in extended US trading |
These are historical readings from the report, not live prices. Coinbase said it was unaffected by the breach.
Industry Faces Renewed Scrutiny Over Custody Controls
The theft raises questions about how exchanges protect the systems and personnel involved in authorising large transfers.
Following the incident, Coinbase said it had made precautionary changes to its offline key-storage systems, while Kraken said it was reviewing industry incidents for lessons applicable to its own defences, Reuters reported. reuters.com
For Binance, the immediate milestones are restoring withdrawals safely, substantiating its replacement-funding commitments and recovering frozen assets. Its promised technical investigation should also clarify whether the initial laptop compromise was the main entry point or one part of a broader intrusion.
The ultimate financial impact will depend on recoveries and remediation costs. The wider effect on confidence will depend on whether users can regain reliable access to their assets and whether the exchange provides a verifiable account of what happened.
Read Also: Sheikh Ahmed bin Saeed Mourns Sheikh Ahmed bin Rashid Al Maktoum
