Binance says approximately $6.3 billion in crypto assets was stolen from its hot wallets on October 29, 2026, and has pledged to cover the losses. As of October 31, its published incident update still described withdrawals as suspended, with a phased restart dependent on security checks.
The exchange's October 30 statement said losses would be covered through its Secure Asset Fund for Users, known as SAFU, and company funds. Blockchain investigators have attributed the attack to a North Korean group, but that assessment remains separate from a completed law-enforcement determination.
What Binance says happened, and what changed
Binance placed the compromise at approximately 20:05 UTC on October 29. Hot wallets are connected to operational systems so an exchange can process transfers, making their controls a critical part of custody security.
Its first October 30 update described a preliminary theory involving a compromised engineering laptop and unauthorized withdrawal requests. A later statement identified additional points of breach. Binance said it had found no evidence of leaked wallet private keys, while acknowledging that its investigation remained unfinished.
The distinction matters: transactions can be improperly authorized through compromised infrastructure without investigators having established that private keys were copied. Neither the preliminary laptop explanation nor the absence of an identified key leak amounts to a complete account of the attack.
Binance also corrected its earlier announcement to clarify that deposits remained unaffected and operational. Older reports saying both deposits and withdrawals were suspended should therefore be read against that correction.
The loss estimates measure different things
TRM Labs put the theft at approximately $6.36 billion, valuing transfers when they occurred. Its analysis, reflecting blockchain observations through 00:30 UTC on October 30, covered ten blockchains and said most of the transfers happened within about 20 minutes. Chainalysis separately estimated approximately $6.4 billion in its October 30 report.
Those are estimates of assets removed, not the same measure as money permanently lost after recoveries. Nor are frozen assets automatically money returned to customers.
Binance's second update, published at 19:33 UTC on October 30, said it had allocated more than $6.34 billion in company funds, including about $5 billion already held in the types of tokens taken. It was still purchasing the remaining assets. These are company statements about replacement funding, not an independently audited balance sheet.
Why Tether and Circle could freeze funds
TRM's October 30 snapshot identified approximately 1.77 billion USDT frozen by Tether and roughly 825 million USDC frozen by Circle. Its overall frozen-asset estimate was around $2.7 billion at that cutoff. Binance's 19:33 UTC update reported approximately $3 billion frozen. These snapshots should not be added together.
Some stablecoins have issuer controls that can restrict transfers involving specific addresses. Circle's published policy says blocklisting can prevent an address from sending or receiving USDC. It also distinguishes that restriction from reversing a completed transaction, which it cannot do. Tether's terms likewise provide for freezing tokens and blacklisting addresses.
A freeze can stop further movement of affected tokens, but returning value to victims requires additional steps. It does not reverse every transfer associated with an incident or give issuers control over unrelated cryptocurrencies.
Investigators point to TraderTraitor
TRM attributed the attack with high confidence to TraderTraitor, a North Korean hacking group, citing blockchain and other intelligence. Chainalysis reached a similar assessment. It said funds from Binance mixed with proceeds from a previous theft that it had attributed to North Korean actors.
The FBI told Nextgov/FCW on October 30 that it was working with public and private partners to assess the incident and coordinate investigative steps. The bureau did not name North Korea in that statement. The firms' attribution should therefore remain attributed to them, rather than presented as an FBI finding.
Withdrawal access and the next reserves report
Binance's second October 30 update targeted the start of phased withdrawals within approximately 34 hours, subject to checks. It planned an initial reserves snapshot within 12 hours and publication of the results by November 2. These were targets, not confirmation that withdrawals had restarted or the promised report had been delivered.
The incident illustrates a basic exchange custody risk: customers depend on a provider's security and ability to process withdrawals. A commitment to replace assets addresses the financial shortfall; restoration of access is a separate operational question.
A proof-of-reserves report also needs careful interpretation. The SEC's investor education and accounting offices explain that these reports are not equivalent to financial-statement audits and may not show the full picture of liabilities. Binance's promised report, successful withdrawal restoration and the final technical findings will answer different questions. None should be treated as a substitute for the others.