Binance, the world’s largest cryptocurrency exchange by trading volume, is responding to a major security incident involving an estimated $6.3 billion in affected digital assets. The exchange says it will cover the financial impact and has been replacing the affected assets while working with law enforcement and blockchain security firms.
The incident occurred on October 29, 2026, according to Binance’s security updates. The company reported that its hot wallets were compromised, resulting in unauthorised withdrawals of digital assets.
Binance temporarily suspended withdrawals while it investigated the incident and checked the security of affected systems. Deposits and unaffected platform services remained operational, according to the exchange.
By October 31, Binance said it had replenished approximately 90% of the affected assets. In an update published on November 1, the company said the figure had risen to approximately 95% and announced plans to resume withdrawals in phases.
The incident has raised important questions about exchange security, user access to funds, and the risks associated with storing digital assets on centralised platforms.
What Happened in the Binance Security Incident?
Binance reported that its hot wallets were compromised at approximately 20:05 UTC on October 29, 2026.
Hot wallets are cryptocurrency wallets connected to online systems. Exchanges use them to process transactions and provide liquidity for customer withdrawals.
Because hot wallets connect to online infrastructure, exchanges must protect them through security controls, access restrictions, monitoring, and checks designed to prevent unauthorised transactions.
Binance said the incident involved unauthorised withdrawals and estimated the financial impact at approximately $6.3 billion.
The company initially suggested that a compromised laptop belonging to a DevOps engineer might have played a role. A later update said investigators had identified additional points of compromise.
Binance stated that it had found no evidence of wallet private keys being leaked. The investigation was still ongoing in the company’s latest update.
The distinction matters because the full attack method had not yet been established publicly. Reports about the possible entry point should therefore be treated as preliminary until Binance releases its technical investigation.
The exchange said it was working with law enforcement, blockchain intelligence firms, asset issuers, and other industry partners to investigate the incident and trace the affected assets.
Sources: Binance’s official security updates and Associated Press reporting.
Binance Says It Will Cover the Financial Losses
One of Binance’s main responses has been its commitment to cover the affected assets rather than pass the loss to customers.
The exchange said it had set aside more than $6.34 billion in company funds to address the incident. It also reported that approximately $5 billion in replacement tokens had been secured in an earlier update.
By October 31, Binance said it had covered around 90% of the affected amount. Its November 1 update raised the reported figure to approximately 95%.
The company said the remaining portion involved less-liquid tokens that required more time to source in the necessary quantities.
Binance reported that it was using resources from its Secure Asset Fund for Users, its Futures Insurance Fund, and its corporate treasury to cover the losses. It also said it planned to replenish the Secure Asset Fund for Users, commonly known as SAFU, to approximately $1 billion.
These commitments are important, but readers should distinguish between the company’s stated plan and independent verification of every affected balance.
Binance says customer losses from the incident will not be passed on to users. Its public updates also describe its efforts to replace the affected assets and strengthen security controls.
The company’s response will remain under scrutiny as the investigation continues and further information becomes available.
Source: Reuters’ October 31 report on Binance’s recovery efforts.
Approximately $3 Billion in Affected Assets Frozen
Binance and its industry partners reported that approximately $3 billion in affected assets had been located and frozen on-chain by October 30.
Freezing digital assets can limit the ability of an attacker to move or exchange tokens. However, the process depends on the type of asset, the blockchain involved, and the cooperation of organisations that control relevant services.
Some stablecoin issuers have tools that allow them to freeze tokens at specific addresses under certain circumstances. Other digital assets do not have the same centralised controls.
The ability to freeze funds does not automatically mean the assets have been returned to Binance or that the investigation has concluded.
Reuters reported on October 31 that the FBI attributed the attack to TraderTraitor, a North Korean state-sponsored cyber unit. The FBI also said members of the group had been observed converting stolen assets into Ethereum and expected further laundering activity.
The attribution is significant because cryptocurrency thefts have become an important source of concern for exchanges, regulators, law enforcement agencies, and blockchain security companies.
However, asset tracing and recovery can take time. Digital assets may move across multiple addresses and services, making the investigation more complicated.
Binance has said it will continue working with law enforcement and industry partners to recover affected assets and identify those responsible.
Source: Reuters’ report on the incident and the FBI attribution.
Binance Temporarily Suspended Withdrawals
Following the incident, Binance temporarily suspended withdrawals while its teams investigated the breach and checked the affected infrastructure.
The exchange said deposits and unaffected platform services remained operational during the review.
A withdrawal suspension is a significant disruption for customers because it limits their ability to move assets away from the platform. Even when an exchange says customer balances remain safe, users may be concerned about when normal access will return.
Binance said it took the precautionary measure to contain the incident, validate affected systems, and reduce the risk of further unauthorised activity.
The company also reported that it had revoked affected authorisations and introduced additional security controls.
On November 1, Binance announced that it was preparing to resume the first phase of withdrawals between 06:00 and 09:00 UTC. The company said the rollout would happen progressively after security and readiness checks.
The first phase covered selected assets and networks, including Bitcoin, Ethereum, BNB Chain, Tron, Solana, XRP, and other supported networks.
Binance warned that users might experience temporary delays or longer processing times during the initial rollout. It advised users to check the withdrawal page or network status information for the latest availability.
The announcement represents progress, but the phased approach means customers should not assume every token and network will become available at the same time.
Source: Binance’s November 1 recovery update.
Binance Says 95% of Affected Assets Have Been Replenished
The recovery process has moved quickly, according to Binance’s public updates.
On October 30, the exchange said it had covered approximately 80% of the affected amount. On October 31, it reported that the figure had increased to 90%.
In its November 1 update, Binance said it had covered approximately 95% of the impacted amount.
The company said balances in ten listed assets were fully backed at a 1:1 ratio. These included Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD, and ZEC.
The exchange also said the remaining 5% consisted of tokens outside that group that were less liquid and took longer to acquire in the required quantities.
Replenishment refers to the exchange obtaining replacement assets to cover the affected amount. It does not mean every stolen token has been recovered from the attacker.
This distinction is important. An exchange might replace missing assets using its own resources while investigators continue trying to locate and freeze the original funds.
Binance said it planned to continue acquiring the remaining tokens and publish additional information as the investigation progressed.
The company also announced a new proof-of-reserves snapshot as part of its efforts to provide customers with more information about platform assets.
Source: Binance’s November 1 recovery update and Reuters reporting.
What Is Proof of Reserves, and Why Does It Matter?
Proof of reserves is a method used by cryptocurrency platforms to provide evidence about the digital assets they hold.
Exchanges publish reserve information to help customers assess whether the platform holds assets corresponding to reported customer balances.
Binance said it had taken a new snapshot of assets held on its platform as of 00:00 UTC on October 31. The company said users holding certain listed tokens would be able to verify that those assets were backed at a minimum ratio of 1:1 once the full information became available.
Proof of reserves is useful, but readers should understand its limits.
A reserve snapshot provides information about assets at a particular time. By itself, it does not provide a complete picture of every liability, obligation, internal control, or operational risk facing an exchange.
The quality of a proof-of-reserves report depends on its methodology, the information included, and the extent of independent verification.
Customers should also distinguish between an exchange’s statement that balances are backed and an independent assessment of the company’s full financial position.
Following the Binance incident, updated reserve information could help customers evaluate the company’s claims about replacement assets and account backing.
The exchange has said it intends to provide further information as its recovery work continues.
What the Incident Means for Cryptocurrency Exchange Security
The incident highlights the importance of security controls at centralised cryptocurrency exchanges.
Exchanges manage large amounts of digital assets and must protect the systems used to approve transactions, process withdrawals, and manage wallets.
A compromise involving internal access, employee devices, or operational infrastructure could create risks even when there is no evidence of a wallet private key leak.
The incident also shows why exchanges need multiple layers of security. These include restricted access, transaction monitoring, authorisation checks, secure employee devices, and procedures for responding to suspicious activity.
No single security measure removes every risk. Companies need to review their systems regularly and investigate unusual activity quickly.
For users, the incident is a reminder that holding assets on an exchange involves platform-related risks in addition to the price risks associated with cryptocurrency markets.
Customers should follow official security updates and avoid relying on unverified claims circulating on social media.
They should also be cautious about messages claiming to offer emergency refunds, account recovery, or special access following a security incident. Such messages might be used to trick people into sharing account credentials or approving fraudulent transactions.
Binance has advised customers to rely on official channels for verified information.
How the Incident Affected the Wider Crypto Market
The incident attracted attention across the cryptocurrency market because Binance is one of the industry’s largest trading platforms.
Reuters reported that cryptocurrency prices fell during the period following the breach, with Bitcoin declining below $79,000 at one point on Thursday evening.
Market reactions to security incidents often reflect concerns about the affected platform, potential losses, and the possibility of further disruption.
However, price movements during the incident should not be treated as proof that the breach alone caused every market decline. Cryptocurrency prices respond to many factors, including broader financial conditions, investor positioning, liquidity, and other market news.
The scale of the reported loss also drew attention to the importance of coordination between exchanges, blockchain analytics firms, token issuers, and law enforcement.
The ability to trace and freeze some affected assets shows how cooperation between these groups can support investigations.
At the same time, the incident highlights the limits of those efforts. Not every asset is equally easy to trace, freeze, or recover, and some tokens have fewer controls than others.
What Happens Next for Binance?
Binance’s immediate priorities include restoring withdrawal services, completing its security review, replenishing the remaining affected assets, and continuing its investigation.
The November 1 update said withdrawals would resume in phases after the relevant security checks. Customers should check the exchange’s official withdrawal page for the current status of individual assets and networks.
The company also plans to publish a more detailed post-incident report after the investigation is complete.
That report should provide more information about the sequence of events, the points of compromise, and the additional safeguards being introduced.
The investigation into the stolen assets is also continuing. Binance and its partners are working to trace the funds and support recovery efforts.
The FBI’s attribution of the attack to TraderTraitor adds an important law-enforcement dimension to the case. However, further investigation will be needed to establish the full technical details and identify the people responsible.
Binance’s ability to complete the recovery process and restore normal services will be important to rebuilding customer confidence.
Final Thoughts
Binance is dealing with a major security incident involving an estimated $6.3 billion in affected digital assets.
The exchange says it will cover the financial impact and reported that approximately 95% of the affected amount had been replenished by November 1, 2026. It also announced plans to resume withdrawals in phases following security checks.
The incident remains significant because it raises questions about exchange security, the protection of customer assets, and the challenges of tracing stolen cryptocurrency.
Binance has taken steps to contain the incident and restore services, but the investigation is ongoing. Its planned technical report and further reserve information will provide additional details about the company’s response.
For now, customers should rely on official updates, avoid unverified claims, and check withdrawal availability for their specific assets and networks.
Frequently Asked Questions
1. How much was affected in the Binance security incident?
Binance reported an estimated impact of approximately $6.3 billion in digital assets following unauthorised withdrawals from compromised hot wallets on October 29, 2026.
2. Will Binance customers bear the reported losses?
Binance says it will cover the financial impact through its Secure Asset Fund for Users, Futures Insurance Fund, and corporate treasury. The company reported that approximately 95% of the affected amount had been replenished by November 1.
