TechReview
Cybersecurity

Binance Confirms Breach, Estimates $6.3 Billion Impact and Suspends Withdrawals

Published By Shivam Sharma6 min read
Binance logo above the headline 'Binance Breach: $6.3B, Withdrawals Suspended' on a dark background

Binance has confirmed a breach in a statement shared with BleepingComputer, put the estimated impact at $6.3 billion, and suspended withdrawals while it overhauls withdrawal security. The exchange says it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, and it has promised a detailed technical post-mortem and an updated Proof of Reserves once remediation is complete. As of the evening of 30 October IST, withdrawals remain suspended, with co-founder Yi He saying Binance expects to begin resuming withdrawals within 48 hours.

The confirmed core is short. Everything else splits into two piles: what Binance and the freeze tallies confirm, and what analysts estimate but nobody has confirmed.

Every headline number measures something different

Seven figures are circulating, and they disagree because they measure different things: different analysts, different asset coverage, different valuation times and different cut-offs. Our analysis lines them up by what each one measures, not as one settled accounting.

Figure Who said it What it measures
$6.3 billion Binance Company estimate of total impact
$6.36 billion TRM Labs Moved across ten blockchains, mostly within about 20 minutes from 20:05 UTC on 29 October
$5.912 billion Chainalysis At least this much stolen, as of 00:30 GMT on 30 October
$5.3 billion Glassnode Estimated amount drained
About $1 billion DefiLlama founder 0xngmi Founder’s estimate of net loss after freezes, about 0.69% of about $144 billion in Binance assets under custody
About $3 billion frozen Binance Binance’s verified on-chain frozen total
About $2.7 billion frozen TRM Labs, itemised Stablecoin and chain-level freezes at about 00:30 UTC on 30 October, including 8,426 ETH and 74.6 million ARB frozen by Arbitrum

Two cautions from that table. First, the frozen tallies are not directly interchangeable: TRM timestamps its tally at about 00:30 UTC on 30 October, while Binance reports its later verified total without the same asset-level breakdown. Second, the about $1 billion net figure is a founder’s estimate based on frozen USDT and USDC and assets under custody, not a reconciled net-loss calculation Binance confirmed. At TRM’s 00:30 UTC cut-off, the attacker still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach, a snapshot, not a current balance.

What Binance says happened

Binance’s preliminary account, which it stresses is still under investigation: the incident may have started with a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorised withdrawal transactions. Binance says it has found no evidence so far of any wallet private key leak. Co-CEO Richard Teng added that the attacker did not simply use one engineer’s permissions and that this was not a single one-click action: it involved a more complex process. Binance also says it uncovered additional points of breach but is still gathering the facts, and it has revoked the affected address authorisation. Outflows from Binance stopped when the withdrawal service was paused.

On the Bitcoin side, CoinDesk’s on-chain analysis says about 18,270 bitcoin (about $1.4 billion) left the hot wallet in 11 transfers at 20:20 UTC, confirmed in block 973,732, each built like an ordinary Binance withdrawal with valid signatures from Binance-controlled addresses, then split into 19 wallets within minutes. As of 04:23 UTC on Friday, none of those 19 wallets had sent funds onward. CoinDesk’s analysis of Binance’s 1 October proof of reserves puts the roughly 204,500 ETH taken at about 5.6% of Binance’s ETH reserves, which would leave ETH backing near 94% on that snapshot if the missing assets had not been replaced.

On deposits, Binance’s statements moved: the first suspension covered deposits and withdrawals, while later updates from Yi He and Teng say deposits are operating normally and only withdrawals remain suspended. Binance Alpha trading was also paused. Binance TH, the Thai exchange run by Gulf Binance, has temporarily suspended digital-asset deposits and withdrawals for a security check while trading runs normally, and says its cold wallets are separate from Binance’s. Binance.US, a separate exchange, said it was not affected, the Thaiger reports.

What is claimed, not confirmed

Attribution is the biggest claimed item. TRM Labs assessed with high confidence that North Korea’s TraderTraitor unit carried out the attack, and Chainalysis backed that assessment with a high degree of confidence. Binance itself has not attributed the attack to any individual or group. Treat TraderTraitor as an analyst assessment, not a confirmed attribution.

TRM also calls this the largest crypto theft on record, about four times the Bybit hack of February 2025. That superlative is TRM’s, and it rests on TRM’s $6.36 billion moved figure; BleepingComputer puts the Bybit breach at $1.5 billion while TechCrunch put the same breach at $1.4 billion, so even the comparison baseline is not settled. The reporting reviewed gives no affected-user count and does not establish the status of individual customer balances.

Are my Binance funds safe, and what should I do?

Binance says user funds are safe and it will cover all losses from SAFU and company funds. Withdrawals remain suspended while security checks run, with Yi He saying Binance expects to begin resuming withdrawals within 48 hours, an expectation, not a full-restoration guarantee. Until Binance itself announces resumption, treat other resumption claims as suspect.

  1. Use only official Binance channels for updates on withdrawal resumption and the promised technical post-mortem.
  2. Ignore messages claiming to be Binance support and asking for account information or login details.
  3. Do not click links promising early withdrawal resumption, fund recovery help, or SAFU compensation forms.
  4. Wait for Binance’s own resumption announcement before retrying any withdrawal or moving funds elsewhere on the platform.
  5. Check the updated Proof of Reserves once Binance publishes it after remediation, and compare it against the October snapshot.

What to watch next

Four things would move this story: the detailed technical post-mortem Binance promised, the updated Proof of Reserves after remediation, the start of withdrawal resumption inside the 48-hour window Yi He pointed to, and any Binance or law-enforcement statement confirming or rejecting the TraderTraitor attribution. In a later update at 08:47 UTC on 30 October, Binance said it remained on track to resume withdrawals in approximately 45 hours, pointing to about 11:17 IST on 1 November, still an operational target, not a confirmed reopening time. Until then, the loss total stays an estimate and the attacker stays unattributed by Binance.

Not connected to the Polymarket halt

Earlier on Thursday 29 October, Polymarket briefly halted trading after a third-party compromise; trading was restored later that day, and Arkham traced about $2.65 million to a suspected attacker wallet, a suspected balance, not a confirmed loss total. That incident is separate from the Binance breach and has its own fact pattern.

Sources

Related reviews and guides