Binance puts the hack at $6.3 billion: what you can do now

On October 29, 2026, Binance said for the first time where the attack on the exchange is believed to have started: on a work device. According to the preliminary investigation the company published on its account on X, the incident may involve the compromised laptop of a DevOps engineer. Through that device an attacker is said to have gained access to a service container and from there submitted unauthorized withdrawal transactions. In the same statement, Binance put the estimated total damage at around $6.3 billion.

That is the first figure to come from the exchange itself. The estimates of the preceding days came from analysis of blockchain data and were lower. If you are a customer, the second half of the statement matters more than the size of the number: Binance says it has found no indication that the private keys of its wallets were taken. What that does and does not mean is set out below.

What Binance says about the cause: a compromised laptop in the DevOps team

DevOps is the team that keeps the bridge between software development and live operations at a technology company. People who work there hold access rights by the nature of the job that ordinary staff do not have: to systems that move money in the background, reconcile accounts and release withdrawals.

That is exactly where Binance's account begins. The statement on X of October 29, 2026 says the initial investigation suggests the security incident involves a compromised laptop belonging to a DevOps engineer. The precise attack path, it adds, will only be established by the further investigation. Both points are phrased as possibilities, and that is no accident: a week after an incident of this size, the forensics are not finished.

The statement attributes no misconduct to the employee. A device can fall into the hands of attackers through malware in a download, through a tampered development library, or through a message aimed at one individual. Binance has not said which of those routes it was.

Service container and withdrawal interface: how the path ran, according to Binance

A service container is a self-contained software package in which a single service runs, such as the approval of withdrawals. Containers are used so that a service stays isolated and does not affect the rest of the system when it fails. That isolation only protects as far as access to it is protected.

On Binance's account, the attacker gained access to such a container via the laptop and then triggered withdrawals that nobody had authorized. Technically, that is fundamentally different from what most people picture as a hacked wallet. No key was cracked. A system was made to treat a payout as valid.

How that mechanism looked on-chain is what we set out on October 29 in our report on the hot wallet outflow.

No stolen private keys: why the distinction counts

A private key is the string of characters that moves balances held at a blockchain address. Whoever holds it can spend the funds, and nobody can claw that back. That is why the question of whether keys were taken is the most important one after any incident.

Binance says it has found no indication of that. If it stays that way, it means the exchange's addresses remain under its control, and whatever is still sitting there can be moved once the gap is closed. It does not mean that the funds already gone would have been safe. Those transfers are settled on the blockchain.

For the wider assessment it also means that custody in this case did not fail at the cryptography, but at an access route in operations. A hardware wallet protects you against precisely that: the device never hands the key to an operating system, and no service container can instruct it. Which devices qualify and what they cost is in our hardware wallet comparison.

$6.3 billion: the range of damage figures from October 29

The figures for the size of the loss diverge widely, and they are still moving this weekend. Side by side, as of October 30, 2026:

• Around $2.8 billion drained from a hot wallet: the estimate from blockchain data that the first reports on October 29 started with.
• More than $5 billion: the figure in the CoinDesk live blog of October 29, at a point when around $2.5 billion was considered frozen.
• Around $6.3 billion: Binance's own estimate, published on October 29 on X.
• Around $6.36 billion: the calculation by blockchain analytics firm TRM Labs, valuing each asset at its price at the moment it left. At October 30 prices, the same basket comes to around $6.23 billion on the firm's own figures.

Smoothing one of these numbers onto another would be wrong. The figures measure different things: the on-chain estimates count what went to identified attacker addresses, while the exchange's number covers the total damage on its own reckoning. Binance has not broken down how the $6.3 billion is composed.

Between $2.5 billion and $2.7 billion frozen: Tether, Circle and the Arbitrum Security Council

Part of the haul is no longer moving. Stablecoins such as USDT and USDC run through smart contracts whose issuers can block individual addresses. That is what happened, and it is the reason the ledger of this incident looks different from the big exchange thefts of earlier years.

Binance puts the verified frozen funds at $2.54 billion, of which more than $2.37 billion comes from blocks by Tether and Circle. In its statement of October 29, the exchange cites around $3 billion frozen together with partners from the blockchain industry. TRM Labs counts, as of October 30 at 00:30 UTC, around $2.7 billion blocked by issuers and by the Security Council of the Arbitrum blockchain, and around $2.4 billion that the attacker still holds in assets beyond the reach of issuers. What the Tether and Circle blocks cover in detail is something we counted up separately.

What is frozen is not recovered. A block stops the attacker from moving the tokens on or swapping them. Who ends up with them, and through which procedure, is decided much later, and in earlier cases that has taken years.

SAFU fund and company funds: what Binance promises on compensation

SAFU stands for Secure Asset Fund for Users, a reserve pot Binance set up in 2018 to cap customer losses after security incidents. Co-chief executive Yi He wrote on X that Binance will cover all losses from the incident through the SAFU fund and its own company funds, and that customer money is safe.

The fund is not a theoretical promise. Binance drew on it in 2019, when a theft took around 7,000 bitcoin off the exchange; customers had their balances replaced at the time. How large the pot is today, Binance did not say on October 29, and it gave no timetable for reimbursement either.

A pledge of this kind is a declaration of intent by the company, not a statutory deposit guarantee. For a bank account in Germany, deposit protection applies up to 100,000 euros per customer as a matter of law. That does not hold for balances at a crypto exchange, not even a licensed one. What a licence does deliver is in the next section.

Deposits and withdrawals suspended: where things stand on October 30

Binance has temporarily halted deposits and withdrawals. On our reading as of October 30, they are restarting coin by coin, with Solana and XRP still paused most recently while Bitcoin and Ethereum were already being processed again. The exchange has not named a date for full release.

For you, this is the part that hurts most, because it has nothing to do with the headline: as long as withdrawals for your coin are pending, you cannot reach your balance, regardless of whether the attack touched it at all. A transfer you start in this phase can sit in the queue without you being able to pull it back.

TraderTraitor: what TRM Labs attributes to the attacker

Since overnight there is an attribution from a firm that investigates such cases for a living. Blockchain analytics company TRM Labs assigns the attack to the group TraderTraitor, which it describes as North Korea's specialist unit for hacking operations, and writes that it reaches this judgement with high confidence. On its own account, the assessment rests on blockchain data and on findings from outside the chain. The FBI attributed the 2025 attack on the Bybit exchange to the same group.

The sequence TRM Labs describes adds to the exchange's account at one point that matters for the assessment. On Ethereum, it says, a Binance hot wallet was turned into an externally controlled sweeper through a delegation under the EIP-7702 standard. On nine further blockchains, by contrast, the wallets sent regularly signed transfers, from which the firm concludes that the signing infrastructure of those hot wallets was compromised. The outflow spread across ten blockchains, the bulk of it in about 20 minutes from 20:05 UTC. Binance itself has stated that it found no indication of private keys leaving. The two accounts stand side by side, and the difference has not been resolved.

For your access to your balance and for the reimbursement pledge, the attribution changes nothing. It is the assessment of an analytics firm, not an official finding; Binance has not endorsed it and has named no perpetrator. It is not irrelevant to recovery, though, because in past state-linked attacks frozen funds stayed tied up in proceedings for years.

Around $1.5 billion in liquidations: the market fallout on Friday morning

The market reacted more sharply to the news than to the number. On CoinGecko data, bitcoin trades at $77,563 on October 30, 2026, down 3.20 percent in 24 hours. Ether is at $2,225.86 and loses 4.03 percent, more than bitcoin. BNB, the exchange's own token, carries the incident most visibly: $702.35 after a drop of 6.27 percent. Solana stands at $96.73, down 3.43 percent, and XRP at $1.25, down 3.03 percent.

Leveraged positions were hit harder. Forced liquidations across the whole crypto market come to around $1.5 billion within 24 hours; the running tally is kept by Coinglass, whose extract CoinCentral reports at $1.5 billion on October 30. Reports vary between $1.49 billion and $1.54 billion depending on when they were taken, and the larger share falls on long positions. A running counter is not a fixed figure: anyone who opens it later sees a different window.

Leverage and liquidation: what a blocked account means with open positions

A liquidation is the forced closing of a leveraged position by the exchange, as soon as the margin no longer covers it. At five times leverage, around 20 percent of price movement against you is enough; at ten times, around 10 percent. The numbers above are the result of that mechanic in a single day.

The particular twist in an incident like this: paused deposits and withdrawals take away your ability to top up margin. Anyone holding a leveraged position who wanted to add fresh funds cannot do so while deposits for that coin are halted. The position keeps running anyway, and it is liquidated anyway.

Custody and key management: hardware wallet versus exchange account

The incident exposes a dividing line that blurs easily in day-to-day use. A balance on an exchange account is a claim against the company; the exchange holds the keys. A balance in your own wallet is property; you hold the keys. In the first case security rests on the operational security of a corporation, in the second on your own care.

Both carry a price. A hardware wallet costs money and requires you to store your recovery words so that neither fire nor strangers can reach them; lose them and the balance is gone, with nobody able to help. An exchange takes that burden off you and hands you in return the risk this October 29 has shown. Anyone holding larger amounts they do not trade usually shifts the trade-off towards self-custody.

Buying in Germany: MiCA licensing and what it covers

Since the EU's MiCA regulation, crypto service providers need a licence to serve customers in Germany; BaFin supervises them. The licence sets requirements for the segregation of customer assets, for custody and for reporting duties. Which duties apply in detail depends on the type of service.

What MiCA does not do: the regulation is no substitute for deposit protection, and it does not prevent a break-in through an employee device. It does require a provider to demonstrate how it holds customer assets, and it gives a supervisor access to that evidence. Which providers are licensed in Germany can be looked up in BaFin's register.

Holding period and tax: what a forced sale triggers in this situation

In Germany, gains from selling cryptocurrencies are tax-free after a holding period of more than one year; within the year they are taxable as a private disposal, with an exemption threshold of 1,000 euros a year.

This week that is more than a footnote. Anyone selling in panic and closing a position held for under a year loses the price and, on top of that, the clock that had been running. A liquidation counts as a sale for tax purposes, even if you did not trigger it. For the tax return you need the acquisition date of every single tranche, and when an exchange pauses withdrawals, the exports for that are not always available straight away. Securing the records now costs nothing.

Binance hack: the balance stays locked until release

The incident is confirmed by Binance, the cause has been named but not conclusively established, and the damage figure is the exchange's estimate, not an audited value. Three things make sense in this situation:

1. Check which part of your holdings sits on an exchange account and which in your own custody, and decide for the holdings you do not trade whether that is the right place for them. The hardware wallet comparison lists the devices and the prices.
2. In the phase of paused withdrawals, do not start a transfer you cannot pull back, and do not open a new leveraged position while you cannot top up margin. Where leveraged trading happens and on what terms is shown by the perp DEX comparison.
3. Look up whether your provider is licensed in Germany and how it segregates customer assets; the comparison of regulated crypto exchanges lists the providers with their terms.

(As of October 30, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)

Protect yourself: Storing crypto safely, and guarding against hacks like the one at Binance.