Binance says it will cover the losses from a record $6.3 billion cryptocurrency theft, while around $3 billion in stolen assets has been frozen. The incident has also demonstrated how much power stablecoin issuers retain over digital tokens.
The breach of the world’s largest cryptocurrency exchange began at about 20:05 UTC on Thursday 29 October 2026, according to Binance’s latest security update. Attackers drained assets from its internet-connected, or ‘hot’, wallets. Blockchain investigators describe it as the largest known cryptocurrency theft.
Binance says customers will not bear the loss. That is a commitment from the exchange, rather than independent confirmation that every affected customer has already regained unrestricted access to funds.
What we know about the Binance hack
- Binance estimates the stolen assets at about $6.3 billion. Blockchain-analysis firm Elliptic puts the figure at $6.43 billion, reflecting differences in tracking and valuation.
- Binance says about $3 billion has been frozen on-chain. Elliptic independently identified approximately $2.84 billion in frozen assets in its 30 October analysis.
- Withdrawals were temporarily suspended while Binance investigated and strengthened its systems. Its 30 October update said deposits and unaffected services remained operational.
- The exchange says it has earmarked more than $6.34 billion in company funds and has already obtained about $5 billion in the same types of tokens as those stolen.
The theft far exceeds the approximately $1.5 billion stolen from Bybit in February 2025. It has prompted rival exchanges to review security arrangements. Reuters reported on 31 October that Coinbase had made precautionary adjustments to its offline cryptocurrency-key systems.
Why Tether and Circle were able to freeze billions
The intervention involved two major dollar-linked stablecoins. According to Reuters, Tether reported freezing nearly $1.57 billion of USDT linked to the theft, while Circle froze more than $800 million of USDC. Other action contributed to the broader total reported by Binance.
Both companies issue tokens designed to track the US dollar. Unlike Bitcoin, these stablecoins include issuer-controlled mechanisms that can prevent tokens at designated blockchain addresses from being transferred. Circle’s published USDC terms expressly describe its ability to block certain addresses.
That power can help stop criminals moving stolen assets, but it also illustrates a distinction sometimes lost in claims that cryptocurrency is beyond central control: the rules depend on the particular asset. Tether or Circle cannot simply freeze native Bitcoin or Ether held in an independent wallet.
Frozen does not mean recovered. Preventing stolen tokens from moving is not the same as returning them to Binance or reimbursing customers. Investigators and the relevant organisations still face legal and technical steps before the money can be recovered.
What caused the breach?
Binance’s initial account pointed towards a compromised laptop belonging to a DevOps engineer. Its subsequent security statement says investigators have found additional points of intrusion, so the full route into its systems has not yet been established.
The exchange says it has found no evidence that wallet private keys were leaked. That assertion and the precise attack mechanism remain subject to the continuing investigation. Binance says it intends to publish a technical post-mortem once findings have been verified.
Are North Korean hackers responsible?
Two blockchain-analysis firms have attributed the theft to North Korea-linked hackers. TRM Labs says it has high confidence that the TraderTraitor group was involved. Elliptic describes North Korean involvement as likely and points to links between stolen funds and addresses associated with previous suspected attacks.
These are expert assessments, not an official finding by law enforcement. The FBI has confirmed it is involved in investigating the incident, but has not publicly attributed responsibility. Reuters also reported that the US Secret Service is working with private-sector partners, including Circle, to trace and freeze funds.
What we don’t know yet
- Whether Binance’s promised replacement funds will be independently verified and when every withdrawal service will be fully restored.
- How attackers gained access to the exchange’s systems and whether further vulnerabilities remain.
- How much of the frozen cryptocurrency can ultimately be returned and what will happen to the unfrozen balance.
- Whether an official investigation will confirm the North Korean attribution.
What happens next for Binance customers?
Binance says it intends to restore withdrawals in phases following security checks. It also plans to publish updated proof-of-reserves information by Monday 2 November. Neither target should be treated as completed until confirmed by subsequent announcements and verification.
Crypto holdings do not automatically have the same protection as ordinary bank deposits. In the United States, the FDIC excludes cryptoassets from deposit insurance. In the UK, the Financial Conduct Authority warns that crypto investors are unlikely to receive Financial Services Compensation Scheme protection if something goes wrong.
For customers, the immediate questions are whether Binance can substantiate its repayment commitments and safely reopen withdrawals. For the wider cryptocurrency market, the episode poses a separate question: how should the power to freeze digital assets be governed, and what safeguards should exist against misuse?
