Binance estimates that its security incident has affected around $6.3 billion in assets, with roughly $3 billion frozen on-chain, according to a new company statement on October 30. Its preliminary investigation points to a potentially compromised DevOps engineer’s laptop that enabled access to a service container and unauthorised withdrawal transactions.
The update moves the story beyond the early reports of suspicious wallet transfers. Stablecoin issuers, custodians and competing exchanges have publicly described efforts to block funds, while blockchain records show both large transfers and actual token swaps.
Reporting snapshot: October 30, 2026, 02:31 UTC / 06:31 Dubai. This is a developing story. Company estimates, frozen balances and final recovered funds are different measures.
What we know so far
- Estimated impact: around $6.3 billion, according to Binance’s preliminary assessment.
- Assets frozen: approximately $3 billion, according to Binance’s latest update.
- Customer operations: Binance says deposits and withdrawals are temporarily suspended during security checks.
- Loss coverage: the exchange says it will use SAFU and company funds to cover losses.
- Still unresolved: the final technical explanation, perpetrator identity and complete recovery accounting.
Binance’s initial explanation: access to withdrawal infrastructure
In its latest official X statement, Binance said it had found no evidence of a wallet private-key leak. It described the laptop and service-container explanation as preliminary, pending a fuller technical report.
The exchange also said it had revoked the affected address authorisation, involved law enforcement and blockchain-intelligence partners, and would release updated proof-of-reserves information after remediation.
That distinction matters. A valid on-chain signature or authorisation establishes that an action was accepted by the blockchain. It does not, by itself, explain whether an attacker stole a private key, abused a signing service or obtained access through another part of an exchange’s systems. The final incident report must connect those steps.
What Tether, Circle, Ripple and other companies have said
Crypto University reviewed the original X posts below. The figures reflect separate statements made as the response developed; they should not be added mechanically to Binance’s latest aggregate.
| Company or spokesperson | Public response |
|---|---|
| Tether — Paolo Ardoino | The CEO said Tether had frozen more than 1.567 billion USDT connected to the potential Binance hack, emphasising protection of the industry and its partners. Original post. |
| Circle — Jeremy Allaire | The CEO said Circle had frozen more than 800 million USDC in coordination with law enforcement and would continue assisting the investigation. Original post. |
| Ripple — Jack McDonald | The executive said Ripple was actively freezing affected RLUSD holdings and coordinating with relevant parties. His post did not specify a total, so it should not be treated as an independently quantified freeze announcement. Original post. |
| World Liberty Financial | The company said it worked with BitGo to freeze stolen WLFI and USD1 funds and would cooperate with the investigation. Its statement did not give a dollar breakdown. Original post. |
| BitGo | The custodian described steps to freeze USD1 at one flagged address identified by World Liberty Financial. It said it had found no indication of a security issue at BitGo and that other USD1 services remained active. Original post. |
| Coinbase — Brian Armstrong | The CEO said the team was blocking sends to compromised wallets and had contacted Binance to offer help. He called for information sharing and cooperation across the industry. Original post. |
| Binance.US | The separate platform said it was unaffected by the Binance.com incident, with customer funds and services secure and operating normally. That assurance applies to Binance.US, rather than establishing the condition of Binance.com. Original post. |
The response has also extended beyond token issuers. Investigator ZachXBT reported that Arbitrum’s Security Council executed a transaction to freeze approximately $30.5 million associated with the exploit, and published an address and transaction hash. That is a participant’s public report; Crypto University has not independently decoded that intervention here.
What the blockchain records show
Crypto University inspected the following Ethereum transactions directly on Etherscan. Wallet names are the explorer’s attribution labels; they do not identify the person behind an address.
1. An authorisation change preceded the first large Ethereum sweep
At 20:20:59 UTC on October 29, Etherscan records an EIP-7702 delegation involving Binance 14. The wallet delegated to another contract.
At 20:24:23 UTC—three minutes and 24 seconds later—a successful sweep moved approximately 167,464 ETH and 63 ERC-20 token transfers into the receiving address labelled Binance Hot Wallet Exploiter 2. The transfers included approximately 1.615 billion USDT.
This establishes a sequence of events. It does not establish an Ethereum protocol vulnerability or the initial route into Binance’s systems.
2. A second Binance-labelled wallet supplied 780 million USDC
At 20:41:23 UTC, a separate transaction transferred 780 million USDC from Binance: Hot Wallet 34 to the same receiving address. The caller interacted with Binance 14 while the token transfer originated from Hot Wallet 34.
3. A frozen-token transaction was blocked
At 00:53:47 UTC on October 30, a call from the receiving wallet to the FDUSD contract failed with the error “Account is frozen.” Etherscan showed no corresponding successful token transfer event. This demonstrates a blocked attempt, without proving that the balance has been returned to Binance.
4. ETH moved between linked wallets, while altcoins were swapped
A 2,000 ETH transfer at 01:14:11 UTC went from the main receiving wallet to Etherscan-labelled Exploiter 8. Two later transactions sent 2,726.29 ETH at 01:26:11 UTC and 1,546.835 ETH at 01:27:59 UTC from previously tracked recipients to the same address, labelled Exploiter 17.
Those are transfers between addresses. In contrast, two successful transactions at 02:21:23 UTC show actual DEX swaps: approximately 36,718 RED for 0.967 ETH through PancakeSwap, and 1.285 million OGN for 2.937 ETH through Uniswap. They demonstrate conversion into ETH, rather than merely a change of wallet. They do not demonstrate conversion into fiat currency.
The Bitcoin trail continues beyond the first address
The Bitcoin receiving address linked in the public investigation showed 18,270.2 BTC received, a zero confirmed balance and 17 transactions when checked. Its subsequent transactions include several 1,000 BTC outputs.
An empty first-hop address is not evidence of recovery or of funds disappearing from the blockchain. Monitoring must follow the outputs into later addresses. Our initial coverage follows this Bitcoin branch and selected Ethereum recipients; it is not a complete reconciliation of every affected chain.
Why frozen funds are not the same as recovered funds
A token freeze can stop transfers while leaving the balance visible at the same address. Returning those assets may require further technical and legal steps. The ability to freeze also depends on the asset and the powers available to its issuer or network.
For that reason, subtracting a rounded freeze total from a preliminary impact estimate does not produce an audited final loss. Nor should every transfer between linked addresses be counted as a new theft. The same assets can appear in several transactions as they move through a trail.
Arkham’s labelled wallet collection is useful for following the investigation, but a portfolio’s changing dollar value can reflect prices, address membership and token balances. It is a different measure from Binance’s company-wide incident estimate.
What users should watch next
The immediate operational questions are when deposits and withdrawals resume, what Binance’s technical post-mortem establishes, and whether its updated reserves and recovery disclosures reconcile the affected assets.
During the interruption, use Binance’s official website or app for account-specific support. Treat unsolicited compensation links, wallet-connection requests and requests for seed phrases as suspect. A recovery claim circulating on social media is not an official compensation process.
Several questions remain open: how the suspected laptop compromise occurred, how access controls and signing infrastructure were traversed, who was responsible, and how much ultimately returns to the exchange. The evidence reviewed here does not establish a perpetrator identity or justify attributing the incident to an insider or a particular state-backed group.
Methodology: original company and executive X posts, Binance’s official announcement, Etherscan transaction records and Bitcoin explorer data. Company assertions are attributed; on-chain observations are identified separately. Latest statements reviewed at 02:31 UTC on October 30, 2026. Cover: conceptual AI-generated editorial illustration.
