Binance Says Suspected Hack Affected $6.3 Billion, Points to Compromised Engineer Laptop

Since Binance hot wallets began draining on the evening of Oct. 29, the exchange has gone from a vague "potential security issue" to an official number and a first theory of how it happened.

The $6.3 billion figure

Binance now estimates the total impact at about $6.3 billion. Roughly $3 billion of that has been frozen on-chain so far, according to the exchange. An earlier Binance update on X put the verified frozen total at $2.54 billion.

The $6.3 billion would exceed the roughly $1.5 billion Bybit hack in 2025, which was linked to North Korea. Binance has not publicly broken down how much of the $6.3 billion has left for good and how much is frozen.

Arkham Intelligence, a blockchain analytics firm, linked nearly $6 billion in bitcoin, ether, solana and stablecoins to 55 wallet addresses tied to the exploit. Those are Arkham's attributions, built from public blockchain data and community tips, not a Binance finding.

How the attacker got in

Binance said its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

The exchange also said it has "found no evidence of any wallet private key leak." It has revoked the affected address authorization. It says it is working with law enforcement and blockchain intelligence firms to trace and recover funds.

Binance has not said who is behind the attack. It has not said whether the attacker contacted the company. It said it is working with law enforcement "to confirm the identity of these criminals and bring them to justice."

Who froze what

Stablecoin issuers did most of the freezing. Tether CEO Paolo Ardoino said his company froze more than $1.5 billion in USDT. His figure was 1.567 billion at one point. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC "in coordination with law enforcement."

Binance co-founder Yi He said Ripple helped halt the movement of $200 million linked to the incident. World Liberty Financial, the crypto venture launched by President Trump and his sons, said it froze $27 million of its USD1 stablecoin.

Issuers can freeze their own tokens. They cannot freeze assets like ether, which is part of why the frozen total trails the headline impact figure.

Customer funds: what Binance is saying

Binance's public line is that user funds are safe. A spokesperson said, "Rest assured that user funds are completely safe." The exchange also said it will "cover all losses" using its Secure Asset Fund for Users and company funds.

Both statements are on the record. Binance has not explained how the first squares with the second, and it has not said how large the loss will be once the freezes are counted.

The financial-news site FinanceFeeds, which reviewed the edit history of Binance's first post on X, reported that the wording changed twice. According to FinanceFeeds, a line saying the exchange had "not confirmed any impact to user funds" was removed at 21:24 UTC. "User funds are completely safe" was added at 21:29 UTC. Binance has not commented on the edits in the material published so far.

Crypto trackers cited by TechCrunch put the drain from hot wallets at no less than $2 billion. Some estimates ran as high as $5.7 billion. Those figures were unconfirmed when they were published, and the outflow may have been ongoing at the time.

Changpeng Zhao, who stepped down as CEO in 2023 after pleading guilty to violating anti-money laundering laws, remains a major shareholder. He said, "It does look like a hack on Binance." He said he expects all user funds to be fully covered. Trump pardoned him in November 2025. Zhao no longer manages the exchange.

Market and platform fallout

Binance suspended deposits and withdrawals on multiple networks. Alpha trading is also paused. Yi He wrote, "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure." No restart date has been given.

Bitcoin fell more than 4% to about $78,000, with ether and solana also dropping sharply. Circle shares fell about 5% in after-hours trading on Thursday.

Binance.US said its platform is not affected, and the incident concerns Binance.com. Coinbase said it was unaffected and was monitoring the situation.

A separate incident hit prediction market Polymarket on Thursday. It paused trading and withdrawals after a third-party vendor was compromised. Security researchers say about $2 million in user funds was stolen through software from DebugBear. No source has tied it to the Binance incident.

What comes next

Binance has promised a technical post-mortem once the facts are fully verified. It will also publish an updated Proof of Reserves after remediation. Those two documents should show how much was actually lost, how much is recoverable and whether customer balances are fully backed. Until then, withdrawals stay shut.