Binance has temporarily suspended deposits and withdrawals for all users while it completes security checks after the largest theft in crypto history, the exchange confirmed in an official Security Incident Update published on Friday, October 30, 2026. The announcement puts the estimated total impact of the incident at around $6.3 billion, says about $3 billion has already been frozen on-chain, and gives the company's first official account of how the attacker got in: an initial investigation suggests a compromised DevOps engineer's laptop allowed the attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance stressed that it has found no evidence of any wallet private key leak, and promised that all losses will be covered. "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe."
For the millions of customers who woke up unable to move money off the world's largest exchange, the update answers the two questions that matter most: why withdrawals are stopped, and whether their funds are safe. The suspension is described as an immediate precaution while security checks are completed. Alongside it, Binance says it has revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds, and that it will publish an updated Proof of Reserves once the remediation is complete and a detailed technical post-mortem once the facts are fully verified.
The suspension follows the attack itself, which began on Thursday, October 29, when blockchain trackers flagged billions of dollars moving out of Binance-linked wallets. Early on-chain estimates put the theft at more than $5.7 billion (Arkham), roughly $5.9 billion (Chainalysis) and more than $6 billion (TRM Labs), and Binance suspended deposits and withdrawals that evening while it investigated, as US News Pulse reported in its earlier coverage of the Binance hack. Friday's announcement is the company's first full official statement: it raises the estimated impact to around $6.3 billion, confirms the suspension applies across the platform while checks are completed, and sets out the cause its investigators have identified so far.
That cause is notably different from the hot-wallet compromise many observers first assumed. According to Binance, the trail leads to a person, not a vault: a DevOps engineer's compromised laptop gave the attacker a way into a service container, and from there the attacker was able to submit withdrawal transactions that the system treated as authorised. Binance says it has found no evidence that any wallet private key leaked, a distinction that matters for how the incident is understood and fixed — the failure, on the company's own account, sat in operational access and internal systems rather than in the cryptography that protects customer wallets.
While the checks run, the freeze effort continues in parallel. Binance says it has worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain so far — a figure that matches the total the company had cited earlier on Friday, built up from freezes by stablecoin issuers Tether and Circle, Ripple and others. Freezing is not recovery, and Binance says law enforcement and blockchain intelligence partners are now engaged to trace and recover what can still be reached.
Binance is the largest cryptocurrency exchange in the world by trading volume, with more than 335 million registered users and about $160 billion in assets under custody as of its 2024 annual report, so a platform-wide halt to deposits and withdrawals is a market event in itself, not just a customer-service problem. The SAFU fund — the Secure Asset Fund for Users, established in 2018 and holding roughly $1 billion in bitcoin — exists for exactly this kind of emergency. During the first hours of the incident the company promised to cover losses but had not said whether SAFU would be used; Friday's announcement settles that question: the losses will be covered from the SAFU fund and the company's own funds.
The incident dwarfs every previous crypto theft. The prior record, about $1.5 billion taken from the Bybit exchange in February 2025, stood for less than two years; at around $6.3 billion, the Binance incident is roughly four times larger. Binance itself is no stranger to breaches — it lost 7,000 bitcoin, worth about $40 million at the time, in 2019 — but nothing in the industry's history approaches this scale, which is why the company's Proof of Reserves promise will be watched so closely: after remediation, Binance says it will publish an updated Proof of Reserves so users can verify that assets backing their balances are in place.
The market backdrop remains fragile. Bitcoin fell below $77,000 on Thursday and to a six-week low in early Asian trading on Friday, ether slid to a two-month low, Binance's BNB token dropped more than 8 percent over 24 hours, and crypto liquidations reached $1.11 billion in a day as traders absorbed the news. Researchers at TRM Labs and Pangolin Intelligence have pointed to North Korea's TraitorTraitor hacking group as the likely attacker, an attribution Binance has not confirmed; Friday's announcement does not name an attacker, saying only that the company is working with law enforcement partners to confirm the criminals' identity.
While Binance suspends withdrawals, the practical position for users is simple. Deposits and withdrawals are paused for all users, temporarily, while security checks are completed; Binance has not given a clock time for resumption, and its earlier statement said withdrawals would resume as soon as the security issue was fully resolved. Funds held on the exchange are, in the company's words, safe, and any hacking losses will be covered from the SAFU fund and company funds, so customers are not being asked to absorb the theft.
The company also repeated the warning that matters most in the days after any big hack: rely only on official Binance channels for updates. Suspension periods are prime time for phishing — fake support accounts, cloned announcements and fraudulent "withdrawal reopening" links target worried customers — and Binance directed users with questions to its official Customer Support. Users should not follow links from unsolicited messages, should not share credentials or seed phrases with anyone claiming to expedite a withdrawal, and should wait for the resumption notice on Binance's official announcement page rather than acting on social media claims.
One more distinction is worth keeping in view. A withdrawal suspension is a protective pause, not a solvency statement: Binance's position is that the loss is the company's, to be covered from SAFU and company funds, and that customer balances are intact. The updated Proof of Reserves promised after remediation is the document that will let users test that claim, and the technical post-mortem is the document that will let the industry test the company's account of the compromised laptop and the service container.
Binance's announcement was written to reassure first and explain second. "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," the company said, adding: "Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice." It closed by asking users to rely only on official Binance channels for updates.
The same commitment had been building since Thursday night. Co-founder Yi He said during the first hours of the incident: "Binance will cover all hacking losses," and promised a full post-mortem once the investigation is complete. Founder Changpeng Zhao, the company's largest shareholder, wrote on X: "User funds are safe! It does look like a hack on Binance... I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." Friday's announcement turns those assurances into a named funding source: the SAFU fund and the company's funds.
Security researchers, meanwhile, have focused on the method. The picture Binance describes — an engineer's laptop compromised, a service container reached, withdrawals submitted from inside trusted systems — is the pattern behind several of the largest recent thefts, including attacks US prosecutors have linked to North Korean operatives working through fake IT jobs and insider access, a campaign covered in the case of the North Korea IT worker scheme. Whether that pattern applies here is exactly what Binance says its investigation, and law enforcement's, will establish.
This announcement matters because it converts rumour into record. Until Friday, the size of the theft, the state of the freezes and above all the cause rested on blockchain trackers, security firms and unnamed reporting. Binance has now put its name to the core facts: roughly $6.3 billion of impact, about $3 billion frozen, a compromised staff laptop as the entry point, no evidence of a private key leak, and a funded promise to make users whole. Each of those claims can now be checked — against the promised Proof of Reserves, against the post-mortem, and against whatever law enforcement eventually says.
It also matters for what it reveals about the industry's weakest point. The largest exchange in the world, with vast security resources, was not beaten by broken cryptography, on its own account, but by the compromise of one engineer's machine and the access that came with it. For every exchange, bank and technology firm watching, the lesson is uncomfortable and familiar: operational access — laptops, containers, internal authorisations — is where determined attackers now aim, and it is defended by process and vigilance rather than by mathematics.
Finally, it matters for the millions of ordinary users whose money is paused mid-flight. A temporary suspension that ends with full coverage and a clean Proof of Reserves would be remembered as a crisis handled; a long suspension, or any gap between the promise and the reserves, would damage trust in centralised exchanges far beyond Binance, in a market already nursing $1.11 billion of liquidations from this single incident.
The immediate sequence is set by Binance itself: finish the security checks, complete the remediation, then publish the updated Proof of Reserves and lift the suspension. The company has not announced a resumption time for deposits and withdrawals, and its announcement says the detailed technical post-mortem will come once the investigation is complete and the facts are fully verified — the document that should confirm or correct the laptop-and-container account and explain how the attacker was able to submit withdrawals.
In parallel, the tracing and recovery effort continues with law enforcement and blockchain intelligence partners, and the frozen total — about $3 billion so far — may rise as more affected assets are identified and frozen by issuers and partner platforms. Markets will keep their own verdict running: bitcoin's six-week low and the slide in exchange-linked shares and tokens, of the kind seen in the Robinhood Q3 earnings sell-off, show how quickly crypto shocks transmit. For users, the only step that matters is the official resumption notice; until it appears on Binance's own channels, withdrawals remain stopped — by design, and, Binance insists, with funds safe behind the pause.
Has Binance stopped withdrawals for all users? Yes. In its Security Incident Update of October 30, 2026, Binance confirmed it has temporarily suspended deposits and withdrawals for all users while security checks are completed, as an immediate precaution after the incident.
Are Binance user funds safe? Binance says yes. The company states that user funds are safe and that it will cover all losses from the SAFU fund and the company's funds, and it will publish an updated Proof of Reserves once the remediation is complete.
How much was taken, and how much has been frozen? Binance puts the estimated total impact at around $6.3 billion. Working with blockchain partners, about $3 billion of affected assets has been frozen on-chain so far, and tracing and recovery work with law enforcement continues.
How did the attacker get into Binance? The company's initial investigation suggests a compromised DevOps engineer's laptop allowed the attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance says it has found no evidence of any wallet private key leak, and a full technical post-mortem will follow.
When will Binance withdrawals resume? Binance has not given a specific time. The suspension lasts while security checks are completed and the remediation is finished; the company says to rely only on official Binance channels for the resumption notice and further updates.
Related coverage on US News Pulse: Binance Hack Drains $5.7 Billion in Largest Crypto Heist Ever Reported; North Korea IT worker scheme: defense contractor pleads guilty in Virginia; Robinhood Q3 earnings miss as crypto revenue falls 55%.
Leave a Comment
| Today's Date:
