Binance said it paused deposits and withdrawals after a hot-wallet breach reported around 4:00 a.m. Beijing time on Oct. 30, as on-chain estimates placed total outflows between $5.64 billion and $6.26 billion across nine blockchains. Stablecoin issuers and network operators have since frozen or paused roughly $2.54 billion to $2.829 billion connected to the suspected attacker, leaving an estimated $3.3 billion in assets still under the attacker's control.
A Binance co-founder identified as He in the account of the incident said customer assets were safe and that the exchange would cover losses tied to the breach. Binance paused transfers while its security team reviewed systems, sought to freeze connected addresses and coordinated with law-enforcement authorities, according to the supplied information.
The size of the theft would place the incident among the largest cryptocurrency breaches recorded, though the range of estimates reflects the difficulty of valuing fast-moving assets across multiple chains and tracking addresses as funds are swapped. The figures also may differ depending on whether analysts count assets frozen by issuers, tokens paused at the network level, and funds that have already moved through intermediary wallets.
Bitcoin and Ethereum dominate the remaining exposure
The suspected attacker reportedly retained about 18,270 BTC, valued at roughly $1.44 billion, and 467,000 ETH, valued near $1.06 billion. Those two positions account for most of the estimated $3.3 billion remaining balance and would be the principal assets to watch if the attacker attempts to convert stolen funds into other tokens, stablecoins or fiat-linked exit routes.
Lookonchain estimated that the attacker's remaining smaller-token holdings were worth approximately $180.3 million. While those assets could be volatile and difficult to liquidate in size, they are materially smaller than the reported Bitcoin and Ethereum balances.
On-chain tracking described the attacker as moving assets from stablecoins and other issuer-controlled tokens into assets that are harder to freeze. ETH was reportedly the only major asset whose balance continued to rise during the post-breach transfers, suggesting it may have been used as a preferred destination for swaps.
That pattern is consistent with the practical differences between token types. Issuers of centrally administered stablecoins can blacklist addresses and halt transfers of tokens under their control. Native assets such as Bitcoin and Ethereum do not have an issuer with an equivalent ability to freeze a wallet balance, making recovery more dependent on tracking, exchange cooperation and eventual contact with identifiable conversion points.
Issuers and networks blocked billions in funds
The reported freeze total includes about $2.54 billion in USDC, USDT and WLFI, according to the supplied account. A later estimate put the combined value of locked or paused assets at about $2.829 billion.
Among the specifically identified actions, Arbitrum network operators reportedly paused 30.5 million ARB tokens, while Paxos froze 215,700 USDP. The differing headline freeze totals likely reflect changing token prices, additional blacklists, and varying treatment of assets that were paused rather than permanently immobilized.
The response demonstrates that stablecoin issuers can intervene rapidly when stolen tokens remain in identifiable addresses. That authority can limit a hacker's ability to use particular assets, but it does not recover every dollar automatically. Frozen tokens may require legal processes, issuer decisions and law-enforcement coordination before they can be returned to an affected platform or users.
The breach also places renewed attention on hot-wallet management. A hot wallet is connected to the internet and used to process customer withdrawals and other operational transfers, making it more convenient than offline storage but also a more attractive target for attackers. The supplied account said the attacker had practiced transfers for hours and swept funds in rapid batches, indicating preparation designed to exploit the period before counterparties could identify and block addresses.
Estimates point to a substantial Ethereum loss
The reported theft included an amount equal to roughly 6% of Binance's Ethereum reserves, according to the supplied material. That comparison should be treated cautiously without a current, independently verified reserve snapshot, but it indicates that the stolen ETH was large enough to draw scrutiny over how the exchange manages operational liquidity and wallet segregation.
Binance's commitment to cover customer losses would reduce the immediate risk that affected account holders bear the direct cost of the breach. The financial impact would instead fall on the exchange's own balance sheet, insurance arrangements, reserves or other recovery mechanisms, depending on how much is ultimately retrieved.
Markets may focus on movements from the Bitcoin and Ethereum addresses associated with the attacker. Large transfers do not necessarily signal immediate selling: stolen assets can be split across wallets, routed through bridges, exchanged through decentralized protocols or held while the attacker seeks a less visible route to convert them. Yet a sustained attempt to liquidate holdings of this size could create operational pressure for platforms and liquidity providers asked to identify and block proceeds.
The incident also underlines a limit of rapid freezes. They work best against tokens whose issuers retain administrative controls, while the remaining exposure is concentrated in major native cryptocurrencies that cannot be stopped by a single company. The recovery effort will therefore depend heavily on blockchain tracing, coordination among service providers and whether the attacker eventually sends funds to a regulated venue where they can be identified or restrained.
Worried about exchange hacks? Learn how crypto safety standards can protect your assets before the next breach hits.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
