Binance paused withdrawals after a security incident that it said affected about $6.3 billion in assets transferred from its hot wallets, leaving customers unable to move funds off the platform as of 07:00 UTC on Oct. 30. The exchange said deposits were operating normally and estimated withdrawals could begin resuming within 48 hours, while roughly $3 billion in related assets had been frozen across several networks.
The incident began with Binance halting withdrawals at 22:15 UTC on Oct. 29, according to its service updates. Deposits were subsequently listed as paused at 00:07 UTC on Oct. 30, before an update at 04:17 UTC said deposits had not been affected and were functioning normally. Binance did not explain the change in its deposit-status language.
Binance said it would cover customer losses through its Secure Asset Fund for Users, or SAFU, and company funds. It also said it would refresh its proof-of-reserves information after remediation work was complete. A full technical incident report had not been published by 07:00 UTC.
Asset totals differ by methodology
Public estimates of the affected assets ranged from about $3.3 billion to $6.36 billion, largely because trackers measured different points in the transaction flow. Some figures reflected the value of assets as they left Binance wallets, while others counted balances remaining in attacker-linked addresses after swaps, sales, and price movements.
One dataset valued the transferred assets at $6.36 billion at the time of the transactions and $6.23 billion after repricing. Another estimate, around $5.84 billion, referred to the balances held in attacker-linked wallets at a particular time rather than the total transferred volume.
Blockchain security firm TRM Labs said the outflows spanned 10 networks. Ethereum accounted for the largest share, at about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. The attackers also moved 18,270 BTC, valued at about $1.47 billion in TRM Labs' assessment.
Other assets included about $628 million on TRON, 2.3346 million XRP worth around $296 million on the XRP Ledger, and 970,500 SOL worth about $96 million on Solana, according to TRM Labs. The firm also identified approximately $39 million transferred across Arbitrum, Optimism and Base, alongside around $28 million on Avalanche and $10 million on Polygon.
DefiLlama data cited in the incident reporting placed Binance's platform assets at roughly $144 billion before the breach. On Binance's $6.3 billion estimate, the affected assets represented about 4.4% of that total.
Ethereum delegation was central to the reported exploit
TRM Labs and blockchain security company Blockaid said the Ethereum portion of the operation involved EIP-7702, a recently introduced Ethereum transaction feature that permits an externally owned wallet to authorize smart-contract code to act on its behalf.
According to both firms, an EIP-7702 delegation transaction carried 50 pre-signed authorizations associated with 50 consecutive transaction nonces. Once the delegation took effect, the wallet was swept in approximately three and a half minutes.
The mechanism matters because it can allow a smart contract to execute approved actions from a wallet without requiring each transfer to be separately signed at the moment it occurs. It does not apply to the non-Ethereum chains included in the reported theft; TRM Labs described those transactions as conventional signed transfers.
Binance said its preliminary investigation found no evidence that private keys had leaked. Instead, the company identified a compromised laptop belonging to a DevOps engineer as the entry point. Binance said the attacker moved from the device into a service container and submitted unauthorized withdrawal transactions. The exchange said it had revoked authorizations connected to the affected addresses.
That account places the incident in the operational security layer surrounding wallet infrastructure rather than in a direct compromise of wallet private keys. The eventual technical report will be central to determining whether the breach was confined to one employee device and service environment or exposed deeper weaknesses in the exchange's transaction controls.
Issuer freezes immobilized about $3 billion
Stablecoin issuers and network administrators began blocking assets before Binance halted withdrawals, according to TRM Labs. The firm said Tether and Circle completed an initial round of freezes roughly 40 minutes after the first major on-chain sweep.
First Digital said it froze FDUSD connected to the incident at 02:21 UTC, but did not disclose the amount.
TRM Labs estimated that about $2.7 billion had been frozen by 00:30 UTC on Oct. 30. Its estimate included roughly 1.77 billion USDT, $825 million in USDC, $40.5 million in RLUSD and $27.8 million in USD1. The calculation also included actions by the Arbitrum security committee affecting 8,426 ETH and 74.6 million ARB.
Binance later said it had verified around $3 billion in frozen assets, a difference it attributed to timing. Using the exchange's $6.3 billion affected-assets figure, that total amounts to roughly 48% of the transferred value.
A freeze prevents tokens from moving through blacklist controls embedded in the relevant token contracts. It does not automatically return the assets to Binance or credit them to customer accounts. Recovering frozen funds generally requires coordination among issuers, exchanges, investigators and, in many cases, legal authorities. The report referenced a February 2025 theft in which $48.4 million was eventually returned after months of such processes.
Attackers moved away from freezeable tokens
TRM Labs said the attackers acted quickly to reduce their exposure to assets that issuers could immobilize. Before the freezes took effect, they sold about $325 million in USDT at a discount of more than 10% and acquired around 122,300 ETH.
The attackers also used Aave to borrow ETH against USDT collateral, TRM Labs said, while conducting further lending activity on a TRON-based protocol and swapping assets through Uniswap. Those transactions shifted a significant portion of the remaining holdings into BTC and ETH, assets without issuer-operated blacklisting systems.
After the conversions, TRM Labs estimated that approximately $2.4 billion of the remaining holdings were concentrated in Bitcoin and Ether. That structure limits the ability of token issuers to intervene, placing greater weight on exchange surveillance, blockchain tracing and any later attempts by the attackers to convert assets into fiat currency or regulated stablecoins.
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korea-linked group, citing on-chain and off-chain intelligence as well as similarities to the February 2025 Bybit theft and an April 2026 KelpDAO incident. Blockchain investigator ZachXBT and Blockaid also pointed to North Korea-linked activity. No law-enforcement agency had publicly issued a formal attribution by 07:00 UTC.
Market volatility eased after early sell-off
Crypto prices fell sharply during the initial incident window. Bitcoin reached an intraday low near $76,650 and traded around $76,937 at 01:19 UTC on Oct. 30, down 4.9% over 24 hours. Ether traded near $2,211, down 5.7%, while BNB fell about 8%, according to price data cited in the report.
DeFi-linked tokens saw heavier declines, with AAVE down 11.3% and UNI down 10.7% during the same period. CoinGlass recorded about $1.4 billion in leveraged liquidations across the broader market over the following 24 hours, although that figure includes routine liquidations and cannot be assigned solely to the Binance incident.
By 06:35 UTC, CoinGecko data showed a partial recovery. Bitcoin traded at $78,518, down 1.78% over 24 hours; Ether was at $2,245.53, down 2.79%; and BNB stood at $715.24, down 4.83%.
The immediate test for Binance is operational: reopening withdrawals without creating a second security risk, reconciling affected balances, and converting the frozen-asset total into an actual recovery process. The platform's commitment to use SAFU and corporate funds reduces the likelihood that customers will bear losses directly, but withdrawals remain the practical measure users will watch until normal service returns.
Worried about hacks and wallet risk? Strengthen your defenses with our guide on crypto safety standards every trader must know.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
