Editor’s note (October 30, 2026): This article has been corrected. A resumption quotation attributed to Binance’s update and a second co-CEO resumption estimate have been removed because their stated sources could not be produced; Binance’s suspension wording and co-CEO Yi He’s 48-hour estimate — independently reproduced in a secondary source carrying the original service update — remain as reported.
What this means for Binance users right now
Binance says withdrawals across its platforms stay paused while it finishes security checks, deposits are running normally, and any user losses will be covered by its emergency user-protection fund, SAFU, together with company funds. The exchange also says it will publish an updated Proof of Reserves – a public showing that the exchange holds enough assets to back customer balances – once its fix-up work is complete.
That update lands on top of our earlier reporting on the suspected hot-wallet drain and on the freeze playbook that stopped more than $2.3 billion in tokens cold.
The exchange’s own account
In its Security Incident Update, dated October 30, Binance gave its first preliminary account of how the money moved. Its initial investigation suggests the break-in “may involve a compromised DevOps engineer’s laptop” – DevOps engineers are the staff who keep an exchange’s software and servers running – and, on that preliminary account, an attacker reached a service container, a packaged slice of software that runs a given job, and submitted unauthorized withdrawal transactions from inside.
Binance says it has “found no evidence of any wallet private key leak.” A private key is the secret code that alone can move funds out of a wallet. The exchange says it has revoked the affected address’s authorization, brought in law enforcement and blockchain intelligence partners, and will publish a detailed technical post-mortem once the facts are fully verified.
The numbers, each with its own source
The figures in play are not one number. Binance puts the estimated total impact at around $6.3 billion – its own preliminary, unaudited estimate – and says roughly $3 billion has been frozen on-chain so far. TRM Labs, a blockchain intelligence firm, puts the take at about $6.36 billion and counts roughly $2.7 billion frozen as of 00:30 UTC on October 30. Chainalysis has put losses at roughly $6.4 billion. Our own October 30 freeze piece reports more than $2.3 billion frozen by Tether and Circle alone – issuers only, a narrower slice than the on-chain totals above.
Who they say is behind it
TRM Labs wrote: “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence.” High confidence is TRM’s own label. Chainalysis CEO Jonathan Levin wrote on X that the hack was likely the work of the same group, as SecurityWeek reported. Both are private firms’ assessments. Neither is a government or law-enforcement determination, and Binance itself has not named an attacker in its own update.
When withdrawals might come back
Nothing here says withdrawals have resumed. Binance’s update says it has “temporarily suspended withdrawals while security checks are completed,” and it sets no restart time of its own. One executive estimate is on the record: co-CEO Yi He said in a service update on X at 04:17 UTC on October 30 that it expects to begin resuming withdrawal services within the next 48 hours – pointing at November 1 – according to a FinanceFeeds report that reproduces the post’s wording. The estimate concerns the start of resumption, not its completion; it is a forward-looking estimate, not a date.
The exchange says its investigation is still running. A detailed post-mortem and an updated Proof of Reserves are promised once the facts are verified.