What we know about the Binance hack: Binance says the estimated total impact is around $6.3 billion and the verified total value of crypto frozen is $3 billion. This could increase as investigators trace additional assets.Binance says deposits are operating normally, and withdrawals are expected to resume within 48 hours. Assets frozen include Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB).Cybersecurity analysts suspect North Korea’s TraderTraitor is behind the attack.Oct. 30 at 07:37 am UTCTeng says Binance hack was not a single “one-click” actionThe attacker behind Binance’s $6.3 billion hack did not simply use one engineer’s permissions to carry out the breach, co-CEO Richard Teng said Friday.In an X post, Teng said the incident involved “a more complex attack process” and was not a single “one-click” action.“Our investigation has not attributed responsibility to any individual,” he wrote.Teng reiterated that preliminary findings pointed to a compromised DevOps engineer’s laptop, which may have allowed the attacker to access an internal service and submit unauthorized withdrawals. He said investigators had found no evidence of a wallet private-key leak.Binance would cover all losses using its SAFU fund and company funds, he said.Oct. 30 at 05:01 am UTCAnalysts suspect North Korean group behind Binance hackChainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor, citing links to a previous hack.In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. He said industry partners had frozen approximately $3 billion and Chainalysis was continuing to track the funds.In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain. “This indicates the same actor is likely behind both incidents,” he said. “The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO,” he added.Speaking to Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan also said the attack resembled the work of North Korea, or DPRK, based on the sophisticated onchain preparations, customer sweeper contract and multiple authorizations. TRM Labs has also attributed the attack to TraderTraitor with “high confidence,” which it said is “based on robust on and off-chain intelligence.” TraderTraitor has also been named by the FBI as the same group responsible for the ByBit hack in February last year. Oct. 30 at 4:17 am UTCBinance expects withdrawals to resume within 48 hoursBinance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours. Deposits are operating normally.The exchange said the incident involved multiple factors and that its security team was tracing the full attack path through a compromised computer, which they suspect to be the entry point.Oct. 30 at 03:49 am UTCBinance hack could accelerate shift to DEXs: Standard CharteredThe Binance hack could push more crypto trading toward decentralized exchanges and benefit Uniswap over the longer term, according to Standard Chartered’s global head of digital assets research, Geoffrey Kendrick.In an email shared with Cointelegraph, Kendrick retained his $100 price target for Uniswap’s UNI token by 2030, saying the breach was “another reason why that forecast may end up being too low.”CoinGecko research shows that the top 10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, climbing 2.1 percentage points from the first quarter of 2026. “I would encourage investors to re-engage with Uniswap,” said Kendrick. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.” Oct. 30 at 02:25 am UTCBinance points to engineer’s hacked laptop in $6.3B breachBinance said its initial investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop. The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak, though its investigation remains ongoing.The crypto exchange has also disclosed that the estimated total impact of the hack is $6.3 billion. Oct. 30 at 02:21 am UTCFirst Digital confirms it has frozen FDUSD involved in attackFirst Digital CEO Vincent Chok said it has frozen the FDUSD stolen in the attack on Binance. “We’re working alongside the Binance team and will share updates as we have them,” Chok told Cointelegraph in a written statement. “Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds. Protecting users is a responsibility we all share.”Oct. 30 at 01:19 am UTCBitcoin trades below $77,000 as BNB falls 8% Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211.DeFi tokens also fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the same period. The Bitcoin Fear and Greed Index, which tracks Bitcoin market sentiment, fell to “fear” with a score of 30, which it has not seen since August. Oct. 30 at 12:52 am UTCBinance says $3 billion frozen from hack Binance said the current verified amount of assets frozen from the hack is now $3 billion. The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH).“The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said. “As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.The funds will no longer be accessible to the address that originally held the funds and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, it added. Oct. 30 at 12:26 am UTCChainalysis estimates $5.9 billion stolen from BinanceChainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.Binance earlier said the verified total frozen is $2.54 billion.Oct. 30 at 12:26 am UTCBlockaid suspects Binance hack involved private key “misuse”The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature, according to Blockaid co-founder and CEO Ido Ben-Natan.Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity. Arkham CEO Miguel Morel said the attack appears to be ongoing. Oct. 30 at 12:07 am UTCBinance says deposits temporarily suspendedBinance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals. “We are working around the clock and will share a full post-mortem once the investigation is complete,” the company said, adding it will “cover all losses.”Earlier, Binance also said it had temporarily suspended Binance Alpha trading. Oct. 30 at 12:07 am UTCWintermute and GSR disclose Binance exposureCrypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses.The firms are market makers, which place buy and sell orders on exchanges to help other traders complete transactions. A disruption to their operations could make trading harder or more expensive across crypto markets.GSR CEO Xin Song said its Binance exposure was less than 5% of its net equity, meaning the value of its assets minus its liabilities. He said GSR was working with Binance to understand the incident and identify ways to help.Wintermute CEO Evgeny Gaevoy said his firm’s exposure was less than 20% of net equity and that he did not expect operational disruption.Neither executive disclosed a dollar amount for the exposure or confirmed financial losses.Oct. 29 at 11:40 pm UTCRipple freezes RLUSD linked to Binance hackRipple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins.McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.Oct. 29 at 11:35 pm UTCBinance says $2.54 billion frozen after hackBinance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.The exchange said the total could increase as its teams work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. Binance said it would publish further figures once verified.Oct. 29 at 10:36 pm UTCWorld Liberty Financial freezes $27 million in USD1 World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He. “USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff. World Liberty Financial said it worked with BitGo to freeze the stolen WLFI and USD1 funds. “We will cooperate fully with the ongoing investigation and support efforts to hold those responsible accountable. Protecting our users remains a top priority,” said World Liberty in a post on X. Oct. 29 at 10:33 pm UTCBinance says withdrawals will resume once issues resolvedBinance says its team is conducting security checks and will resume withdrawals as soon as the “security issue” is resolved.Oct. 29 at 10:32 pm UTCAave freezes markets after Binance exploiter borrows $44.6 millionDecentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.In a governance forum update posted after the freeze, risk service provider LlamaRisk said the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time.The borrowing occurred between 8:58 pm and 9:01 pm UTC on Oct. 29, about 40 minutes before the first freeze. It was the exploiter’s only Aave position across all networks and versions, with no further interactions detected after 9:01 pm UTC.The position remained backed by $59.9 million in USDT collateral against $43.8 million in debt at the update’s snapshot. LlamaRisk said it remained subject to normal liquidation and did not put Aave suppliers at risk.The freezes covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks.Users can still withdraw funds and repay loans, and liquidations continue. However, the freeze prevents new deposits and borrowing, including additional collateral deposits, leaving repayment as the only way to improve an existing position’s health factor.LlamaRisk said markets would remain frozen until the exploiter’s funds stopped moving and Binance provided greater clarity on containment, followed by a staged reopening. It warned that a prolonged freeze could push borrowing rates higher as withdrawals reduce available liquidity.Oct. 29 at 9:15 pm UTCBinance investigates multibillion-dollar security breachBinance is investigating a potential multibillion-dollar security breach involving one of its Ethereum wallets, after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions in assets.A Binance spokesperson told Cointelegraph on Thursday that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds. The spokesperson said its security teams were reviewing the activity and would provide updates once more information was verified.Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash. Spreek later reported that wallets connected to the transfers had begun selling Tether USDt (USDT) through decentralized exchanges.Blockchain analytics platform Arkham Intelligence later identified a collection of wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets. The figure represents the wallets’ reported holdings rather than a confirmed estimate of stolen funds.Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.Tether, Circle freeze over $2.36 billionBlockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.Shortly after news of the hack emerged, Tether and Circle, the two largest stablecoin issuers by market capitalization, said they had frozen a combined $2.36 billion in tokens linked to the suspected incident.Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.A few minutes later, Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.“Protecting the industry and our partners is our main priority,” Ardoino wrote.The Binance hack came hours after Polymarket temporarily halted trading following a compromise at a third-party provider. The prediction market platform said it had fixed the issue and pledged to reimburse affected users, with all systems reported operational by 7:05 p.m. UTC Thursday.Reporting by Felix Ng, Bryan O’Shea and Nate Kostar.

Bitcoin treasury company Strategy is looking to finance more Bitcoin purchases through preferred-share offerings, with executive chairman Michael Saylor saying it has the capacity to create as much as $30 billion in digital credit. During Strategy’s third-quarter earnings call, Saylor said the company could generate the amount using its existing balance sheet, without an additional common-stock capital raise or further Bitcoin price appreciation. “We could create $10 billion, $20 billion, $30 billion of digital credit,” Saylor said.The potential financing capacity highlights the company’s shift toward preferred shares such as STRC to fund Bitcoin accumulation rather than relying primarily on convertible debt or common-share sales.CEO Phong Le said during the call that issuing digital credit would be the main method for acquiring more Bitcoin. “The primary way to acquire Bitcoin is by issuing digital credit,” Le said.Le said that if Strategy raised $1 billion to $2 billion in a month through STRC, it could put some proceeds into dollar reserves and spend the rest on Bitcoin.The company reported $19.53 billion in third-quarter net income, driven largely by a $20.91 billion gain in the value of its digital assets. Its Bitcoin holdings reached 848,517 BTC as of Oct. 25, up 26% year to date.The $30 billion figure represents a possible capacity, not an announced fundraising target.  Related: Strategy skips Bitcoin purchases, spends $205M on STRC buybacks

The Binance hack could accelerate a shift in crypto trading toward decentralized exchanges, benefiting Uniswap over the longer term, according to Standard Chartered’s global head of digital assets research, Geoffrey Kendrick.In an email shared with Cointelegraph, Kendrick said the breach should drive further growth in decentralized exchanges’ share of trading relative to centralized platforms, though investors should wait until after the impact of the Binance attack has time to play out in the markets. “I would encourage investors to re-engage with Uniswap,” said Kendrick. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.”CoinGecko research shows that the top 10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, climbing 2.1 percentage points from the first quarter of 2026. Kendrick said he retains his $100 price target for Uniswap (UNI) for 2030, but said the Binance hack is “another reason why that forecast may end up being too low.”The forecast builds on Standard Chartered’s earlier thesis that assets locked in DeFi could reach $2.7 trillion by 2030, with Uniswap emerging as a key trading venue for tokenized assets.Looking at the broader implications of the Binance hack, Kendrick said he expects there will be further negative price action in the near term. Cointelegraph reported that cryptocurrency markets extended their decline early Friday following the Binance hack, with BNB down more than 8% over 24 hours and Bitcoin trading near $77,000. Decentralized finance tokens also declined. Aave’s AAVE fell 11.3% to $118.54, while Uniswap’s UNI dropped 10.4% to $6.48, according to CoinGecko.“Only after assets are unfrozen and more detail of the hack emerges will we find a new base,” said Kendrick. Live updates: Binance says $6.3B hack involved compromised engineer’s laptop

The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. “It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity. Binance has not confirmed the precise method that allowed hackers to steal over $2.5 billion in crypto from the exchange — the largest crypto hack in history. Arkham CEO Miguel Morel told Cointelegraph there isn’t enough information at this point in time to confirm whether the attack involved stolen keys or compromised infrastructure. “From what we can tell, it appears the hack is still ongoing,” he said.Related: Binance hack rattles crypto markets as BNB falls 7%, Bitcoin slidesBlockaid identifies malicious wallet delegationIn its onchain analysis published on X, Blockaid said the attacker bundled 50 EIP-7702 authorizations into a single transaction targeting Binance 14. One authorization reportedly matched the account’s required nonce, allowing it to be accepted. EIP-7702 allows an account to delegate execution to smart-contract code. Blockaid said the affected account was delegated to an unverified sweeper contract that allowed a designated operator to drain tokens and Ether.Ben-Natan told Cointelegraph the operation could have involved multiple compromised devices and movement through the exchange’s network, though this remains unconfirmed.North Korea, Bybit comparisonAsked whether the suspected signing manipulation resembled the February 2025 Bybit attack, Ben-Natan described the incidents as “very, very similar.”In that case, Bybit’s published forensic update said attackers compromised a Safe developer’s credentials, accessed the wallet provider’s infrastructure and deceived signers into approving a malicious transaction.Like Bybit, Ben-Natan said the activity resembled operations linked to North Korean cyber attackers, based on the sophistication of the on-chain preparations.Magazine: Tampered Ledger reported in Singapore a month before news broke: Asia Express