Binance identifies new breach points in $6.3B hack

Complex attack process bypassed single engineer permissions

Binance CEO Richard Teng stated that the attack was "not a single 'one-click' action" and involved a "more complex attack process" that did not rely on the permissions of just one engineer. The incident has been officially described by the exchange as a "complex" occurrence.

While initial reports pointed to a compromised laptop belonging to a DevOps engineer, investigators found no evidence of a private key leak. The entry point may have allowed access to a service container to submit unauthorized transactions.

Blockaid’s Ido Ben-Natan suggested the hack involved "key misuse," where attackers manipulated the transaction-signing signature. This method allowed the perpetrators to bypass security protocols without needing to extract private keys.

Industry partners freeze $2.54 billion in stolen assets

Binance has confirmed that $2.54 billion of the stolen assets have been frozen onchain with the assistance of blockchain partners. This figure clarifies earlier public reports, including a previous estimate of $1.8 billion.

The Arbitrum Security Council executed a transaction on October 30, 2026, to freeze $30.5 million in stolen funds, consisting of 74.6 million ARB and 8,425 ETH.

While some outlets such as tech-insider.org reported that $3 billion in assets were frozen, Binance has officially verified the total at $2.54 billion.

According to the exchange, the aggregate value of frozen assets could rise as it collaborates with industry partners, blockchain intelligence firms, and law enforcement to track further funds.

Stablecoin issuers and protocols act to block stolen funds

Binance co-founder Changpeng "CZ" Zhao expressed gratitude to Tether and Circle for their quick action in freezing stolen funds. First Digital CEO Vincent Chok confirmed that his company has frozen the FDUSD stolen during the attack.

Ripple senior vice president of stablecoins Jack McDonald stated that the company is "actively freezing affected funds" linked to its RLUSD stablecoin. The firm is currently coordinating with relevant parties to support the ongoing investigation.

Zach Witkoff, co-founder and CEO of World Liberty Financial, noted that the company implemented proactive measures to freeze $27 million in USD1 linked to the hack. The company also reported it froze $2 million in WLFI tokens after working with BitGo to secure the assets.

World Liberty Financial stated on X that it will cooperate fully with the investigation to prioritize protecting its users. Following the breach, the decentralized lending protocol Aave suspended markets throughout its V3 and V4 deployments as a precautionary measure.

LlamaRisk, a risk service provider, indicated that the perpetrator deposited 60 million USDT and took out a loan of 19,762 Wrapped Ether, valued at roughly $44.6 million at that moment.

North Korean group TraderTraitor suspected in ongoing attack

Data from Arkham indicates that the attacker transferred $38.82 million in Ethereum to a fresh address on Friday and maintains a balance of $1.12 billion in ETH. On Friday, the attacker also executed 14 transfers, sending roughly $2.1 million in TRX to nine different new addresses.

ZachXBT, an onchain investigator, remarked that funds pilfered from the Binance attack and the previous Bitget exploit were mixed in the same address after being routed through THORChain, which implies the same individual is behind both.

TraderTraitor was previously identified by the FBI as the entity accountable for the ByBit hack in February 2025. Arkham CEO Miguel Morel stated that the attack on Binance appears to be ongoing.

Binance suspends withdrawals for 45 hours during security revamp

For a duration of 45 hours, Binance has halted withdrawals to carry out a security overhaul of its withdrawal infrastructure and associated addresses. The exchange has also temporarily suspended trading on Binance Alpha. While withdrawals remain paused, deposits have reopened.

CEO Richard Teng said the company is working around the clock to investigate the hack. He committed to sharing a detailed technical post-mortem and an updated Proof of Reserves once the investigation concludes.

Binance plans to cover all user losses using its Secure Asset Fund for Users (SAFU) and company funds.

Market analysts predict shift toward decentralized exchanges

Market prices fell on Friday, October 30, 2026, as Bitcoin dropped 4.9% to $76,937 and BNB fell 8% to $693. Ether declined 5.7% to $2,211, while AAVE and UNI tokens fell 11.3% and 10.7%, respectively. The Bitcoin Fear and Greed Index dropped to a score of 30, indicating a period of fear in the market.

While trading firms Wintermute and GSR revealed they have exposure to Binance, they noted that they anticipate no significant operational disruptions. Evgeny Gaevoy, CEO of Wintermute, mentioned that the exposure held by his firm accounts for under 20% of its net equity. GSR CEO Xin Song stated the firm’s exposure is less than 5% of its net equity and they are working with the exchange to help.

Standard Chartered analyst Geoffrey Kendrick suggested the hack may accelerate a market shift toward decentralized exchanges (DEXs), which function without a central intermediary. Research from CoinGecko revealed that the ratio of top 10 spot DEX-to-CEX hit 23.5% during the second quarter of 2026, representing a rise of 2.1 percentage points compared to the first quarter. A $100 price target for the UNI token of Uniswap by 2030 was maintained by Kendrick.

Chainalysis CEO Jonathan Levin estimated the total theft at $6.4 billion. Chainalysis also estimated the amount stolen from Binance at $5.912 billion at the time of the theft, noting this is four times the amount stolen from Bybit in 2025. Industry partners have frozen approximately $3 billion in stolen assets.