Information checked through October 30, 2026, 18:12 Beijing time (UTC+8). This is a developing incident; amounts and service arrangements may change.
Binance's October 30 security incident announcement put the estimated total impact at approximately $6.3 billion and said about $3 billion had been frozen on-chain. The scale has prompted comparisons with the largest crypto thefts. Three distinctions matter when reading the updates: an estimated impact is not a final net loss, a freeze is not completed recovery, and a promise to cover losses is not evidence that coverage has already been executed.
What has Binance said so far?
The initial announcement described precautionary restrictions on deposits and withdrawals. A subsequent update from Binance’s verified official account said deposits were operating normally while withdrawals remained paused for security work. Withdrawal reopening was still described as an expectation, with precise arrangements to be announced. Reading only the first notice can therefore give an outdated picture of service availability.
| Issue | Published position | What it does not establish |
|---|---|---|
| Estimated impact | Approximately $6.3 billion, according to Binance | A finalized net loss after recovery and reconciliation |
| Assets frozen | About $3 billion, according to Binance | That the assets have already been returned |
| Deposits | Normal in the subsequent official update | That withdrawals have also reopened |
| Withdrawals | Paused; reopening remained prospective | A confirmed reopening time for every asset and network |
| Loss coverage | Binance committed SAFU and company funds | That all coverage and account reconciliation are complete |
Users should match an operational notice to the particular service, asset and network they intend to use. A functioning trading screen, an available deposit address and a successfully completed withdrawal answer different operational questions.
Is it the largest crypto attack on record?
TRM Labs’ original analysis tracked approximately $6.36 billion leaving Binance wallets across ten blockchains, valued at the time of transfer. It described the event as the largest cryptocurrency theft on record. That is a comparison of the scale of assets transferred, rather than a final ranking of unrecovered losses.
TRM said most of the transfers occurred within roughly 20 minutes beginning at 20:05 UTC on October 29, equivalent to 04:05 Beijing time on October 30. Its analysis used a snapshot at 00:30 UTC on October 30, or 08:30 in Beijing. The $6.36 billion research estimate and Binance's rounded $6.3 billion announcement describe the same event; they should not be added together.
For historical context, the FBI’s February 2025 notice concerning Bybit put that earlier theft at approximately $1.5 billion. The comparison explains why the current event is attracting record-size headlines. It does not settle the amount ultimately recovered, the final economic cost or the full responsibility for the Binance incident.
A preliminary intrusion account is not a completed technical finding
Binance's initial account pointed to a compromised employee laptop and unauthorized withdrawal activity. Its later explanation described additional entry points and a more complex sequence. The company said it had found no evidence of wallet private-key leakage. A full technical post-mortem and any findings on individual responsibility were still outstanding in those updates.
A withdrawal can be unauthorized even when a platform's own signing infrastructure processes it. The investigation needs to establish which access controls, approval steps and system boundaries failed. An absence of evidence of private-key leakage does not establish that the wider transaction process was secure.
TRM separately attributed the attack to North Korea's TraderTraitor unit with high confidence. Binance had not identified an attacker in the updates cited here. The firm's assessment and a completed official investigation therefore remain distinct.
Why frozen assets are not the same as recovered assets
A freeze restricts movement of affected assets. Recovery requires additional evidence that funds have actually returned or that an authorized recovery process has been completed. Control, legal arrangements, valuation and reconciliation can all matter before frozen assets become funds available to meet customer balances.
TRM's earlier snapshot counted approximately $2.7 billion frozen, while Binance's announcement reported about $3 billion. They are differently timed and attributed totals, not independent pools to sum. The same caution applies to rolling announcements from stablecoin issuers and blockchain partners: overlapping freezes must not be counted twice.
It would therefore be premature to label $6.3 billion minus $3 billion as a confirmed $3.3 billion loss. The gross estimate, realizable recoveries and costs still need to be reconciled on a consistent basis.
What should follow the coverage commitment?
Binance said SAFU and its own funds would bear the losses and that an updated proof of reserves would follow remediation. That is a company commitment. Assessing its execution requires information about funding, customer-account treatment and completed reconciliation. It should not be described as government deposit insurance or as proof that every payment has already occurred.
A reserve disclosure can provide useful evidence within its stated scope and timestamp. Its value depends on what assets and customer balances are included and how the work is verified. KTX's guide to proof of reserves and its limits explains why a reserve snapshot cannot on its own establish all liabilities, future withdrawal availability or the operational security of the platform.
What can ordinary users verify now?
Use the platform's official notices to check service availability, retain relevant account records and distinguish completed withdrawals from pending requests. Be wary of messages demanding an advance payment, a wallet connection or a secret phrase to unlock compensation. A promised recovery service is not evidence that it is authorized.
Account passwords and two-factor authentication protect a different layer from an exchange's wallet and signing systems. Our comparison of custodial and non-custodial wallets explains that division of control. Self-custody also introduces key-management and malicious-signature risks; moving assets does not eliminate all risk.
For a personal wallet, keep the recovery phrase private and follow a deliberate backup process. The KTX seed-phrase backup guide covers that responsibility. Checking an announcement or a reserve report does not require handing a recovery phrase to a stranger.
Frequently asked questions
Has a final $6.3 billion loss been confirmed?
No. Binance described an estimated total impact. Final net loss depends on verified recovery, valuation and reconciliation.
Does about $3 billion frozen mean it is back in customer accounts?
No. A movement restriction and a completed return of assets are separate events and require different evidence.
Does normal deposit service mean withdrawals have resumed?
No. The subsequent official update distinguished normal deposits from paused withdrawals. Confirm the latest notice for the relevant asset and network.
Will changing my password repair the exchange's affected systems?
No. Account security and platform remediation address different systems. Published reports do not establish that any particular user's wallet recovery phrase was exposed.
This article is informational, not investment advice. Digital-asset trading and custody involve risks.