Category: General / News & Updates October 30, 2026 | Reporting cutoff: 11:28 UTC / 4:58 p.m. IST Developing story
Binance has reported a major security incident with an estimated impact of approximately $6.3 billion. The exchange says roughly $3 billion in affected assets has been frozen on-chain and has pledged to cover losses using its Secure Asset Fund for Users, known as SAFU, alongside company funds.
For customers, the immediate questions concern access to funds, the security of withdrawal services and how the recovery process will work. A commitment to cover losses is significant, but readers should distinguish that commitment from independently verified completion of reimbursements.
Are Binance deposits and withdrawals working?
The latest official Binance service update reviewed for this article says deposits are operating normally, while withdrawals remain paused during security work on the withdrawal service and associated addresses.
| Item | Reported position at the reporting cutoff |
|---|---|
| Deposits | Operating normally, according to Binance |
| Withdrawals | Paused during security remediation |
| Restoration estimate | Binance’s cited notice indicated a roughly 48-hour window |
| Detailed findings | Technical postmortem and updated Proof of Reserves promised |
The restoration estimate is the company’s guidance, not a guaranteed reopening deadline or a countdown starting when this article is published. Readers should verify the status of their particular asset and network inside the official platform before initiating a transfer.
Earlier announcements described a suspension of both deposits and withdrawals. The later update changes the position on deposits, which is why older screenshots may give a different impression.
What happened, and when?
Blockchain intelligence firm TRM Labs traced approximately $6.36 billion in outflows from Binance wallets across ten blockchains. Its investigation places most of the transfers within roughly 20 minutes beginning at 20:05 UTC on October 29—equivalent to 1:35 a.m. IST on October 30.
This timing explains why the incident appears as October 29 news in some international reports and October 30 news for Indian readers.
Binance’s preliminary explanation points to a potentially compromised DevOps engineer’s laptop that may have allowed access to an internal service and unauthorized withdrawal requests. The company says it has found no evidence of wallet private keys being leaked. Its investigation remains ongoing, so the complete attack path should not be treated as established.
TRM’s assessment points to a compromise of hot-wallet signing infrastructure. Hot wallets support online exchange operations; a failure in the systems authorizing transfers can therefore be consequential even when investigators have not identified exposed private keys.
The available findings concern exchange infrastructure. They do not establish that the underlying Bitcoin or Ethereum consensus networks were breached.
Why do reports mention $6.3 billion, $6.36 billion and $6.4 billion?
These figures should not be added together.
Binance’s estimate, TRM’s tracing and Chainalysis’s approximately $6.4 billion assessment describe the same developing incident. TRM also distinguishes asset values at the time of the transfers from values at a later reporting snapshot.
Crypto prices move, investigators reconcile addresses and estimates are rounded. Slightly different headline totals can therefore coexist without representing separate thefts.
The eventual financial impact will depend on reconciliation, recoveries and other verified outcomes. An initial transfer estimate is not an audited final loss.
Frozen funds are different from recovered funds
Freezing an asset can prevent further movement while investigators work through the incident. It does not automatically mean the asset has been returned to Binance or credited to a customer’s account.
Three milestones deserve separate attention:
- Frozen: Movement has been restricted through an applicable control.
- Recovered: Funds have actually been returned to an authorized party.
- Reconciled or compensated: The exchange has confirmed how affected balances and obligations have been addressed.
It would be premature to subtract the frozen amount from the initial estimate and present the remainder as a final net loss. Recovery can involve technical verification, ownership checks and legal processes.
The most useful future disclosures will explain what has moved from restriction to actual recovery and how customer balances have been reconciled.
Who do investigators believe was responsible?
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korea-linked hacking group. Chainalysis also attributes the incident to that group, citing transaction patterns and links between funds from this incident and an earlier exploit.
These are assessments by blockchain investigation firms. They should remain clearly attributed while the exchange’s investigation and any law-enforcement findings develop.
Attribution can help explain patterns across attacks, but it does not establish every technical detail or prove that a particular employee was personally responsible.
How did Bitcoin and Ethereum react?
Reuters reported that Bitcoin touched a six-week low of $76,368, while Ether fell more than 3% to a two-month low of $2,178, before prices stabilized.
Those figures are reported session lows in Reuters’ coverage, not live quotes, closing prices or trading targets.
Pratik Algo analysis: An exchange security incident can affect markets through several channels. Customers may reassess where they hold assets, traders may reduce exposure, and interrupted withdrawals can complicate the movement of collateral between platforms.
The next stage depends partly on whether withdrawals resume securely and whether disclosures restore confidence. A successful reopening could ease immediate concern. A longer interruption, additional security findings or unclear reconciliation could prolong uncertainty.
Neither outcome guarantees a particular price move. Interest rates, the dollar, institutional flows and broader risk appetite can influence crypto prices at the same time.
What should Binance users check now?
Use the official app or a bookmarked website to review service notices and account activity. Check the relevant token and network rather than assuming that a general announcement applies identically to every transfer.
Be especially careful with unsolicited messages offering compensation, emergency verification or a “safe wallet.” Binance’s published security guidance describes scams in which impersonators provide a recovery phrase and persuade users to move assets into a wallet controlled by the scammer.
Practical precautions include:
- Never share passwords, one-time codes, private keys or your recovery phrase.
- Never import a recovery phrase supplied by an unsolicited support contact.
- Avoid links demanding a payment to unlock withdrawals or claim compensation.
- Keep transaction IDs and support records, and contact support through the official platform.
These are general precautions; they do not imply that every customer account has been compromised.
What matters next?
Watch for a confirmed withdrawal restart, clear asset-by-asset service notices, verified recovery totals and a technical explanation of how unauthorized transfers became possible.
An updated reserves disclosure can provide useful information about reported assets. It should be assessed alongside customer obligations and operational disclosures; an asset snapshot alone cannot demonstrate that the security weakness has been fixed.
For this developing story, operational evidence will carry more weight than an estimated reopening window: services restored, transfers processed and recovery progress documented.
Follow VYOMA Beta from Pratik Algo
Pratik Algo’s VYOMA Beta provides a view of reported gold charts, model activity and research progress. Testing continues ahead of the full launch, and reported information may be delayed or unavailable.
*This article provides news and educational analysis, not personalized investment advice. Service availability and incident estimates may change after the reporting cutoff.*