Binance, the world’s largest cryptocurrency exchange, said on Thursday that a “security incident” on its platform affected roughly $6.3 billion worth of assets. It is one of the largest security events in the crypto industry so far, though the exchange said close to $3 billion of the affected funds had already been frozen on-chain.
Stablecoin issuers moved quickly after the data breach at Binance. Tether said it had frozen more than 1.567 billion USDT linked to the incident, and Circle froze 800 million USDC. The Arbitrum Security Council also reportedly executed a transaction to freeze about $30.5 million connected to the Binance exploit.
How the Binance Data Breach Happened
According to the exchange, early findings point to a compromised employee device. Initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” Binance said in an update.
The statement, titled “Security Incident Update,” was published on October 30, 2026, at 07:53. It said the company had found no evidence that any wallet private key was leaked. Binance added that it would release a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
Who Will Cover the Losses
Binance said it will cover all losses from the cyberattack on Binance using its Secure Asset Fund for Users (SAFU) and the company’s own funds. “User funds are safe,” the exchange stated. It also said it had worked with blockchain partners to freeze the affected assets. Once remediation is complete, it plans to publish an updated Proof of Reserves.
Immediate Steps Following the Binance Data Breach
As an immediate precaution, the exchange said it has:
- Temporarily suspended deposits and withdrawals while security checks are completed;
- Revoked the affected address authorization;
- Engaged law enforcement and blockchain intelligence partners to trace and recover the funds.
The company said its teams are working around the clock to resolve the issue. “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” Binance said.
The exchange asked users to rely only on official Binance channels for updates and to contact Binance Customer Support with any further questions.
Withdrawals Expected to Resume Within 48 Hours
In a later update, Binance said it expects withdrawals to resume in 48 hours, after its team “completes a security revamp of the withdrawal service and its related addresses.”
Until then, users cannot move funds on or off the platform. Binance has not yet said how the attacker gained access to the engineer’s laptop. The company has said those technical details will be in its upcoming post-mortem on the Binance data breach.
