A compromised professional computer, unauthorized cryptocurrency transfers, and several billions of dollars of assets frozen in an emergency: Binance, the world’s leading cryptocurrency exchange by volume, is at the center of a hacking incident of unprecedented scale.
In the night of October 29 to 30, 2026, the company assessed the impact of the attack at around $6.3 billion, while its partners attempted to freeze funds transferred to addresses linked to the hackers.
To understand the affair, three things must be distinguished: the assets whose transfers were compromised, those that were immobilized, and the losses that may eventually need to be covered.
A “frozen” amount is not necessarily an amount already returned to customers. And the suspension of Binance’s operations does not mean that a flaw has been demonstrated in the functioning of the blockchains themselves.
The Essentials
$6.3 billion: Binance’s overall estimate of the impact of the hack announced on October 30.
About $3 billion: assets that Binance says it has frozen following the attack, in its latest update viewed. A previous tally stood at $2.54 billion.
Deposits and withdrawals: temporarily suspended for security checks, according to Binance. No firm reopening time is announced in its official statement.
Customers: Binance commits to covering all losses with its SAFU protection fund and its own resources. The execution of this commitment remains to be tracked.
Possible origin: a compromised engineer’s laptop, according to the platform’s preliminary investigation; the authors’ responsibility is not yet officially established.
Binance, what exactly is it?
Binance is a company that allows its users to buy, sell, exchange, and store cryptocurrencies such as Bitcoin, Ethereum, or dollar-pegged digital currencies. It acts as an intermediary: rather than managing all their transactions and cryptographic keys themselves, many customers pass through its app and the technical wallets it administers.
It is this centralized model that explains the nature of the risk. A platform can have strong protections, but if its authorization systems or certain technical accounts are compromised, unauthorized transfers can be initiated. Attacking Binance is not the same as breaking the computer protocol of Bitcoin or any other blockchain.
What happened in the night of October 29 to 30?
On Thursday, October 29, transaction-analysis firms specializing in blockchain movements spotted massive transfers from wallets linked to Binance. The company subsequently confirmed a security incident and began working with crypto issuers, specialized investigators, and authorities.
The estimate became clearer over the hours. In an initial tally relayed by Reuters, $2.54 billion of assets had been frozen. In Binance’s statement published on October 30 at 02:23, the total impact was estimated at $6.3 billion and the frozen amount at about $3 billion. These figures therefore describe successive stages of the investigation, not two incompatible tallies.
According to AFP, the platform announced around 00:30 GMT on Friday the temporary suspension of deposits and withdrawals. Binance confirms this suspension in its official statement, invoking security checks and the search for funds. The platform does not set, in this statement, a guaranteed time for the restoration of operations.
How could the hackers have managed to transfer the funds?
Binance’s initial investigation mentions a laptop of an engineer in charge of technical operations, or “DevOps”, that would have been compromised. The attacker would have used this access to intrude into an internal service and submit unauthorized withdrawal transactions. Binance states that, to date, there is no evidence of private-key leakage from its wallets.
For a non-specialist reader, the distinction is important: a pirate may seek to trigger an operation by a system that already has the necessary permissions, without necessarily stealing the cryptographic secrets themselves. The exact mechanisms and any weaknesses in internal controls will only be known after the technical investigation announced by the company.
Independent analyses do not all give the same valuation of the movements: Chainalysis valued the stolen assets at about $5.912 billion at their value at the time of the incident, while TRM Labs tracked transfers of around $6.36 billion across several networks. These differences stem largely from the perimeters and valuation methods. The total reference amount reported by Binance remains around $6.3 billion.
Six billion affected, three billion frozen: where is the money?
A “freeze” means making certain digital assets temporarily non-transferable. It does not necessarily imply immediate restitution to Binance, nor that restitution has already appeared on a user’s account. It can be a technical block pending the outcome of the investigation.
| Figure | What it means |
| ~$6.3B | Total impact estimated by Binance; it does not yet correspond to a confirmed final loss for customers. |
| ~$3B | Assets that Binance and its partners say have been frozen; not all are necessarily recovered. |
| ~$3.3B | Arithmetic difference between the two published amounts, without proof that this sum is definitively lost or that it remains entirely available to attackers. |
The investigators are following several blockchains and different assets, including Bitcoin, Ether, and stablecoins. The recoverable amount will evolve with the freezing operations, the tracing of transactions, and the legal steps.
Why can Tether and Circle block billions?
A large portion of the funds involved consisted of stablecoins, digital tokens designed to track the value of a currency, often the US dollar. The best known are USDT, issued by Tether, and USDC, issued by Circle.
Unlike Bitcoin, which has no central issuer capable of deciding alone to block transfers from an address at the protocol level, some stablecoins include administrative controls managed by the issuing company. It can, when the technical arrangement allows, place certain addresses on a blocking list and immobilize the tokens concerned.
According to information released and relayed by Reuters and CoinDesk, Tether froze more than $1.56 billion in USDT, while Circle immobilized more than $800 million in USDC, around $823 million according to cited data. Other actors contributed to the blocking measures, bringing the total announced by Binance to around $3 billion.
Why can USDT be frozen, but not simply “blocked” Bitcoin?
USDT and USDC: certain contracts and issuance mechanisms allow Tether and Circle to block tokens held at identified addresses. The freeze can prevent their transfer.
Bitcoin: no company can, by a simple decision, freeze an address on the Bitcoin network. The funds can nonetheless be monitored, and a platform that receives them can refuse or block their use in its own system.
Consequence: tracing a cryptocurrency and recovering it are two different operations. Recovery is never automatic.
Will users lose their money?
Binance asserts that its users’ funds are protected and that it will cover all losses related to the hack using its security fund, called SAFU (“Secure Asset Fund for Users”), along with the company’s own financial resources. This is Binance’s public commitment, the implementation of which remains to be observed.
According to CoinDesk, the SAFU fund represents about $1 billion in Bitcoin. It does not, therefore, on its own cover the entire amount initially announced for the attack. Binance specifically notes that additional company funds may be mobilized. It is not possible, based solely on the SAFU fund amount, to conclude on the company’s overall financial capacity or on a definitive loss for its customers.
Another document will be particularly followed: Binance has announced that it will publish an updated proof of reserves after the corrective operations. This document should help illuminate the balance coverage by held assets, while needing to be read alongside the usual limitations of such publications.
Who could be behind the attack?
Blockchain intelligence firm TRM Labs attributes, with a high level of confidence, the operation to the North Korean group TraderTraitor, associated in several investigations with the Lazarus cyber-espionage ecosystem. It relies on technical elements and resemblances to prior operations.
However, this attribution remains a private investigative conclusion, and not an identification officially confirmed by Binance or a court decision. Authorities continue their investigations. Prudence is all the more warranted as hackers may attempt to mask their traces by routing funds through multiple services and networks.
Why are we talking about a historic hacking?
In February 2025, platform Bybit suffered a theft estimated at about $1.5 billion, then considered one of the sector’s largest. The incident reported by Binance, with a $6.3 billion estimated impact, represents an amount roughly 4.2 times higher. This comparison explains the exceptional nature of the case, even though its final cost is not yet established.
The magnitude of the sums is not the only novelty. The attack shows the speed with which assets can be moved across networks, but also the power of intervention available to the issuers of certain stablecoins. It revives the debate over centralized custody of cryptocurrencies, internal authorizations, and transparency of reserves.
What impact on the markets?
The revelation of the hacking triggered a pullback in major cryptocurrencies during the night trading of October 29 to 30. Bitcoin fell below $77,000, down about 5% at one point in the session. Ether declined about 5–6% and BNB, the token tied to the Binance ecosystem, around 7–10%, depending on the time and quotation feed. These fluctuations reflect the reaction to the announcement and are not fixed prices for the entire day.
The shock revived questions about the security of intermediaries that hold users’ digital assets for safekeeping. A market reaction due to a trust incident does not imply that every blockchain itself experienced a hack.
What should cryptocurrency holders, especially in Tunisia, take away from this?
The first precaution is to not confuse platform incidents with recovery messages. After a highly publicized cyberattack, scammers may try to contact users claiming to unlock or safeguard their holdings. No legitimate advisor would ever need a wallet’s secret recovery phrase or the password shared by message.
Users should consult information published in the app or on official channels, check account security notifications, beware of links received via SMS or chat, and not pay “unlock fees” to strangers. Personal decisions regarding digital assets must take into account their high volatility and the actual status of available services.
The TN Reading
The Binance case raises three distinct questions: how could an internal authorization have been used to transfer funds, what portion of assets can actually be recovered, and how will the platform implement its commitment to cover its clients’ losses?
The freezing of several billions in stablecoins is a major intervention, but a frozen asset is not yet a restituted asset. Likewise, the size of the SAFU fund is not by itself sufficient to assess Binance’s overall financial health.
The next key elements will be the publication of the full technical report, the evolution of the amount recovered, the effective resumption of services, and Binance’s announced update of its reserves.
