Binance Reports $3 Billion Frozen After Estimated $6.3 Billion Crypto Theft

Binance said on October 30, 2026, that it had frozen about $3 billion after disclosing an estimated $6.3 billion theft the day before. Deposits operated normally, but withdrawals remained paused as the cryptocurrency exchange rebuilt the affected withdrawal systems.

In its latest update, Binance pledged to cover all losses through its SAFU emergency fund and company resources. The frozen assets have not necessarily been returned to the exchange, and the final loss and recovery totals remain unsettled.

Blockchain investigators have independently corroborated multibillion dollar outflows. Their assessments point to North Korean attackers, but that attribution remains distinct from a publicly confirmed government determination.

What Investigators Have Confirmed

According to Reuters reporting published October 30 , Chainalysis research head Eric Jardine said investigators had confirmed at least $5.912 billion stolen as of 8:30 p.m. Eastern on October 29. Chainalysis said the cause remained under investigation.

Reuters separately reported that TRM Labs estimated $6.36 billion had been transferred out across ten blockchains. The figures support the scale of Binance’s estimate, but they do not complete an accounting of losses.

TRM Labs described the incident as the largest hack in history and attributed it with high confidence to TraderTraitor, a North Korean hacking unit.

TRM cited blockchain activity and additional intelligence, including small Tornado Cash withdrawals used to fund an operator wallet, preparation, and transaction signatures obtained before a coordinated burst of activity. Those findings represent the firm’s assessment, not a government conclusion.

Withdrawals Remain Paused

Binance initially suspended deposits and withdrawals and revoked authorization for the affected address. Its subsequent update said deposits were no longer affected, while withdrawals would remain paused during changes to the withdrawal service and associated addresses.

The company said it expected withdrawals to resume within 48 hours. That is a restoration target, not confirmation that access has returned.

Binance also described approximately $3 billion as its current verified frozen total on the blockchain. That remains a company figure, not a universally reconciled, independent total. Freezing assets restricts their movement and should not be described as completed recovery or reimbursement.

Cause And Customer Protection Remain Under Review

Binance’s preliminary explanation was that a compromised DevOps engineer’s laptop may have enabled access to a service container and unauthorized withdrawals. The company said it found no evidence that wallet private keys were leaked.

Those findings remain preliminary. Binance has promised a technical report after its investigation and updated proof of reserves following remediation.

For customers, the immediate distinction is between Binance’s promise to cover losses and evidence that it has completed reimbursement or reserve replacement. The exchange’s next disclosures will need to clarify withdrawal restoration, the final financial impact, and how much of the frozen money has actually been returned.