Overview
- Industry trackers say funds moved out of Binance hot wallets in a rapid multi‑chain operation early Friday, Oct. 30, 2026, with estimates around $6.3 billion.
- Stablecoin issuers and other partners have frozen about $2.7–$3 billion on‑chain so far, and Binance reports roughly $3 billion of the affected assets are frozen.
- Binance’s initial investigation finds no evidence of leaked wallet private keys and says the attacker used a compromised engineer laptop to reach a service container and submit unauthorized withdrawals.
- Multiple blockchain intelligence firms attribute the operation with high confidence to North Korea‑linked groups and report the attackers are laundering remaining funds through mixers, swaps and OTC trades while holding large amounts of unfrozen BTC and ETH.
- Binance suspended withdrawals, revoked the affected authorization, pledged to make customers whole using its SAFU reserve and company funds, and is working with law enforcement and analysts as markets and regulators prepare for tighter scrutiny.