What we know about the Binance hack:
- Binance says the verified total frozen is $3 billion and could increase as investigators trace additional assets.
- Binance has temporarily suspended withdrawals and deposits as it investigates the security breach.
- Chainalysis estimates the amount of crypto stolen in the security breach is $5.9 billion. The final loss remains undetermined.
- Circle, Tether, Ripple, World Liberty Financial and Arbitrum have helped to freeze millions in crypto assets.
- The incident did not impact Binance.US.
Oct. 30 at 01:19 am UTC
Bitcoin trades below $77,000 as BNB falls 8%
Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211.
DeFi tokens also fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the same period.
Oct. 30 at 12:52 am UTC
Binance says $3 billion now frozen from hack
Binance said the current verified amount of assets frozen from the hack is now $3 billion.
The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH).
“The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said.
“As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.
The funds will no longer be accessible to the address that originally held the funds and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, it added.
Oct. 30 at 12:26 am UTC
Chainalysis estimates $5.9 billion stolen from Binance
Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.
Binance earlier said the verified total frozen is $2.54 billion.
Oct. 30 at 12:26 am UTC
Blockaid suspects Binance hack involved private key “misuse,” not theft
The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature rather than stealing private keys, according to Blockaid co-founder and CEO Ido Ben-Natan.
Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.
“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.
Arkham CEO Miguel Morel said the attack appears to be ongoing.
Oct. 30 at 12:07 am UTC
Binance says deposits temporarily suspended
Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals.
“We are working around the clock and will share a full post-mortem once the investigation is complete,” the company said, adding it will “cover all losses.”
Earlier, Binance also said it had temporarily suspended Binance Alpha trading.
Oct. 30 at 12:07 am UTC
Wintermute and GSR disclose Binance exposure
Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses.
The firms are market makers, which place buy and sell orders on exchanges to help other traders complete transactions. A disruption to their operations could make trading harder or more expensive across crypto markets.
GSR CEO Xin Song said its Binance exposure was less than 5% of its net equity, meaning the value of its assets minus its liabilities. He said GSR was working with Binance to understand the incident and identify ways to help.
Wintermute CEO Evgeny Gaevoy said his firm’s exposure was less than 20% of net equity and that he did not expect operational disruption.
Neither executive disclosed a dollar amount for the exposure or confirmed financial losses.
Oct. 29 at 11:40 pm UTC
Ripple freezes RLUSD linked to Binance hack
Ripple is freezing holdings of its dollar-pegged RLUSD stablecoin linked to the Binance hack, according to Jack McDonald, the company’s senior vice president of stablecoins.
McDonald said Ripple was “actively freezing affected funds” and coordinating with relevant parties to support the investigation. He did not disclose the amount frozen.
Oct. 29 at 11:35 pm UTC
Binance says $2.54 billion frozen after hack
Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
The exchange said the total could increase as its teams work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets. Binance said it would publish further figures once verified.
Oct. 29 at 10:36 pm UTC
World Liberty Financial freezes $27 million in USD1
World Liberty Financial has frozen $27 million in US-dollar-pegged stablecoin USD1 and $2 million worth of WLFI, according to Binance co-founder Yi He.
“USD1 has taken proactive steps to freeze the $27 million in USD1 associated with the Binance hack,” said World Liberty Financial co-founder and CEO Zach Witkoff.
World Liberty Financial said it worked with BitGo to freeze the stolen WLFI and USD1 funds.
“We will cooperate fully with the ongoing investigation and support efforts to hold those responsible accountable. Protecting our users remains a top priority,” said World Liberty in a post on X.
Oct. 29 at 10:33 pm UTC
Binance says withdrawals will resume once issues resolved
Binance says its team is conducting security checks and will resume withdrawals as soon as the “security issue” is resolved.
Oct. 29 at 10:32 pm UTC
Aave freezes markets after Binance exploiter borrows $44.6 million
Decentralized lending protocol Aave froze markets across its V3 and V4 deployments as a precaution following the Binance hack.
In a governance forum update posted after the freeze, risk service provider LlamaRisk said the Binance exploiter deposited 60 million USDT and borrowed 19,762 Wrapped Ether (WETH), worth about $44.6 million at the time.
The borrowing occurred between 8:58 pm and 9:01 pm UTC on Oct. 29, about 40 minutes before the first freeze. It was the exploiter’s only Aave position across all networks and versions, with no further interactions detected after 9:01 pm UTC.
The position remained backed by $59.9 million in USDT collateral against $43.8 million in debt at the update’s snapshot. LlamaRisk said it remained subject to normal liquidation and did not put Aave suppliers at risk.
The freezes covered 175 reserves on V3 across 16 networks and 117 reserves on V4 across four networks.
Users can still withdraw funds and repay loans, and liquidations continue. However, the freeze prevents new deposits and borrowing, including additional collateral deposits, leaving repayment as the only way to improve an existing position’s health factor.
LlamaRisk said markets would remain frozen until the exploiter’s funds stopped moving and Binance provided greater clarity on containment, followed by a staged reopening. It warned that a prolonged freeze could push borrowing rates higher as withdrawals reduce available liquidity.
Oct. 29 at 9:19 pm UTC
Binance investigates $5.8 billion security breach
Binance is investigating a potential multibillion-dollar security breach involving one of its Ethereum wallets, after suspicious transfers prompted stablecoin issuers Tether and Circle to reportedly freeze billions in assets.
A Binance spokesperson told Cointelegraph on Thursday that the exchange was investigating reports of a potential security issue but had not confirmed any impact on user funds. The spokesperson said its security teams were reviewing the activity and would provide updates once more information was verified.
Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash. Spreek later reported that wallets connected to the transfers had begun selling Tether USDt (USDT) through decentralized exchanges.
Blockchain analytics platform Arkham Intelligence later identified a collection of wallets labeled “binance-hacker-1029” holding approximately $5.84 billion in digital assets. The figure represents the wallets’ reported holdings rather than a confirmed estimate of stolen funds.
Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.
Source: Arkham Intelligence
Tether, Circle freeze over $2.36 billion as Binance outflows reach $3.3 billion
Blockchain security firm Blockaid said its team had identified roughly $3.3 billion in suspicious transfers involving Binance-linked wallets across Ethereum, Arbitrum and Avalanche.
Shortly after news of the hack emerged, Tether and Circle, the two largest stablecoin issuers by market capitalization, said they had frozen a combined $2.36 billion in tokens linked to the suspected incident.
Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC in coordination with law enforcement and would continue supporting the investigation.
A few minutes later, Tether CEO Paolo Ardoino said the company had frozen more than $1.567 billion in USDT linked to the potential exploit.
“Protecting the industry and our partners is our main priority,” Ardoino wrote.
The Binance hack came hours after Polymarket temporarily halted trading following a compromise at a third-party provider. The prediction market platform said it had fixed the issue and pledged to reimburse affected users, with all systems reported operational by 7:05 p.m. UTC Thursday.
Magazine: Private, fast USDT is coming to Bitcoin. Can it compete with Ethereum and Tron?
Read the full article here
