Binance now says the $6.3 billion theft involved several points of breach rather than one compromised laptop, while about $3 billion is frozen and withdrawals stay paused. Cointelegraph reports stolen funds moved through THORChain, reviving a dispute over what decentralized protocols can block.
Binance revises its account of how the attackers got in
Binance said on Friday that its investigation had turned up further points of breach in the incident that started Thursday, Decrypt reported. The exchange first pointed to a compromised DevOps engineer's laptop. That device, it said, may have given an attacker access to a service container from which unauthorized withdrawal transactions were submitted.
CEO Richard Teng said the attacker drew on more than one engineer's access and that the attack was not a single step. The Defiant built its summary around Teng's statement that the breach was not a one-click attack. Teng also said the inquiry has not yet blamed any particular person.
Binance said it has found no evidence that any wallet private key leaked. According to Decrypt, the exchange paused withdrawals, which stopped the outflows, and it revoked the affected address authorization. It added that it is cooperating with law enforcement agencies and blockchain analytics companies to follow the funds.
Where the stolen funds stand
Binance puts the loss at around $6.3 billion and says it will cover all of it from its SAFU emergency fund and company resources. It also says roughly $3 billion of the impacted assets has been locked onchain, with blockchain partners assisting. Deposits were operating normally by Friday morning, but withdrawals remain suspended while Binance rebuilds the withdrawal service and its related addresses.
Blockchain analytics firm Arkham gave a lower and more granular picture. The key figures reported by Decrypt are below.
- Arkham put the haul at $6.01 billion, drawn from Binance hot wallets across nine chains in a window running from 4:10 p.m. to 7:05 p.m. ET on Thursday.
- Arkham said issuers had frozen $2.80 billion, while $2.9 billion in assets such as Ethereum, Bitcoin, Tron and Solana tokens could still be moved.
- Tether and Circle froze about 975.1 million USDT and 823 million USDC in the main receiving wallet, worth about $1.8 billion.
- Arkham's entity page for the attacker showed about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances.
- Early Friday the wallets moved $38.82 million of ETH to a fresh address and still held $1.12 billion of ETH, Arkham said, while a Tron address it labeled as the attacker's distributed roughly $2.1 million of TRX across nine new addresses via 14 transfers.
THORChain again sits in the laundering path
Cointelegraph reported that onchain investigator ZachXBT traced funds from the Binance theft and from September's Bitget hack through THORChain. Both flows were then combined at the same Ethereum address, according to ZachXBT. He said the Bitget attack had been attributed to the North Korea-linked group TraderTraitor, and Cointelegraph added that TRM Labs and Chainalysis have also tied the Binance hack to that group.
THORChain lets users swap assets across blockchains. The same outlet noted that North Korean hackers previously used it to move money from the $1.4 billion Bybit hack in February 2025 and from the $388 million Bitget hack. Cointelegraph said the RUNE token gained over 13% on Friday and traded at $0.67, up from $0.59 at 12:20 a.m. UTC, citing TradingView.
After the Bitget exploit, CEO Gracy Chen asked the protocol to block the attacker's addresses. She argued that "Decentralization is a design principle, not a shield for facilitating known stolen funds." THORChain declined, stating that it cannot stop particular swaps. Its node operators, it added, can halt trading on one chain or network-wide to deal with security risks.
How the outlets' accounts compare
The headline loss differs depending on who is counting. Cointelegraph says Binance confirmed a $6.3 billion hack, while Decrypt describes the figure as an estimate by the exchange. Arkham's tally is $6.01 billion, and Decrypt noted that an onchain count on Thursday had put the drain at $5.57 billion. The gap likely reflects different counting methods and timing, though the outlets do not say so.
The frozen amount also varies. Binance says about $3 billion is frozen, a figure repeated by The Defiant. Arkham attributes $2.80 billion to freezes by issuers. These numbers may not measure the same thing, and neither outlet reconciles them.
Attribution is another difference. Teng said Binance has not pinned responsibility on any individual, and Decrypt's account does not name a group. Cointelegraph, by contrast, cites TRM Labs and Chainalysis linking the incident to TraderTraitor. CoinDesk's live coverage is available only as a headline and summary, which say the hack adds to crypto jitters on a day when weak earnings outlooks and AI spending concerns pushed the QQQ down more than 2%.
Why the incident matters beyond one exchange
The reported entry method matters for every platform that holds customer assets. If attackers can combine access across several systems rather than exploit one device, single fixes such as replacing a laptop are not enough. Teng's description of a more complex process suggests Binance is reviewing the withdrawal service and its address authorizations as a whole.
The speed of the stablecoin freezes shows how much recovery depends on centralized issuers. Tether and Circle could act on the main receiving wallet within hours. Assets such as ETH, BTC and TRX have no equivalent freeze mechanism, which is why Arkham's figure for movable assets remains large.
Market data is a limited guide here. Bitcoin trades near $77,590, down 3.1% over 24 hours, and Ether is at $2,242, down 3.5%. CoinDesk links the hack to market jitters alongside the tech selloff, but the outlets do not establish how much of the move comes from the breach itself. TRON's TRX, by contrast, is up 2.5% in the same period at $0.339502, and no outlet connects that to the attacker's TRX transfers.
What to watch next
Binance has promised a detailed technical post-mortem once every fact is verified. It also plans to publish an updated Proof of Reserves after remediation. Decrypt reported that the exchange remains on track to resume withdrawals in 45 hours. Whether that timeline holds depends on how far the security revamp of the withdrawal service has progressed.
Several questions remain open. It is unclear how the additional points of breach relate to the engineer's laptop, and whether Binance will confirm the attribution made by TRM Labs and Chainalysis. It is also unclear whether the roughly $2.9 billion Arkham describes as movable will be frozen or laundered. For THORChain, the Bybit episode previously split contributors, with developer Pluto departing and validator TCB threatening to leave, so another round of pressure on node operators is possible.
Users of Binance can watch the exchange's withdrawal status and its coming Proof of Reserves update. Projects whose tokens were affected should check issuer and exchange announcements for freeze actions.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $77,590 | -3.1% | -4.8% | $1.56 trillion |
| Ethereum (ETH) | $2,242 | -3.5% | -6.3% | $273.92 billion |
| TRON (TRX) | $0.339502 | +2.5% | +3.7% | $32.27 billion |
CoinGecko data as of 2026-10-30 (UTC).
FAQ
How much did Binance lose in the hack?
Binance estimates the loss at around $6.3 billion, according to Decrypt. Arkham counted $6.01 billion taken from hot wallets on nine blockchains. Binance says its SAFU reserve and company money will pay for every loss.
Are Binance withdrawals open?
Not yet. Deposits were operating normally by Friday morning, but withdrawals remain suspended while Binance revamps the withdrawal service and its related addresses. Decrypt reported the exchange is on track to resume them in 45 hours.
Why is THORChain mentioned in the Binance hack?
Cointelegraph reported that ZachXBT traced stolen Binance funds and Bitget funds through THORChain before they were combined at one Ethereum address. THORChain has previously said it cannot block individual swaps. Its node operators can pause trading for a chain or the whole network.
Sources
- Cointelegraph: THORChain’s RUNE jumps 13% after Binance’s record $6.3B hack (2026-10-30)
- Decrypt: Binance Finds 'Additional Points of Breach' in $6.3B Hack (2026-10-30)
- CoinDesk: Live updates: Binance finds more breaches in $6.3 billion hack; AI spending fears hit tech (2026-10-30)
- The Defiant: Teng Says Binance Breach Was Not a ‘One-Click’ Attack (2026-10-30)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by Cointelegraph, Decrypt, CoinDesk and The Defiant. Not financial advice.
