Markets · Markets
Binance says it found more breach points as $3 billion stays frozen
The exchange says the attack went beyond a single compromised laptop and that it targets to start resuming withdrawals in about 34 hours, in phases. It has not said what the new breach points are.
Binance said Friday afternoon that its investigation into the attack on its hot wallets, the internet-connected wallets an exchange uses for day-to-day withdrawals, "has uncovered additional points of breach," widening an account that had centered on one compromised laptop. In the same update, the exchange said about $3 billion of the affected assets is frozen and that it "targets to start resuming the withdrawal service within approximately 34 hours," in phases [1]. For users locked out since Thursday, that is a target, not a reopening.
The update, posted on binance.com at 3:33 p.m. ET and signed by co-CEOs Yi He and Richard Teng, is Binance's second formal incident update [1]. It gives three time targets. Withdrawals are targeted in about 34 hours. A first Proof of Reserves snapshot is due "in 12 hours," with the result "ready by Monday 2026-11-02." Technical findings are expected "within about 48 hours" [1]. Teng pointed users to it at 4:00 p.m. ET, writing: "Withdrawals resume once security checks are done. Then our Proof of Reserves, and a full post-mortem" [2].
The mechanism
Binance's first explanation was narrow. At 10:24 p.m. ET Thursday it said the incident "may involve a compromised DevOps engineer's laptop," which gave an attacker access to a service that could submit withdrawals [3]. The new update keeps that suspicion but moves past it: "Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach" [1].
That matters for how long the doors stay shut. One bad laptop is one entry to close. More than one point of breach means more systems to check before money can move out again. Binance ties the restart to that work, saying withdrawals will resume "subject to the completion of security checks" and on "a phased approach" [1]. Deposits and other services not affected by the attack remain open, it said.
On the most serious risk, Binance repeated its earlier line. "At this stage, we have found no evidence that wallet private keys were leaked," the update says [1]. A private key is the secret that controls a crypto wallet. If keys had leaked, the exchange would need to move every affected balance to new wallets, not just patch a service.
The evidence
The money figures are Binance's. The update says Binance has "set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets," which it puts at "approximately 80% of the impacted amount" [1]. That $6.34 billion is a reserve of company money, not the loss. Binance says it is buying the rest of the tokens "through market and OTC channels," OTC meaning large trades arranged directly between two parties rather than on an exchange [1].
The size of the attack is unchanged. On Thursday Binance put the "estimated total impact" at "around $6.3B" [3]. Friday's update gives the same figure, calling it a loss of "approximately $6.3B USD worth of token assets" [1].
On recovery, Binance says "Approximately $3 billion has been frozen on-chain to date" [1]. Blockchain analytics firm Chainalysis, in its own assessment earlier Friday, put transfers at about $6.4 billion and frozen funds at about $2.8 billion [7]. Chainalysis has also tied the attack to North Korea; that attribution is Chainalysis's, and Binance's update does not address it (Le Coin's report).
Binance has restated the timeline through the day. At 4:47 a.m. ET Binance said withdrawals would come "in 45 hours" [4]. At 10:33 a.m. ET Teng said the "Sunday deadline" was "on track to be within 40 hours," and that the reserves report was "targeting Monday" [6] (Le Coin's report). The afternoon update restates it as a target "to start resuming" in about 34 hours, in phases [1]. Figure 1 sets Binance's statements side by side.
| Item | Earlier statement (ET) | Wording then | Friday update, 3:33 p.m. ET |
|---|---|---|---|
| Withdrawals | Oct. 30, 4:47 a.m. | "in 45 hours" | "targets to start resuming" in "approximately 34 hours," phased |
| Withdrawals | Oct. 30, 10:33 a.m. (Teng) | "on track to be within 40 hours" | restated as above; a target, not a restart |
| Proof of Reserves | Oct. 30, 10:33 a.m. (Teng) | "targeting Monday" | snapshot "in 12 hours," result "by Monday 2026-11-02" |
| Cause | Oct. 29, 10:25 p.m. | "compromised DevOps engineer's laptop" | "additional points of breach" |
| Private keys | Oct. 29, 10:25 p.m. | "no evidence of any wallet private key leak" | "no evidence that wallet private keys were leaked" |
| Frozen | Oct. 30, 6:55 a.m. | "$3bn" | "approximately $3 billion" on-chain |
| Company funds set aside | Oct. 30, 6:55 a.m. | over $6.34B; $5B in exact tokens | "more than $6.34B"; "$5B" in exact tokens; "approximately 80%" |
| Technical findings | none given | none | "within about 48 hours" |
Source: Binance announcement, Oct. 30, 2026 [1]; @binance posts Oct. 29–30 [3][4][5]; Richard Teng transcript [6]. Times are Binance's targets, not confirmed reopen times.
The Proof of Reserves step is the one users can check. Binance says the reports "will provide users with an updated view of platform asset holdings and the corresponding backing of user balances" [1]. A snapshot like this shows what an exchange holds against what it owes at one moment. It does not show how the attack happened or whether the systems are now secure.
The objection
Two gaps remain. First, Binance has not said what the additional points of breach are, how many there are, or whether any is still open. "The investigation remains ongoing," the update says, and technical detail is held back until it "will not compromise ongoing investigative efforts" [1]. Readers have the claim, not the evidence.
Second, a target is not a restart. The 34-hour figure is Binance's aim "to start resuming," it depends on security checks, and it comes in phases that Binance has not described [1]. Binance has restated the withdrawal target three times in a day, each time as a count of hours [1][4][6].
The tell (Le Coin's view)
Watch the first Proof of Reserves snapshot, due "in 12 hours" [1]. If it arrives on schedule and shows holdings covering user balances, it supports Binance's account of its reserve. If it slips, the Monday result date and the withdrawal target come into question with it. The next tell is the technical findings promised "within about 48 hours" [1], which should say what the extra breach points were.
Stop
What is settled: Binance says it has $6.34 billion set aside, $5 billion of it in the affected tokens, about $3 billion frozen, and no evidence of leaked keys [1]. What is not: what else was breached, and when the first user can withdraw.
Sources
- Binance, "Security Incident Update #2 (2026-10-30)," binance.com, Oct. 30, 2026, 3:33 p.m. ET, https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751 , accessed Oct. 30, 2026, ~4:20 p.m. ET.
- Richard Teng (@_RichardTeng), Oct. 30, 2026, 4:00 p.m. ET, post 2116259036903669855: https://x.com/_RichardTeng/status/2116259036903669855
- @binance, Oct. 29, 10:24 p.m. ET (edited 10:25 p.m.), post 2115993361517891592: https://x.com/binance/status/2115993361517891592
- @binance, Oct. 30, 4:47 a.m. ET, post 2116089661408108712: https://x.com/binance/status/2116089661408108712
- @binance, Oct. 30, 6:55 a.m. ET, post 2116121748555153621: https://x.com/binance/status/2116121748555153621
- Richard Teng (@_RichardTeng), transcript of video update, Oct. 30, 10:33 a.m. ET, post 2116176703823528024: https://x.com/_RichardTeng/status/2116176703823528024
- Chainalysis, "The $6.4 Billion Binance Exploit: Tracing the North Korea Link," Oct. 30, 2026, 5:34 a.m. ET (modified 6:41 a.m. ET): https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/
Holding the Corner.
Not financial advice.