Binance Estimates $6.3 Billion Cyberattack as Stablecoin Issuers Freeze $2.3 Billion
Binance has estimated the total impact of a cyberattack at about $6.3 billion, and said roughly $3 billion of the affected assets had been frozen on-chain so far, according to Engadget.
Reuters describes Binance as the world's largest cryptocurrency exchange. The exchange said it will cover all losses using funds from its SAFU fund (a reserve set aside to protect users) and the company, and that user funds are safe. Withdrawals have been frozen while Binance carries out a security revamp, but deposits have remained normal. Reuters reported that Binance expects to resume withdrawal services within the next 48 hours, following the October 2026 security incident, in a Reuters report dated October 29.
The freezes extended beyond the exchange. Tether froze $1.5 billion in funds associated with the attack, and Circle froze $800 million. Both are stablecoin issuers, companies that issue tokens pegged to the dollar, and the two freezes together account for the bulk of the funds immobilized on-chain to date.
Binance's initial investigation points to an entry route in operations rather than in the protocol layer, meaning the smart contracts and blockchain code themselves. A compromised DevOps engineer's laptop may have enabled the attacker to reach a service container and submit unauthorized withdrawal transactions. The investigation is at an early stage, and the exchange has not yet published a full root-cause analysis. How the attacker moved from the endpoint into the container, and what controls sat between the container and the withdrawal path, remain unclear.
Security research firm TRM Labs attributed the attack to TraderTraitor, which it described as North Korea's elite hacking unit, with high confidence. That attribution comes from TRM Labs, not from Binance.
If the $6.3 billion estimate holds, the theft would be a record for cryptocurrency theft, eclipsing the $1.5 billion hack of the Bybit exchange last year. The comparison rests entirely on the current estimate, which the exchange has described as an estimate.
The broader context here is that the attack surface of centralized exchanges increasingly includes engineering tools, build and deployment pipelines, and the credentials that reach production withdrawal services. A single compromised workstation with privileged access to a service container can, under the path described, produce transactions that look authorized to downstream systems. Hardware-bound credentials (keys stored on a physical chip that cannot be copied), segregated signing environments, and withdrawal policies that require independent approval are standard answers in the security literature. Whether Binance applies them in its revamped stack is what the resumption of withdrawals will test.
In my view, the stablecoin freezes are the more consequential development for the wider market. Two issuers were able to halt $2.3 billion in flows tied to a single incident within days, which gives the industry a concrete measure of how much intervention capacity centralized issuers hold. That capacity can protect users, but it also places a discretionary control point in the path of recovery, and that tradeoff will shape how exchanges and issuers coordinate in the next incident.
For operators, the immediate lesson is narrower and more practical. Engineering endpoints are production assets. The question for the next quarter is less about whether a determined state actor can reach an engineer's laptop and more about whether a compromised laptop can reach a withdrawal path at all.
