Binance's $6.3bn security incident: what happened and what it means for your crypto

Binance, the world's largest crypto exchange, said on 29–30 October 2026 that a security incident had an estimated impact of $6.3bn. About $3bn of that has been frozen so far. The exchange paused withdrawals while it reworks their security. Bitcoin and ether, the two biggest cryptocurrencies, fell on Friday 30 October.

Many details are still unclear. This explainer sets out what the company has said, what outside data suggests, and what nobody knows yet.

What has Binance actually said?

Binance said the estimated impact of the incident is $6.3bn. It said about $3bn in crypto assets has been frozen so far. It also said customer funds remain safe and that it will cover all losses from two pots of money: its SAFU fund and company funds.

SAFU is the exchange's emergency reserve for users. Think of it like a community contribution kept aside for a bad day. If something goes wrong, the exchange can dip into it to make customers whole. How big the SAFU fund is was not given in the material we have, so we cannot say whether it covers the full amount alone. Binance's statement says company funds will also be used.

Binance suspended withdrawals while it reworks its withdrawal security. Co-founder Yi He said withdrawals should start resuming within 48 hours. That is a company estimate, not a guarantee.

How did it happen?

Nobody outside Binance can say for sure yet. Binance's early finding is that the incident may involve a compromised laptop belonging to a DevOps engineer. A DevOps engineer is a technical worker who builds and maintains the systems a company runs on. A compromised laptop means someone else may have taken control of it.

Co-CEO Richard Teng said there was no evidence that a wallet private key had leaked. A private key is the secret code that lets someone move the coins in a wallet. Whoever holds the key controls the money. Teng also said the attack was a complex process, and not one engineer misusing their permissions.

These are early statements. Binance said it would publish a technical report and an updated Proof of Reserves after it has fixed the problem. Proof of Reserves is a check that is meant to show an exchange holds enough assets to match what it owes customers. Until those documents appear, the cause is a preliminary account.

Changpeng Zhao, Binance's co-founder, is reported to have written on X that it does look like a hack on Binance. That is a social media post relayed in reporting, so treat it as a comment, not a finding.

How big is the loss, really?

The numbers do not all match, and that matters.

• Binance's own estimate of the impact is $6.3bn.
• Arkham Intelligence, a firm that tracks money moving on blockchains, linked nearly $6bn in assets to 55 wallet addresses tied to the exploit.
• Other on-chain data pointed to about $6bn, and an earlier claim put the figure at $2.7bn.

The on-chain data broke the amount down by blockchain: about $3.78bn on Ethereum, $1.441bn on Bitcoin, $628M on Tron, $290M on XRP Ledger, $94M on Solana and $61M across four other chains. Added together (derived), that comes to about $6.29bn, close to Binance's figure.

Two things are not known. One is how much was actually stolen and how much was only moved or affected. The other is how much can be recovered. Binance says $3bn is frozen, which is about 48% of $6.3bn (derived: 3 ÷ 6.3). Tether and Circle, the companies behind two large stablecoins, have reportedly frozen about $2.3bn in stablecoins. That figure is unconfirmed, as it comes from press reporting.

What is a stablecoin, and why can it be frozen?

A stablecoin is a crypto token designed to hold a steady price, usually one US dollar. Tether and Circle issue two of the biggest. Because a company issues and controls them, it can block specific wallets from moving them. That is why freezing is possible here. Bitcoin and ether have no company in charge, so no one can freeze them in the same way.

Is this the biggest crypto hack ever?

If confirmed, yes. The previous record was the $1.5bn Bybit exploit in February 2025. At $6.3bn, this incident would be about 4.2 times larger (derived: 6.3 ÷ 1.5). The word confirmed matters, because the cause and the final loss are still being worked out.

What happened to prices?

Prices fell on Friday 30 October. Using one set of quotes from that day, bitcoin fell 2.8% to $78,489.73. Ether fell 3.8% to $2,242.90. BNB, the token linked to Binance, fell 3.5% to $717.4. Other reports quote slightly different levels because they were taken at different times. The direction is the same.

One token went the other way. Hyperliquid's HYPE token rose 17% to $93.16. The sources give no reason. RainingMoney's reading: some traders may be moving toward platforms that are not run by a single exchange, but the sources do not say so, so this is a guess.

Crypto liquidations were reported at more than $1bn in 24 hours. A liquidation happens when a trader borrowed money to bet on prices and the market moves against them. The trading platform then sells their position automatically to cover the loan. When many liquidations happen at once, they can push prices down further.

Why does one exchange's problem move the whole market?

Binance is the world's largest crypto exchange. A huge number of traders buy, sell and park coins there. When it pauses withdrawals, people cannot move their coins. Some worry about what else might be wrong, and some sell elsewhere to raise cash or reduce risk. That selling pressure can lower prices across the market.

There is also a trust effect. An exchange works a bit like a bank for crypto. You hand over your coins for safekeeping. If the keeper has a security problem, even customers who lose nothing start to ask whether their coins are safe.

What did Standard Chartered say?

One report says Geoffrey Kendrick, Standard Chartered's head of digital-assets research, expects prices may struggle to find a bottom until Binance restores access and gives more detail. This is unconfirmed. We found no primary statement from the bank, so we are relaying a secondary account of his view. It is an opinion about the market, not a forecast with a number.

What about Polymarket?

Polymarket is a prediction market, a platform where people trade on the outcome of events. It disclosed a separate incident involving a compromised third-party provider. It said it had fixed the issue and would reimburse affected users. The sources give no link between this and the Binance case. They only say it added to the worry in the market.

What does this mean for my money?

If you do not own crypto, the direct effect is small. If you do, there are a few plain lessons from what has been reported:

• Coins on an exchange are held by the exchange. You are trusting the company to keep them safe and let you take them out.
• A promise to cover losses is not the same as having your coins available. Binance says customer funds are safe and losses will be covered, but withdrawals are paused for now.
• Prices can move fast. Falls of around 3% in a day, with more than $1bn in liquidations, show how quickly sentiment shifts.
• Early facts change. The loss figure and the cause may both be revised once the technical report is out.

This is explanation, not advice. RainingMoney is not telling anyone to buy, sell or hold anything.

What do we still not know?

• How much was stolen, how much is frozen and how much will be recovered.
• The exact cause. Binance's account is preliminary, and its technical report is not yet out.
• Who is behind it. The sources we used do not name an attacker.
• Whether withdrawals will resume within 48 hours as Yi He said.
• Whether the SAFU fund and company funds are enough to cover every loss, as Binance says.

What should I watch next?

Watch for four things: the resumption of withdrawals, the technical report, the updated Proof of Reserves, and any statement from the stablecoin issuers about what they froze. Each one will either firm up or change the picture described here.