Binance has raised its estimate of the impact from Thursday’s security incident to about $6.3 billion and said roughly $3 billion of the affected assets has been frozen onchain. The exchange is investigating what it now describes as a complex attack involving more than the compromised laptop initially identified as a possible entry point.
The company said it will cover all losses using its SAFU emergency fund and corporate funds, while maintaining that user assets are safe. Deposits have reopened, but withdrawals remain suspended as Binance reviews and rebuilds parts of its withdrawal system.
Investigation expands beyond compromised laptop
Binance initially said a DevOps engineer’s compromised laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange also said it had found no evidence that wallet private keys were leaked.
A subsequent investigation uncovered “additional points of breach,” according to Binance. Chief Executive Richard Teng said the attacker did not rely solely on one engineer’s permissions and that the incident was not a single “one-click” event. He described a more complicated process and said the investigation had not assigned responsibility to any individual.
The exchange has not yet published a complete technical explanation. Binance said it is still collecting and verifying the facts, and plans to release a detailed post-mortem after the investigation concludes. It also said it will publish an updated proof of reserves once remediation work is complete.
Binance said withdrawals were paused after the incident, stopping further outflows while the exchange worked on containment. It said the service was on track to resume withdrawals in 45 hours, although the withdrawal suspension remained in place as the security review continued. The company also revoked authorization for the affected address and is working with law enforcement and blockchain intelligence firms to trace and recover assets.
Billions frozen as funds continue moving
Binance said blockchain partners helped freeze about $3 billion of the affected assets. The company has not indicated that all of the remaining assets can be recovered.
Blockchain analytics firm Arkham estimated the haul at $6.01 billion, saying the assets were taken from Binance hot wallets across nine blockchains between 4:10 p.m. and 7:05 p.m. Eastern Time on Thursday. Arkham said issuers had frozen $2.80 billion, while approximately $2.9 billion in Ethereum, Bitcoin, Tron, Solana and other tokens remained potentially movable.
The wallets linked by Arkham to the attacker continued to transfer funds on Friday. One wallet sent $38.82 million in Ethereum to a new address and still held $1.12 billion in ETH, according to Arkham. Later, an identified Tron address transferred about $2.1 million in TRX to nine new addresses through 14 transactions.
According to Decrypt, stablecoin issuers reacted quickly as assets moved from Binance. Tether and Circle froze approximately 975.1 million USDT and 823 million USDC in the main receiving wallet, with a combined value of about $1.8 billion. Binance co-founder Changpeng “CZ” Zhao thanked the two companies for acting quickly.
Arkham’s entity page for the attacker showed holdings of about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL, as well as stablecoin balances that had been frozen. These figures reflect blockchain-tracked holdings and may change as funds are transferred or immobilized.
Binance promises to cover losses
Binance said users would not bear the financial impact of the incident. It plans to use its Secure Asset Fund for Users, known as SAFU, together with company funds to cover all losses. SAFU is an emergency reserve established by the exchange for user protection.
The exchange initially suspended both deposits and withdrawals. By Friday morning, deposits were operating normally, while withdrawals remained unavailable during what Binance called a security revamp of the withdrawal service and associated addresses.
The incident highlights the difference between assets being stolen from exchange-controlled hot wallets and the exposure of customer wallet private keys. Binance has said it found no evidence of a private-key leak, but the investigation is still open and the company has not released its final technical account.
Moneyiar market picture
Moneyiar market data at 2026-10-25 22:39 +03:30 showed BNB at $740.8618136891, up 0.81% over 24 hours and 3.32% over seven days. Horizen (ZEN) was $5.7259060904, up 0.09% in 24 hours but down 1.51% over seven days.
The same Moneyiar data showed Billions Network (BILL) at $0.0139971939, down 0.59% over 24 hours and up 10.04% over seven days. ONEchain (ONE) was $0.1019913497, down 0.44% over 24 hours and up 1.74% over seven days. These market figures are separate from Binance’s estimate of the security incident and are provided for context only.
