Binance Estimates $6.3B Impact as Withdrawal Restart Is Expected to Begin Within 48 Hours

Binance estimates a $6.3 billion impact and says about $3 billion is frozen on-chain. Withdrawals were not restored at the cutoff; the company expected to begin resuming them within 48 hours.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Steel security vault in a dark blue server room with a cyan-lit recovery conduit
Original editorial illustration of a secured digital-asset system under incident response.

Binance Estimates $6.3B Impact as Withdrawal Restart Is Expected to Begin Within 48 Hours12

Binance says a security incident had an estimated total impact of about $6.3 billion, with roughly $3 billion frozen on-chain.1 Its investigation remains preliminary, and those figures do not establish the final amount stolen, returned or lost.1

Security incident and service update • Reporting cutoff: October 30, 2026, 1:12 a.m. EDT / October 30, 2026, 05:12 UTC

The bottom line

Binance says its initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop that allowed access to a service container and unauthorized withdrawal transactions.1 In a later service update, Binance co-founder Yi He described deposits as operating normally and said Binance expected to begin resuming withdrawals within 48 hours; that was not a statement that withdrawals had already resumed or that full restoration would finish within 48 hours.2

Verified facts

Impact estimateBinance estimates about $6.3 billion in total impact and says approximately $3 billion has been frozen on-chain.1 “Impact” and “frozen” are different measures; the notice does not give a final theft or net-loss figure.1
Service stateYi He said deposits were unaffected and operating normally, while withdrawal service and address controls were still being worked on.2 That deposit statement conflicts with Binance’s earlier incident notice, which said both deposits and withdrawals had been temporarily suspended.12
Preliminary pathBinance’s initial investigation “suggests” the incident “may involve” a compromised laptop, service-container access and unauthorized withdrawal transactions.1 It is not a final forensic conclusion.1

What happened

Binance’s incident notice says the preliminary path may involve a compromised DevOps engineer’s laptop, access to a service container and unauthorized withdrawal transactions.1 The company also says it found no evidence of a wallet private-key leak, temporarily suspended deposits and withdrawals for security checks, and would cover losses from its SAFU fund and company funds.1

Why it matters

Yi He’s later update distinguishes deposits, described as normal, from withdrawals, which were still under remediation at the reporting cutoff.2 Analysis: The 48-hour wording describes when Binance expected to begin resuming withdrawals, not a deadline for complete restoration.2 The conflict over deposits means readers should not treat either statement as independent, network-by-network availability proof.12

What this means for readers

Withdrawals were not described as restored at the reporting cutoff.2 Binance expected to begin resuming them within 48 hours, but gave no completion time in the two company updates reviewed.2

  • Practical guidance: Treat a withdrawal as unavailable unless the specific asset and network show an enabled state in an official Binance interface; the company’s update describes an expected start, not universal restoration.2
  • Practical guidance: Navigate independently to official Binance channels for incident updates rather than following unsolicited recovery messages or links.1

What remains unknown

Final loss and recovery: The two company updates reviewed do not state the final amount stolen, the amount returned rather than frozen, the net loss, or any customer-specific loss.12

The laptop and service-container path remains an initial-investigation suggestion, and the updates do not provide a final root cause, a network-by-network reopening schedule or a time for complete withdrawal restoration.12

Sources

  1. Security Incident Update — Binance, October 30, 2026.
  2. Service Update — Yi He on X, October 30, 2026.

Update and correction note: This report is bounded to the stated cutoff. Any correction should identify the changed fact and the date of the correction; later service or forensic updates require fresh verification.

Browse Articles

Latest Articles