Oct. 30 at 08:37 am UTC
Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said, after initially pointing to a potentially compromised laptop.
The exchange said it was still gathering facts in coordination with law enforcement.
Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected. Outflows from the exchange stopped when it paused withdrawals, it said.
Oct. 30 at 07:37 am UTC
The attacker behind Binance’s $6.3 billion hack did not simply use one engineer’s permissions to carry out the breach, co-CEO Richard Teng said Friday.
In an X post, Teng said the incident involved “a more complex attack process” and was not a single “one-click” action.
“Our investigation has not attributed responsibility to any individual,” he wrote.
Teng reiterated that preliminary findings pointed to a compromised DevOps engineer’s laptop, which may have allowed the attacker to access an internal service and submit unauthorized withdrawals. He said investigators had found no evidence of a wallet private-key leak.
Binance would cover all losses using its SAFU fund and company funds, he said.
Oct. 30 at 05:01 am UTC
Chainalysis co-founder and CEO Jonathan Levin said the Binance hack was likely carried out by North Korean hacking group TraderTraitor, citing links to a previous hack.
In a post on X, Levin put the theft at $6.4 billion, slightly above Binance’s estimated $6.3 billion impact. He said industry partners had frozen approximately $3 billion and Chainalysis was continuing to track the funds.
In a separate post, onchain investigator ZachXBT said the stolen funds from the Binance attack and the earlier Bitget exploit were commingled in the same address on Friday, after arriving via THORChain.
“This indicates the same actor is likely behind both incidents,” he said.
“The Bitget exploit was attributed to DPRK-linked TraiderTraitor, which had overlap with other previous exploits such as Kelp DAO,” he added.
Speaking to Cointelegraph, Blockaid co-founder and CEO Ido Ben-Natan also said the attack resembled the work of North Korea, or DPRK, based on the sophisticated onchain preparations, customer sweeper contract and multiple authorizations.
TRM Labs has also attributed the attack to TraderTraitor with “high confidence,” which it said is “based on robust on and off-chain intelligence.”
TraderTraitor has also been named by the FBI as the same group responsible for the ByBit hack in February last year.
Oct. 30 at 4:17 am UTC
Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours. Deposits are operating normally.
The exchange said the incident involved multiple factors and that its security team was tracing the full attack path through a compromised computer, which they suspect to be the entry point.
Oct. 30 at 03:49 am UTC
The Binance hack could push more crypto trading toward decentralized exchanges and benefit Uniswap over the longer term, according to Standard Chartered’s global head of digital assets research, Geoffrey Kendrick.
In an email shared with Cointelegraph, Kendrick retained his $100 price target for Uniswap’s UNI token by 2030, saying the breach was “another reason why that forecast may end up being too low.”
CoinGecko research shows that the top 10 spot DEX-to-CEX ratio was 23.5% in the second quarter of 2026, climbing 2.1 percentage points from the first quarter of 2026.
“I would encourage investors to re-engage with Uniswap,” said Kendrick. “The decentralized exchange (DEX) has never had any exploits, and the hack of the largest centralized exchange (CEX), in Binance, should see the ratio of DEX to CEX trading continue to increase.”
Oct. 30 at 02:25 am UTC
Binance said its initial investigation into the multi-billion crypto breach has pointed to a compromised DevOps engineer’s laptop.
The exchange said the laptop compromise may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak, though its investigation remains ongoing.
The crypto exchange has also disclosed that the estimated total impact of the hack is $6.3 billion.
Oct. 30 at 02:21 am UTC
First Digital CEO Vincent Chok said it has frozen the FDUSD stolen in the attack on Binance.
“We’re working alongside the Binance team and will share updates as we have them,” Chok told Cointelegraph in a written statement.
“Our priority is protecting FDUSD holders and stopping bad actors from moving stolen funds. Protecting users is a responsibility we all share.”
Oct. 30 at 01:19 am UTC
Bitcoin traded near $76,937, down 4.9% over 24 hours, according to CoinGecko. BNB fell 8% to about $693, while Ether declined 5.7% to about $2,211.
DeFi tokens also fell, with AAVE down 11.3% and Uniswap’s UNI down 10.7% over the same period.
The Bitcoin Fear and Greed Index, which tracks Bitcoin market sentiment, fell to “fear” with a score of 30, which it has not seen since August.
Oct. 30 at 12:52 am UTC
Binance said the current verified amount of assets frozen from the hack is now $3 billion.
The update came after the Arbitrum Security Council said it executed a transaction to freeze $30.5 million from the Binance exploit, involving 74.6 million Arbitrum (ARB) and 8,425 Ether (ETH).
“The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications,” it said.
“As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet,” it said.
The funds will no longer be accessible to the address that originally held the funds and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, it added.
Oct. 30 at 12:26 am UTC
Chainalysis said its current estimate of the amount stolen from Binance is $5.912 billion at the time of theft, four times the amount stolen from crypto exchange Bybit in 2025.
Binance earlier said the verified total frozen is $2.54 billion.
Oct. 30 at 12:26 am UTC
The suspected multi-billion-dollar Binance hack may have involved attackers manipulating the exchange’s transaction-signing signature, according to Blockaid co-founder and CEO Ido Ben-Natan.
Speaking to Cointelegraph, Ben-Natan said Blockaid’s preliminary assessment pointed to “key misuse,” in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key.
“It seems to be… a compromise of signing infrastructure. We don’t think a key was leaked,” he said.
Ben-Natan said this was a preliminary assessment, drawing on their experience with similar attacks and their observations of the onchain activity.
Arkham CEO Miguel Morel said the attack appears to be ongoing.
Oct. 30 at 12:07 am UTC
Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals.
“We are working around the clock and will share a full post-mortem once the investigation is complete,” the company said, adding it will “cover all losses.”
Earlier, Binance also said it had temporarily suspended Binance Alpha trading.
Oct. 30 at 12:07 am UTC
Crypto trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption to their businesses.
… 为阅读体验已截取。完整原文请访问来源网站。
原文抓取与轻量化重排，仅供阅读辅助。 · 源语言：pt