Binance users withdraw billions in cryptocurrencies after hacker attack

Binance announced last Saturday (31st) that it managed to recover 90% of the amount stolen on Thursday (29th), the day the exchange was victimized by the largest hacker attack in the sector.

According to the company itself, ten types of cryptocurrencies, including Bitcoin (BTC) and Ether (ETH), had their values fully covered. The remaining 10% corresponds to cryptocurrencies with lower trading volume in the market.

The exchange stated that it will continue recovering assets until the total loss, which exceeds $6 billion, is fully replenished.

The incident occurred around 5 PM Brasília time and lasted approximately twenty minutes, according to analyses of transaction records made by specialists.

Both TRM Labs and Chainalysis indicated that the individuals responsible for the theft were hackers associated with North Korea. Both companies are American and specialize in tracking cryptocurrency movements.

As of the publication of this text, Binance had not yet confirmed whether it had identified the cybercriminals. The exchange is cooperating with international police agencies to investigate the incident, including the FBI and the U.S. Secret Service, as reported by Reuters.

During the attack, Binance temporarily suspended withdrawals and assured its clients that their funds remained protected. Initially, Binance suspected an intrusion into one of its engineers' computers, but later the company identified security vulnerabilities that could have been exploited by cybercriminals.

According to TRM Labs, the hackers managed to compromise the system responsible for authorizing cryptocurrency transfers. Part of the diverted value was in stablecoins, which are designed to maintain a stable value, functioning as a reflection of global traditional currencies, such as the US dollar.

Founded in 2017 in Shanghai, China, Binance currently has 335 million registered users globally, according to its most recent annual report published in 2025. This same report indicates that the company managed about $162.8 billion (equivalent to R$ 879 billion) in digital assets.

Micaella Ribeiro, co-founder of IAM Brasil and expert in Information Security and Identity and Access Management, commented that the episode demonstrates a significant shift in the landscape of digital threats. She emphasized that an attack on a cryptocurrency exchange does not necessarily imply that blockchain technology has been breached.

However, Ribeiro stressed that handling cryptocurrencies carries distinct risks. She differentiated between the security of blockchain technology and the security of the platforms used to buy, sell, and store these assets. For the expert, this attack underscores an alarming trend: criminals are focusing on compromising identities, devices, and systems that already have legitimate permission to perform crucial operations.

Hackers stole $6.3 billion (equivalent to approximately 33.71 billion Brazilian reais) from Binance, the world's largest cryptocurrency exchange. Analysts consider this incident the largest in the sector's history.

This incident caused a market drop, prompted industry companies to freeze some funds, and raised questions about the security of digital asset trading platforms.

According to the American blockchain analytics company TRM Labs, the attackers gained access to Binance wallets across 10 different networks and transferred the majority of the funds in about 20 minutes. The company linked this attack to North Korean groups, noting technical similarities with previous thefts attributed to Pyongyang, including the 2025 hack of the Bybit exchange, which was investigated by the FBI.

Chainalysis reported that it could not yet confirm the cause of the intrusion. By 9:30 AM Brazilian time, the company had identified at least $5.912 billion (approximately 31.63 billion Brazilian reais) in stolen assets.

Mark Karpeles, former head of the Mt. Gox exchange, told Reuters that Binance's assets appear to be distributed across different systems. He speculated that the hacker might have obtained valid authorization to move funds in certain platform systems and possibly even access to a private key.

Binance cooperated with partners to block the affected resources and managed to localize about $3 billion (16.05 billion Brazilian reais). Co-founder Yi He confirmed that the company would cover all losses resulting from the attack.

Other companies also participated in efforts to prevent the movement of funds. Binance's initial investigation showed that the breach might have started with the compromise of one engineer's computer. This access allowed the attacker to penetrate one of the exchange's systems and execute unauthorized withdrawals.

The company stated that user deposits were unaffected and expected to resume withdrawals within 48 hours after the attack. Binance also holds a customer protection fund composed entirely of Bitcoin.

For Kenneth Goh, Director of Private Capital Management at UOB Kay Hian, the attack on one of the world's largest exchanges should prompt investors to pay more attention to asset custody and platform responsibility in case of security failures.

The market reacted to the incident with decreased trading. Bitcoin fell by more than 3%, reaching a six-week low of $76,368. Ethereum also lost over 3%, dropping to $2,178. Coinbase shares fell by 4.8%, and Strategy shares dropped nearly 6% in extended trading in the United States.

Amanda He, Investment Director at ChainUp Investment, told Reuters that the initial drop might have been caused by the cryptocurrency being sold by the attacker himself. In her opinion, this step contributed to spreading investor concerns during the Asian session. She mentioned that her company sold positions held on Binance and converted the proceeds into stablecoins.

For Tim Sun, Senior Researcher at HashKey Group, the pause in deposits and withdrawals on Binance could negatively affect capital flow between platforms and impact market makers responsible for providing buy and sell prices to facilitate trades.

Liquidity concerns are also featured in assessments by Damon Xu, founder of 1Token. Commenting to Reuters, he predicted a reduction in strategies involving simultaneous operations across different exchanges and the use of leverage, which allows trading with borrowed funds. Xu believes that decentralized platforms may benefit from potential capital and commercial activity shifts.

Jeff Ko, Lead Analyst at ViaBTC, assessed to Reuters that Bitcoin might face less selling pressure because its transactions are tracked on the blockchain, making it difficult to move stolen funds without leaving traces. Ethereum, conversely, might experience greater pressure due to the availability of tools that facilitate obscuring transaction origins.

The cryptocurrency exchange Binance has estimated the total damage from a major security incident to be approximately $6.3 billion. As part of coordination with blockchain partners, about $3 billion in digital assets has been frozen.

In an update published on October 30, 2026, the world's largest cryptocurrency exchange by trading volume reported that preliminary investigation suggests the incident may have originated from a compromised DevOps engineer's laptop. It is presumed that the attacker used this access to enter a service container and send unauthorized withdrawal transactions.

Binance stated that it found no evidence of private key wallet compromise. The company added that a detailed technical report following the incident will be published after the investigation and verification of results are complete.

As a precaution, the exchange temporarily suspended all deposit and withdrawal operations while security checks are underway. Furthermore, authorization for the affected address was revoked, and the company engaged law enforcement agencies and blockchain analysis firms to track and recover funds.

Binance assured clients of the safety of their assets, stating that it covers all losses resulting from the incident using its Secure Asset Fund for Users (SAFU) and its own corporate funds. An updated Reserve Confirmation is also planned for publication after the issues are resolved.

This incident triggered a wider industry reaction: blockchain partners and digital asset issuers froze funds related to the hack. Binance reported that approximately $3 billion has been frozen so far, and recovery efforts are ongoing.

The exchange is working with law enforcement to identify those responsible. The full scope of the hack and the final amount of losses remain subject to further investigation.