Drop In: Binance Says "Your Money Is Safe" While Withdrawals Stay Paused

Data as of about 12:15 PM ET, Fri Oct 30, 2026. This is a developing story; figures are attributed to their sources.

Here's the short answer. Binance estimates the total impact of Thursday's security incident at about $6.3 billion, says about $3 billion has been frozen on-chain so far, and says it "will cover all losses from the SAFU fund and the company's funds. User funds are safe."¹ Early Friday, co-CEO Richard Teng put it plainer: "Bottom line - your money is safe, and we're covering every loss."²

Since then, Binance has said more. At 4:47 AM ET it said its investigation "has uncovered additional points of breach" beyond the compromised laptop it first pointed to.²³ At 6:55 AM ET it said it "has begun recovering affected assets for users" and has reserved more than $6.34 billion of company funds to cover the incident.²⁴ Around 10:32 AM ET, co-CEO Richard Teng posted a video update (amplified by the official @binance account) restating the cover and recovery, naming EIP-7702 on the hot-wallet path, and saying Binance is "very hopeful that users will be able to withdraw prior to the Sunday deadline, which is on track to be within 40 hours."²⁵

Deposits are working normally. Withdrawals are still paused. Teng's video is the latest timing word; Binance has not given a schedule by network, and as of this writing withdrawals have not reopened.²⁵²³¹⁴

That's the confirmed part. The rest is still moving, so I'm keeping every number attributed.

What Binance found so far

Binance's official announcement says its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It adds: "We have found no evidence of any wallet private key leak."¹ The same announcement says Binance revoked the affected address authorization, engaged law enforcement and blockchain-intelligence partners, and will publish a detailed technical post-mortem and an updated proof of reserves once remediation is complete.¹

Teng's statement, reproduced in full by the BBC, adds one new detail: "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual."²

That first read has already moved. At 4:47 AM ET Friday, Binance posted: "Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack... We are still gathering the facts, and will share more directly as we have them." It also said "the outflows ceased when we paused withdrawal service earlier."²³

In his ~10:32 AM ET video, Teng repeated that this "was not carried out by one person," that additional points of breach had been found, and that the attacker "used self-destruct mechanisms that destroyed tooling and traces as they ran." He also said the attacker used EIP-7702 "to obtain on-chain execution approval over a hot wallet" and that "the delegation did not pass through our normal approval controls." He framed what was hit as "Binance's own hot wallet," saying Binance "never use[s] any customer funds" and that the vast majority of user assets sit in cold wallets until a withdrawal.²⁵ That's still not a full post-mortem — and Teng said the tech and security teams are "still deep in investigation."

How the on-chain part fits

CoinDesk had already reported that Binance's "Binance 14" wallet was given an EIP-7702 delegation, a permission that lets an ordinary wallet run smart-contract code, which turned it into a sweeper that forwarded funds out.⁸ Teng's video now has Binance itself naming EIP-7702 on that hot-wallet path and saying the delegation bypassed normal approval controls.²⁵ The earlier written announcement still describes unauthorized withdrawals submitted through a compromised internal service, with "no evidence of any wallet private key leak."¹ The remaining gap — a full technical reconstruction — is what Binance says the post-mortem is for.

Deposits normal, withdrawals still paused

Binance's original announcement listed deposits and withdrawals as suspended.¹ Later posts changed the deposit side. At 12:36 AM ET Friday, the official account said: "Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours."³ Co-founder Yi He posted to the same effect at 12:17 AM ET,⁴ and Teng's statement repeats it: deposits normal, withdrawals temporarily suspended.²

Binance's 4:47 AM ET post said it was "still on track towards the expected timeline to resume the withdrawal service in 45 hours."²³ Teng's ~10:32 AM ET video updated that: Binance is rebuilding and retesting the withdrawal service and "not switching it back until it passes rigorous testing," while being "very hopeful that users will be able to withdraw prior to the Sunday deadline, which is on track to be within 40 hours."²⁵ Two things to keep straight. First, as of this writing withdrawals have not reopened. Second, that window is when Binance hopes withdrawals start resuming, and no network-by-network schedule has been given.¹⁴ "Hopeful" and "on track" aren't a guarantee, so watch the official account for the actual reopening. Binance.US says its platform is not affected.²¹⁰

Who's paying, and what's frozen

Binance says losses will be covered from SAFU, its user-protection fund, and from company funds.¹ At 6:55 AM ET Friday it added detail: it "has already reserved over $6.34B of company funds to cover this incident," $5 billion of that is "already held in the exact token assets that were impacted," and it is buying the rest through market and OTC channels, which "can take longer because some tokens may have low liquidity." It says those figures don't include frozen assets, and that "all user funds will be verified publicly through our Proof of Reserves."²⁴ Teng's video restated the same reserve and recovery language and said Binance is targeting a full proof-of-reserves report for public verification on Monday, with hope for an initial view before then.²⁵ CoinDesk reports SAFU holds about $1 billion in bitcoin, and has pointed to a Nov. 1 reserve snapshot as another checkpoint.⁸ Founder Changpeng Zhao posted: "User funds are SAFU! ... It hurts, but we will survive."¹¹

Binance's own frozen total is about $3 billion.¹ Most of that is stablecoins: CoinDesk reports about $2.3 billion of it is USDT and USDC combined,¹² and the BBC says Tether and Circle report freezing about $2.4 billion between them.² The pieces:

• Tether froze more than 1.567 billion USDT, per CEO Paolo Ardoino.⁹
• Circle froze more than 800 million USDC "in coordination with law enforcement," per CEO Jeremy Allaire; CZ later put it at about $823 million, per CoinDesk.⁹⁸
• World Liberty Financial froze $27 million of its USD1 stablecoin, per CoinDesk.⁸
• The Arbitrum Security Council froze about $30.5 million, per Cointelegraph and Yi He.¹⁰¹³
• Ripple helped halt about $200 million, according to Yi He via CNBC. That's still one report.⁹

Here's the part folks skip: a freeze isn't a recovery. TRM Labs' Ari Redbord told CNBC, "A freeze stops the money from moving, and recovery follows through legal process." Chainalysis' Eric Jardine told CNBC that returning funds "can take months or years."⁷

Fundstrat's Sean Farrell told CNBC the incident "does not currently appear to create meaningful solvency risk."⁷ That's one analyst's view, not an audit.

Who's behind it, according to analytics firms

Two blockchain-analytics firms now link the attack to TraderTraitor, a North Korean state-sponsored group. TRM Labs attributes it "with high confidence," per CNBC, and the BBC reports Chainalysis also says it has "high confidence" in the link.⁷² TRM says about $6.36 billion moved across 10 blockchains, most of it within roughly 20 minutes, with preparation starting at least 36 hours earlier.⁷ The FBI previously tied TraderTraitor to the $1.5 billion Bybit hack in February 2025; that FBI notice is about Bybit, not Binance.²⁰

To be clear about who's saying what: that attribution comes from third-party firms. Binance hasn't named an attacker, didn't directly respond to the BBC on North Korea links, and Teng says its investigation "has not attributed responsibility to any individual."² No one has claimed responsibility, and as of our ~7 AM ET check we hadn't seen a government or law-enforcement statement on it.

Other counts

Before Binance gave its own number, analysts had their own: about $5.91 billion per Chainalysis (via CNBC)⁷ and more than $5.7 billion in the attacker-labeled wallet per Arkham (via CoinDesk).¹² They measure different things at different times, so I'm not adding them up. The $6.3 billion figure is Binance's.

Same week, two vendor incidents

Polymarket. Polymarket's status page shows its international platform went cancel-only at 2:05 PM ET Thursday after "one of our third party providers was compromised." Trading resumed around 3:05 PM ET, about an hour later. Polymarket says anyone impacted will be made whole and that it referred the matter to law enforcement.¹⁵¹⁶ CNBC reported the U.S. platform was not compromised, and that analytics firms counted at least $2.7 million withdrawn across 710 wallets.¹⁷ BleepingComputer reported the malicious JavaScript, served via website-monitoring vendor DebugBear, hijacked logged-in sessions; it traced about $2.5 million.¹⁸ Those loss numbers come from researchers, not Polymarket.

Coinbase. Coinbase says it was not breached. It says its analytics vendor, Amplitude, had an incident that exposed contact details and limited transaction data for a "small subset" of customers, that customer funds were not affected, and that it is notifying customers and regulators. A Coinbase spokesperson called a circulating 70,000-user figure "false."¹⁹²¹

Short market note

As of CoinGecko data fetched at about 12:15 PM ET Friday, Bitcoin was at $77,407, down 5.2% over 24 hours. Ether was at $2,228, down 5.9%, and BNB was at $700, down 6.8%.²²

What this means for you

This is general education:

• Pauses can be partial. Here deposits run while withdrawals stay shut. Check official channels for which side is open before you move anything.
• "Resuming" isn't "reopened." A restart window can roll out unevenly. Wait for the official word on your network.
• Only trust official channels. Scammers show up fast with fake "support" accounts and links. No real agent needs your password, 2FA code or seed phrase.
• A preliminary finding isn't a post-mortem. Useful, but wait for the verified write-up.
• A freeze isn't a refund. Frozen funds still have to come back through process.
• Vendors are part of the attack surface. Two of this week's three incidents ran through third parties, by the companies' own accounts.
• Chaos means slow down. Like a creek after a hard rain, sometimes the smart move is to let it settle before you try to cross.

What we're watching

• Whether, and on which networks, withdrawals actually start resuming before Sunday / inside the ~40-hour window Teng described.
• Binance's technical post-mortem, including the "additional points of breach," the self-destruct tooling, and the EIP-7702 path Teng described.
• The Monday proof-of-reserves report Teng targeted (and the Nov. 1 snapshot CoinDesk flagged).
• Any government or law-enforcement statement on attribution.

Binance has told us roughly what happened and who's paying. Now it has to show its work.

Disclaimer: This post is educational and not financial advice. Nothing here is a recommendation to buy, sell or hold any asset. Crypto is volatile and you can lose money. Do your own research.