369 Guard

Update

Permalink for this incident. Same content as the News feed. Use Share to post it.

← All news

Binance: hot wallets drained. Binance says it will cover all losses

criticalEthereum / Arbitrum / AvalanchecustodyUpdated

Update · 2026-10-30

Binance: about 6,300 million dollars. First look points to a DevOps laptop

30 Oct, 02:25 UTC: Binance's first look says a DevOps engineer's laptop may have been compromised. That access reached a service container, and unauthorized withdrawals were submitted from there.

Binance says it has found no evidence of a wallet private key leak. It puts the estimated total impact at about 6,300 million dollars, with about 3 billion dollars frozen on-chain so far.

Losses will be covered from the SAFU fund and company funds. Deposits and withdrawals stay suspended. The affected address authorisation has been revoked.

An updated proof of reserves will follow once remediation is done. A full post-mortem is still to come. Earlier firm posts had described a stolen signing key.

30 Oct 2026, from about 04:24 Manila: attackers drained Binance hot wallets on Ethereum, Arbitrum, and Avalanche.

Binance says it will cover all losses, that user funds are safe, and that all deposits and withdrawals are suspended while it checks, freezes funds, and works with law enforcement. It has not published a loss figure.

Its latest verified freeze total is about 3 billion dollars. Firm estimates of what left the wallets run from 2,500 million dollars to 5,800 million dollars. Defimon and Blockaid say the cause was a stolen signing key.

Tether froze more than 1,567 million USDT. Circle blacklisted about 823 million USDC. Arbitrum's Security Council moved attacker-linked ARB and ETH to a frozen wallet. There is no Binance refund form.

Research snapshot from Binance, Defimon, Blockaid, Tether, and Arbitrum.

369 take

Overnight, attackers drained Binance hot wallets across three chains. Binance's first look puts the impact at about 6,300 million dollars.

It says a DevOps engineer's laptop may have been compromised, and that it has found no evidence of a wallet private key leak.

Earlier firm estimates ran from 2,500 million dollars to 5,800 million dollars, and Defimon and Blockaid had described a stolen signing key.

Binance says it will cover all losses from the SAFU fund and company funds, and reports about 3 billion dollars frozen. zachxbt calls it likely Lazarus. That is his opinion.

The lesson is old: an exchange balance is a promise, and the key is someone else's. Richard Heart was warning about this well before HEX launched in December 2019.

In January 2018 he posted: Please never have other people handle your coins, or keys. In December 2018 he posted: Not your keys, not your coins. Take delivery of your coins to your own wallet.

On a 31 January 2019 stream, as QuadrigaCX and Cryptopia failed, he called exchanges security holes where people lose all their money. The maxim itself is older. Centralised custody failed twice over.

One laptop path moved billions, and one decision froze every customer's deposits and withdrawals. The rescue was centralised too: Tether, Circle, and Arbitrum's Security Council froze funds.

On PulseChain and HEX, you hold the key. No exchange can halt your withdrawal, and only your key can end your HEX stake.

Critics point to stake concentration: about 47,600 validators at 32 million PLS each, and one study puts the Nakamoto coefficient at 7.

They also note the official bridge relies on 5 of 8 signers and single-key admin roles. We found no record of PulseChain being halted or freezing funds since its 2023 launch.

BNB Chain was paused in 2022, Sui validators froze Cetus funds in 2025, and Solana halted for five hours in 2024. That difference matters.

Self-custody moves the risk to you: phishing, seed theft, tampered hardware wallets, and fake Binance refund messages. Do not leave funds on an exchange you do not actively trade on.

Buy hardware wallets only from the maker or authorised sellers, and never use a pre-filled seed. Revoke old token approvals. Ignore refund or support DMs, and use only official Binance channels.

Sources