Binance said in security incident update #2, released at 3:33 this morning, that it had made progress over the past 24 hours in both its investigation and asset compensation efforts.
The exchange said its hot wallet was attacked at 04:05 on Oct. 30, 2026 (UTC+8), leading to losses of about $6.3 billion in token assets. Binance said the losses will be fully covered by the SAFU fund and the company’s own capital, and will not be passed on to users.
Compensation progress
Binance said it has prepared more than $6.34 billion in company funds. Of that amount, more than $5 billion equivalent in assets including USDC, USDT, BTC, ETH and BNB is already in place, meaning about 80% of the stolen funds have been replenished. The remaining portion is being acquired through market purchases and over-the-counter channels.
The exchange added that about $3 billion in assets had previously been frozen on-chain.
Investigation and next steps
On the cause of the attack, Binance said the initial investigation suggested the incident may have involved a compromised laptop. Later findings showed there were additional points of intrusion. The company said it has not found evidence of wallet private key leakage so far and expects to publish further technical investigation results in about 48 hours.
As for operations, Binance said it is working to restore withdrawals in stages within about 34 hours, depending on the progress of security checks. It also plans to conduct its first proof-of-reserves snapshot within 12 hours and publish the results by Nov. 2.
Binance said it will continue working with law enforcement agencies, blockchain intelligence firms and asset issuers to trace and recover the stolen funds, and will release a full technical post-incident report.
