ORBITRUM← Back to Signals

Binance · security

Binance's $6.36B Hack: Will Customers Bear the Loss?

By Orbitrum

Binance says customers will not bear the losses: it has pledged to cover them using its SAFU fund and company funds after TRM Labs traced approximately $6.36 billion in unauthorized transfers, although asset recovery and final reimbursement remain unresolved.

Illustration of the Binance cryptocurrency exchange logo surrounded by blockchain network connections and a security shield, representing the reported major security breach.

What happened to Binance on October 29, 2026?

TRM Labs traced approximately $6.36 billion in cryptocurrency transfers from Binance wallets across ten blockchains to attacker-controlled addresses, identifying the incident as the largest cryptocurrency theft on record. Most of the transfers occurred within approximately 20 minutes.

Orbitrum Investor Impact

Will Binance customers lose money from the hack?

Binance has pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, and says customer funds are safe. This is the exchange's stated commitment, not confirmation that all stolen assets have been recovered or all reimbursements completed.

How much of the stolen cryptocurrency has been frozen, and has it been recovered?

TRM Labs estimated that approximately $2.7 billion had been frozen on-chain by 00:30 UTC on October 30, including assets frozen by Tether, Circle, Ripple and World Liberty Financial, alongside approximately $30 million in ETH and ARB secured by Arbitrum's Security Council. TRM confirmed that 40.5 million RLUSD remained in Ripple-frozen wallets, while the attacker still controlled approximately $2.4 billion in ETH and BTC; frozen assets are not necessarily recovered or returned to customers.

Why does the breach matter to Binance's business?

Binance's commitment makes its SAFU fund and company funds the financial backstop for unrecovered losses, while the withdrawal suspension temporarily restricts a core exchange service. In its latest update, Binance said deposits were operating normally and withdrawals were expected to resume within 48 hours, subject to completion of security work.

What caused the Binance breach, and what happens next?

Binance's preliminary investigation suggests a compromised DevOps engineer's laptop may have enabled an attacker to access a service container and submit unauthorized withdrawals, although the full attack path remains under investigation. Binance reported no evidence of leaked wallet private keys and plans to publish a technical post-mortem and updated Proof of Reserves after remediation.

Sources

Original signal: Reuters ↗

Continue researching

Projects mentioned in this Signal

Continue your research in Orbitrum. Access to full expert research depends on each expert's offer.

See more Orbitrum in Google

Add Orbitrum as a Preferred Source to make our research more likely to appear for you in Google Search.