Skip to content

Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed

Global Financial Service Disruptions

Binance

crypto exchange · XX · Global · Binance group (operating entity of affected hot wallets not stated)

Confirmed cyberStatus: recoveringTier 1Severity 5 of 5Evidence confidence: highAnalyst-verified

Binance paused all crypto withdrawals on 29 Oct 2026 after attackers drained hot wallets of about USD 6.3B, the largest crypto theft on record. Withdrawals resumed in phases from 1 Nov starting with Bitcoin, with USD 3.6B net outflow in the first 9.5 hours. The FBI attributed the theft to North Korea's TraderTraitor.

First disruption
2026-10-29T20:05Z (approx; see conflicts)
First public signal
Oct 29 (user reports of drained hot wallets; Binance confirmed incident to TechCrunch)
Acknowledged
Oct 29
Restored
Nov 1
Duration
not established
DFX first recorded
Nov 5 14:58 UTC

What was restricted

withdrawalsScope: institution wide

All crypto withdrawals frozen from 29 Oct until a phased reopening on Sunday 1 Nov starting with Bitcoin; deposits and trading continued. On reopening Binance reported about USD 4.6B withdrawals vs USD 1.0B deposits (06:00 to 15:30 UTC), net outflow USD 3.6B (2.1 percent of assets).

Financial impact: About USD 6.3B stolen (Binance; TRM 6.36B, Chainalysis about 6.4B); Binance says it set aside USD 6.34B of company funds and users will not bear losses. Roughly USD 2.5B to 3B frozen by issuers (not recovered).

Cause, kept in separate layers

What the institution said
Security incident; hot wallets drained. Binance later said a compromised engineer device enabled access to a service container and unauthorized withdrawal transactions; no evidence of private key leakage.
DFX classification
Confirmed cyber (cyber: confirmed)
Analytical hypothesis (not established)
FBI and analytics firms attribute the theft to TraderTraitor (DPRK); signing infrastructure compromise rather than key theft (TRM). Attribution is third party, not Binance.
Wording used
precaution, These losses will not be passed on to users
Conflicting reports
Theft start 20:05Z is from an earlier DFX register citing TRM (not re-read here); one secondary source puts the drain start at about 20:24 UTC. TechCrunch (1 Nov) says Binance froze all deposits and withdrawals, while other reports say deposits ran normally and only withdrawals paused; restriction_type lists withdrawals only. Stolen total 6.0B to 6.4B across sources; early reports 3.3B to 5.57B. Replenishment 90 percent (Binance via Al Jazeera, Malay Mail) vs 95 percent (TechCrunch 1 Nov). Withdrawal resumption exact time not stated by TechCrunch; 06:00 UTC inferred from Binance's outflow window.

Dependencies

A dependency is a documented relationship. It is not evidence that the provider was compromised.

  • Provider: Tether (stablecoin issuer froze attacker USDT), probable
  • Provider: Circle (stablecoin issuer froze attacker USDC), probable
  • Downstream: Aave: Froze new deposits and borrows across hundreds of reserves on multiple networks (withdraw and repay still allowed), unfrozen 30 to 31 Oct (documented)
  • Downstream: Upbit and Bithumb: Issued withdrawal warnings regarding transfers to Binance (Blockmedia 30 Oct per search summary); whether transfers were blocked not verified (plausible)

Evidence

Other restrictions at Binance