Binance Finds Additional Breach Points in $6.3B Hack

Published October 30, 2026, 03:15 PM PKT. This is a follow-up to MABOnChain's October 30 articles on Binance's investigation into a suspected multi-billion wallet drain, its pause of withdrawals, its pledge to cover all losses and suspend all deposits and withdrawals, its first findings pointing to a compromised DevOps engineer's laptop, TRM Labs' attribution of the hack to North Korea, and its expectation to begin resuming withdrawals within 48 hours. It is based on Binance's investigation update posted on X on October 30, 2026 (primary source for the additional breach points and the 45-hour withdrawal track, as reported by Decrypt, CoinTelegraph and CryptoTimes), and on BleepingComputer and Disruption Banking reporting (secondary sources). Where sources disagree, this article says so rather than picking a winner.

Binance has widened its own account of how the largest crypto hack on record happened. In an investigation update posted on X on October 30, the exchange said its initial investigation had suggested the incident may have involved a compromised laptop, but that its subsequent investigation has uncovered additional points of breach. Binance described the incident as a complex attack, said it is still gathering facts in coordination with law enforcement, and said it will share further information as the investigation progresses. The update was carried by CoinTelegraph's live blog at 08:37 UTC and timed by CryptoTimes to about 08:47 UTC, roughly four and a half hours after co-chief executive Yi He's 04:17 UTC service update that first put a 48-hour clock on resuming withdrawals. The new finding matters because it revises the story Binance itself told hours earlier. The laptop was presented as the possible entry point, a single compromised device opening a path into a service container that could submit unauthorized withdrawal transactions. Additional points of breach means the attack path, on Binance's own current account, runs through more than that one device. Binance has not said what those points are, how many it found, or whether they involve internal systems, accounts or third-party infrastructure, and CryptoTimes stresses exactly that gap: the nature of the additional points is undisclosed, so no reader should fill it in with a guess about which system failed next.

From one laptop to multiple breach points

Co-chief executive Richard Teng gave the clearest version of the revised account. In a post on X on October 30, Teng wrote that the attacker did not simply use one engineer's permissions, and that this was not a single one-click action, describing a more complex attack process. He added that the investigation has not attributed responsibility to any individual. That last line is doing real work, and it cuts in two directions. It pushes back against any reading that blames a single engineer, which matters because the first account centered on one DevOps engineer's laptop. It also leaves the attacker question open from Binance's side: Binance has not attributed the attack to any individual or group, even as outside investigators have. What has not changed in the revised account is the negative finding Binance keeps repeating. Binance said it has found no evidence of any wallet private key leak, and Teng repeated that point, saying investigators had found no evidence of a wallet private key leak. BleepingComputer adds a related technical nuance from Blockaid, whose preliminary assessment pointed to key misuse, in which attackers trick or compromise a signing system into authorizing malicious transactions without extracting the underlying private key. That is Blockaid's assessment, not Binance's, and it is preliminary, but it fits the shape of the revised story: a signing path abused at several points, rather than a single key stolen and reused. Binance also repeated its commitment to publish a detailed technical post-mortem once the investigation is complete and every fact is verified, and to publish an updated proof of reserves once remediation is complete, according to Decrypt and Disruption Banking. Until that post-mortem appears, the additional breach points remain a confirmed existence with undisclosed content, and this article reports them that way.

The 45-hour withdrawal clock

On services, the update narrows the reopening picture without confirming a reopening time. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected, and that outflows from the exchange stopped when it paused withdrawals. Decrypt reports the same position as deposits reopened while withdrawals remain suspended. Readers should keep the two clocks Binance has now given separate, because neither is a confirmed schedule. Yi He's 04:17 UTC update said Binance expects to begin resuming withdrawals within 48 hours, which FinanceFeeds calculates runs to about 04:17 UTC on November 1. The new update says about 45 hours from its own posting, which CryptoTimes calculates points to approximately 05:47 UTC on November 1. Those two arithmetic endpoints land in the same Sunday morning window, but both are other outlets' arithmetic, not Binance's confirmed reopening time, and Binance has given no schedule by network or asset and no word on whether the restart will be staged or limited at first. What is confirmed is narrower: withdrawals remain paused, deposits are operating normally on Binance's account, outflows stopped when withdrawals were paused, and Binance still says it will cover all losses from its SAFU fund and company funds. The frozen total is also unchanged in this update at about $3 billion verified frozen on-chain, against an estimated total impact of around $6.3 billion, so roughly half the impacted assets remain unfrozen and outside issuer control on the latest confirmed figures.

Attribution still belongs to investigators, not Binance

The attribution gap between Binance and outside investigators is now the story's sharpest open question, and the new update does not close it. TRM Labs attributes the attack to North Korea's TraderTraitor unit with high confidence, tracing about $6.36 billion moved from Binance wallets across ten blockchains in about 20 minutes on October 29, as MABOnChain reported earlier on October 30. Chainalysis has corroborated the TraderTraitor link, and onchain investigator ZachXBT said funds from the Binance attack and the earlier Bitget exploit were commingled in the same address after arriving via THORChain, indicating the same actor is likely behind both incidents. Decrypt adds a snapshot of what Arkham's entity page for the attacker showed as of Friday morning: about 18,270 bitcoin, 488,364 ether, 663.6 million TRX and 970,551 SOL, alongside frozen stablecoin balances. Those are Arkham's labels, not Binance's, and the frozen balances are the reason the attacker's liquid position is smaller than the headline total. None of that is Binance's own attribution. Binance's investigation update says it is coordinating with law enforcement and still gathering facts, and Teng's post says the investigation has not attributed responsibility to any individual. Until Binance or a law enforcement agency names an attacker, the honest framing is the one this article has carried all day: TRM Labs, Chainalysis and ZachXBT point to TraderTraitor, Binance has not confirmed or denied that assessment, and the additional breach points may or may not change the attribution picture once Binance publishes its post-mortem.

What to watch next

The next verified facts to look for are Binance's description of what the additional breach points actually are, and whether they implicate other systems, accounts or third parties; its detailed technical post-mortem; its updated proof-of-reserves figures; a confirmation from Binance's main account that withdrawals have begun resuming, and whether the restart is staged by network or asset; any statement from law enforcement confirming or disputing the TraderTraitor attribution; and any change to the verified frozen total from about $3 billion. Until then, the confirmed position is this: Binance's investigation has moved from a single compromised laptop to additional points of breach in a complex attack, with no private key leak evidence found, no attribution by Binance itself, about $6.3 billion impacted with about $3 billion frozen, all losses pledged covered from the SAFU fund and company funds, deposits operating normally, and withdrawals on track to begin resuming in about 45 hours from the October 30 update. Until withdrawals actually begin resuming, customers should treat any message offering to unlock withdrawals for a fee, or asking for account details through an unofficial link, as a scam, and rely only on Binance's official channels.

This article is news reporting and is not investment advice.

Sources

• Binance, investigation update on X, October 30, 2026 (as reported by Decrypt, CoinTelegraph and CryptoTimes), primary source for the additional points of breach, the complex attack description, coordination with law enforcement, the 45-hour withdrawal track, deposits operating normally, outflows stopping when withdrawals paused, and the post-mortem and proof-of-reserves commitments
• Decrypt, Binance Finds Additional Points of Breach in $6.3B Hack (published October 30, 2026), secondary source for the Binance update text, the $6.3 billion impact estimate, about $3 billion frozen on-chain, SAFU and company funds coverage, deposits reopened with withdrawals suspended, and the Arkham attacker holdings snapshot
• CoinTelegraph, Live Updates: Binance Losses Estimated at $6.3B amid Major Crypto Hack (live blog, entry timed 08:37 UTC, October 30, 2026), secondary source for the additional breach points finding, the 45-hour withdrawal track, deposits unaffected, and outflows stopping when withdrawals paused
• CryptoTimes, Binance $6.3B Hack Update: More Breach Points, Withdrawals to Restart in 45 Hours (published October 30, 2026), secondary source for the update timed to about 08:47 UTC, the 45-hour track pointing to approximately 05:47 UTC on November 1 as its own calculation, and the undisclosed nature, number and systems involved in the additional breach points
• BleepingComputer, Binance Links $6.3 Billion Crypto Theft to Compromised DevOps Laptop (published October 30, 2026), secondary source for Teng's not one-click and more complex attack process quotes, the no attribution to any individual line, the TRM TraderTraitor attribution, and the ten-blockchain, about 20-minute, $6.36 billion movement
• Disruption Banking, Binance Says DevOps Laptop May Have Been the Entry Point in $6.3bn Incident (published October 30, 2026), secondary source for the laptop as possible entry point, no private key leak evidence, the post-mortem and updated proof-of-reserves commitments, and Binance not confirming or denying the TraderTraitor assessment
• MABOnChain, Binance Expects to Begin Resuming Withdrawals Within 48 Hours (October 30, 2026), context for Yi He's 48-hour timeline, deposits operating normally, and the absence of a schedule by network or asset
• MABOnChain, TRM Labs Blames North Korea for $6.36B Binance Hack (October 30, 2026), context for the TRM attribution, the $6.36 billion traced total, and the $2.7 billion frozen on-chain
• MABOnChain, Binance Points to Compromised DevOps Laptop in $6.3B Hack, No Key Leak Found (October 30, 2026), context for Binance's initial laptop findings, its $6.3 billion estimate, and its coverage pledge