TL;DR
Binance says its security incident affected $6.3 billion, with roughly $3 billion frozen onchain as recovery efforts continue alongside law enforcement and blockchain intelligence partners.
The attacker split 18,270 BTC worth about $1.4 billion across 19 wallets. Bitcoin cannot be blacklisted at the protocol level, limiting direct freezing options.
FUN plunged more than 90% in a Uniswap pool after 134.1 million stolen tokens were sold, while further FUN remains transferable.
Binance is working with law enforcement and blockchain intelligence partners to trace and recover assets after a security incident affecting approximately $6.3 billion , according to an official update . The exchange says roughly $3 billion has been frozen onchain and that all losses will be covered. The incident also underscores a core feature of Bitcoin : unlike issuer-controlled tokens, native BTC cannot be blacklisted at the protocol level.
Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
The company has already publicly committed to cover losses through… pic.twitter.com/UqtBd37Fpj
— Binance (@binance) October 30, 2026
Bitcoin Split Across 19 Wallets Complicates Binance Recovery Efforts
The attacker moved 18,270 BTC worth about $1.4 billion into 19 separate wallets after the funds left Binance hot wallets. Seventeen addresses received exactly 1,000 BTC each, while two others ended with 832.5 BTC and 437.7 BTC. None of the 19 wallets had sent funds onward as of the cited early-Friday snapshot. Splitting the coins changes their distribution, but it does not make the transactions invisible on Bitcoin’s public ledger.
The Bitcoin position contrasts with stablecoins affected in the same incident. Centralized issuers can restrict transfers from flagged addresses, while Bitcoin has no issuer capable of freezing coins directly. Binance previously halted withdrawals while conducting security checks and says its preliminary investigation points to a compromised DevOps engineer’s laptop that may have enabled access to a service container. The company says it has found no evidence that wallet private keys leaked.
Recovery efforts therefore depend partly on tracing assets and coordinating with services where funds could eventually arrive. BTC could potentially be intercepted if the attacker sends it to a cooperating exchange, OTC desk or swap service , but the coins cannot be remotely disabled while remaining in self-controlled Bitcoin addresses. That limitation differs from the stablecoin freezes already used to contain part of the incident .
The attacker has also begun selling smaller stolen tokens. FUN fell more than 90% in one Uniswap liquidity pool after 134.1 million tokens were sold for 111.5 ETH, worth roughly $250,000 at the cited time. The selling wallet still held 580.8 million FUN, leaving further supply potentially transferable. Other smaller assets were also sold as the incident contributed to sharp market volatility and more than $600 million in forced crypto liquidations . That selling shows recoverability also varies according to each asset’s market structure and control mechanisms. Those distinctions shape how much capital can ultimately be recovered. Binance says a detailed technical post-mortem will follow once its investigation is complete.
