Binance says $6.3B stolen in suspected breach; stablecoin issuers freeze funds and withdrawals halt

Binance said on Thursday that a security incident affected roughly $6.3 billion in crypto assets, an event that — if the figure holds — would be the largest exchange theft on record. By Friday morning the fallout had spread across the market: bitcoin had fallen below $77,000, more than $1 billion in leveraged positions had been liquidated, three stablecoin issuers had frozen reserves tied to the stolen funds, and institutional traders were reported to be pulling balances off centralized venues generally, per CoinDesk.

The cause has not been confirmed. In a post on X, Binance said the suspected breach may have involved a compromised engineer's laptop that enabled unauthorized withdrawals, according to CoinDesk. Changpeng Zhao — the exchange's former chief executive, known as CZ, who no longer runs Binance but remains a key shareholder — wrote on X only that "it does look like a hack." That is a hedge, not a confirmation, and it is worth keeping the word "suspected" attached until Binance or investigators say more.

Binance co-CEO Yi He said the exchange would cover all losses from the hack, and Binance suspended withdrawals, CoinDesk reported. Of the roughly $6.3 billion Binance estimates was taken, about $3 billion had subsequently been frozen, per people familiar with the matter cited by CoinDesk.

How the money was frozen

Three stablecoin issuers moved publicly, each via their chief executives on X:

• Tether's Paolo Ardoino said the company froze more than $1.567 billion in USDT linked to the potential Binance hack.
• Circle's Jeremy Allaire said it froze more than $800 million in USDC tied to the incident, in coordination with law enforcement.
• First Digital's Vincent Chok said FDUSD stolen in the attack had been frozen, without giving a figure, in an emailed statement.

Those disclosed stablecoin freezes — at least ~$2.37 billion between USDT and USDC alone — are the mechanical reason a chunk of the stolen value is now immobilized. It is also a reminder of a structural fact these issuers rarely foreground: centralized stablecoins are freezable by their issuers, which cuts against theft here but is the same lever that can freeze any holder.

A second, smaller breach the same day

Separately on Thursday, the decentralized betting platform Polymarket suspended international trading after hackers drained more than $2.6 million from user accounts in what it described as a third-party breach, per CoinDesk. It is a much smaller sum and, on the available information, a distinct incident — not part of the Binance theft — but the timing stacked two security failures at well-known platforms into a single news cycle.

The market reaction

Bitcoin declined more than 3% over 24 hours to about $77,400 on Friday morning, having briefly dropped toward $76,000, CoinDesk reported; its reference quote listed BTC at $78,037.23. Ether ($2,237.98), BNB ($716.09), XRP and solana fell by slightly more.

The leverage washout did the visible damage. CoinDesk's "more pain" piece put total market-wide liquidations at $1.5 billion "at the time of writing" — with bitcoin accounting for $468 million and ether $358 million, and long positions bearing most of the losses — while the same article's summary and headline framed it as "over $1 billion." Read the $1.5 billion as the later, fuller tally and the $1 billion as the rounded-down early figure.

One token rose: Hyperliquid's HYPE gained 15% — but on unrelated news, not as a safe haven. CoinDesk attributed the move to Intercontinental Exchange, the NYSE's owner, announcing a partnership with Trade.xyz to bring Hyperliquid-powered perpetual futures to the U.S., pending regulatory approval. Every other DEX token CoinDesk named — Uniswap's UNI (down more than 3%), Aster, Pump.fun's PUMP, Jupiter's JUP and Litentry's LIT — fell with the market.

Key facts

• Binance estimated ~$6.3 billion in crypto assets affected in a suspected Thursday breach; co-CEO Yi He pledged to cover all losses and the exchange suspended withdrawals (Binance via CoinDesk).
• About $3 billion had been frozen (sources via CoinDesk). Cause suspected to be a compromised engineer's laptop; "it does look like a hack" — CZ on X (CoinDesk).
• Stablecoin freezes: >$1.567B USDT (Tether's Ardoino), >$800M USDC (Circle's Allaire), undisclosed FDUSD (First Digital's Chok) — all via X/email.
• If confirmed, surpasses the record ~$1.5B Bybit hack of 2025, which was linked to North Korea (CoinDesk).
• Bitcoin fell below $77,000 (~$77,400, briefly ~$76,000); liquidations ~$1.5B — BTC $468M, ETH $358M, mostly longs (CoinDesk).
• Polymarket suspended international trading after >$2.6M drained in a third-party breach (CoinDesk).
• CertiK recorded $1.28B in crypto losses in Q3 2026, up nearly 56% quarter-on-quarter — before this incident (CoinDesk).

The real-world read

A few things deserve a harder look.

"Suspected" is carrying weight. Binance has not confirmed a hack, only a "security incident," and CZ's wording ("does look like") is deliberately non-committal. The $6.3 billion figure comes from Binance's own estimate of affected assets — not an independent audit — and estimates of this kind move. Treat the number as provisional.

Attribution is speculation so far. One of CoinDesk's own linked headlines floats North Korea's Lazarus Group as "likely" behind the breach, sourced to "blockchain sleuths." That is unconfirmed third-party analysis, not a finding by Binance or law enforcement. The Lazarus-Bybit precedent makes it a plausible guess; it is still a guess.

Watch the talking-book. Standard Chartered's Geoffrey Kendrick is quoted forecasting more downside and urging investors to "re-engage with Uniswap," calling Binance's troubles a reason his $100-by-2030 UNI target "may end up being too low." That is a bank analyst using a competitor's crisis to restate a bullish price target on a specific token — an interested read, not neutral analysis, and it should be weighed as such. Notably, UNI itself fell more than 3% on the day, so the market did not share the thesis in the moment.

"We'll cover losses" is a pledge, not a payout. Yi He's commitment to make users whole is a statement of intent while withdrawals are frozen. Nothing in the available reporting confirms reimbursements have begun, and the mechanics — out of reserves, insurance, or company funds — weren't disclosed.

Context the headlines skip: this is not a bolt from the blue. CertiK had already logged $1.28 billion in losses in Q3 2026 alone, up ~56% on the prior quarter. The Binance event is an outlier in size, not in kind.

Finally, a housekeeping note on where this reporting sits: the CoinDesk pages carrying it also host a sponsored "Issuer's Guide to Tokenized Equities" promotional unit. That is marketing, unrelated to the hack, and none of its framing informs this account.

Opinion, and whose

• Standard Chartered (Geoffrey Kendrick, Global Head of Digital Assets Research): expects "the negative price action still has some way to go," with a base only "after assets are unfrozen and more detail of the hack emerges"; argues the breach should accelerate a shift from centralized to decentralized exchanges and reiterates a $100 UNI target for 2030. Forecast and target, not fact — and from a party restating a bullish call.
• CZ (Changpeng Zhao): "It does look like a hack." Characterization, not confirmation; he is a Binance shareholder.
• Unnamed "blockchain sleuths" (via CoinDesk): Lazarus Group "likely" responsible. Unconfirmed attribution.

Sources

• CoinDesk, "$6 billion Binance hack sends bitcoin, ether tumbling; Standard Chartered expects more pain" (Oct 30, 2026) — Tier 2 secondary: breach size, price moves, liquidation breakdown, stablecoin freezes, CZ quote, Standard Chartered commentary, DEX-token moves, HYPE/ICE news, Polymarket. Note: its own $1B vs $1.5B liquidation figures are an early-vs-later tally, reconciled above.
• CoinDesk, "Institutional crypto investors rush to pull funds from exchanges after Binance hack" (Oct 30, 2026) — Tier 2 secondary: anonymous-sourced institutional withdrawals, ~$3B frozen, Yi He loss pledge, withdrawal suspension, CertiK Q3 2026 loss figure.
• Primary statements referenced via the above: Binance (X), Tether's Paolo Ardoino (X), Circle's Jeremy Allaire (X), First Digital's Vincent Chok (email).
• A sponsored "Tokenized Equities" promotional unit appeared on the source pages; it is marketing and was not used.

This is news reporting, not financial advice; nothing here is a recommendation to buy or sell anything.