Madrid, 30 October 2026. Binance has reported an incident with an estimated impact of USD 6.3 billion and approximately USD 3 billion in assets frozen with industry partners’ assistance. The platform says it will cover losses through its SAFU fund and company resources. Estimated impact, frozen assets and final losses are distinct measures; freezing funds does not establish their recovery. [2–3]
The preliminary investigation points to a compromised development and operations engineer’s laptop as a possible entry point into a service container from which unauthorised withdrawal requests were submitted. Binance says it has found no evidence of wallet private keys being leaked. The full attack path and root causes remain under investigation; this hypothesis does not establish a specific failure in key custody. [2]
After initially announcing a suspension of deposits and withdrawals, a later update states that deposits are operating and withdrawals remain paused, with a target to begin resuming them within 48 hours. This is the company’s stated expectation. Users should check service status through official channels and distrust messages requesting credentials or promising to recover funds. [2, 4]
At Internet Security Auditors, we recommend hardening administrative devices, restricting privileges and restricting access from development to production, with phishing-resistant multifactor authentication. Review service permissions, sessions and authorisations to transact with assets, enforce independent approvals and detect anomalous transactions. During an incident, preserve evidence, revoke affected access, investigate persistence and verify recovery before reopening critical functions. [5–6]
At Internet Security Auditors, we help through penetration testing, application and API audits, configuration reviews and system hardening. We complement prevention with digital forensics and incident response, to establish scope and preserve evidence. Our business continuity and disaster recovery, exercise and secure development services help organisations prepare for service disruption and verify that their controls and plans work. [7–9]
Referencias
[1] Expansión — Initial news article; cross-checked against official statements and EFE
https://amp.expansion.com/mercados/criptomonedas/2026/10/30/binance-paraliza-intercambio-criptomonedas-hackeo-miles-millones-dolares.html
[2] Binance — Investigation update and estimates (30 October 2026)
https://www.binance.com/en-IN/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
[3] EFE — Estimated impact and frozen assets (30 October 2026)
https://efe.com/economia/2026-10-30/binance-impacto-ciberataque-bloquea-activos/
[4] Binance News — Deposit status and withdrawal resumption target (30 October 2026)
https://www.binance.com/en/square/post/10-30-2026-binance-says-deposits-normal-withdrawals-paused-for-security-revamp-eyes-48-hour-restoration-382748430882486
[5] CISA y MS-ISAC — Privileged account protection and phishing-resistant authentication
https://www.cisa.gov/sites/default/files/2024-02/aa24-046a-threat-actor-leverages-compromised%20account-of%20former-employee.pdf
[6] CISA — Incident response and recovery playbooks
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Incident_Vulnerability_Response_Playbooks_508C.pdf
[7] Internet Security Auditors — Security audits, penetration testing and hardening
https://www.isecauditors.com/en/pages/system-hardening
[8] Internet Security Auditors— Business continuity, resilience and secure development
https://www.isecauditors.com/en/pages/continuity-resilience-secure-development
[9] Internet Security Auditors — Digital forensics and incident response
https://www.isecauditors.com/en/pages/digital-forensics-and-incident-response
