The exchange has started drawing on its emergency reserve after a breach it estimates at $6.3 billion, confirming a 7,499 BTC transfer out of its SAFU fund to help cover user losses.

Binance says it has already replenished 90% of the stolen amount and plans to rebuild SAFU to about $1 billion afterwards.

The exchange has pledged to cover all losses from SAFU and company funds, and earlier said it had reserved over $6.34 billion for that purpose. Withdrawals remain paused while the withdrawal service is rebuilt, with a restart targeted for November 1 and a full Proof of Reserves report expected by November 3.

The biggest crypto hack in history began with a rehearsal: before the October 29 breach, attackers ran two test sequences of code on Ethereum accounts they controlled while trading on Binance carried on as normal.

The rogue code then gave them access to exchange-owned blockchain accounts. As the attackers emptied those wallets, Binance's own funds kept refilling them, and the drain continued.

Most of the estimated $6.3B left Binance hot wallets on 10 blockchains in about 20 minutes.

The account shows how automated hot wallet top-ups can amplify a breach once attackers control withdrawals from exchange accounts.

Two days after setting aside more than $6.34B of company funds for the record hot wallet breach, Binance published its third recovery update: replenished assets now cover 90% of the stolen amount, up from about 80% in the previous update.

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now 100% backed. The remaining 10% consists of less liquid tokens outside that list, which Binance is still buying through market and OTC channels with industry partners.

The gap is being filled with a partial deployment of the SAFU fund, part of the Futures insurance fund and the corporate treasury. Binance says users will not bear the loss and has committed to rebuilding SAFU back to about $1B.

A new Proof of Reserves snapshot was taken at 00:00 UTC on October 31, with the full zero-knowledge proof expected by November 3. The next milestone is reopening withdrawals, which the exchange says remains on track for Sunday, November 1.

Blockchain analytics firm Chainalysis, whose tools are used by exchanges and law enforcement to trace crypto flows, disclosed a security incident in a notice to customers. An external attacker using "offensive agentic techniques" gained access to its systems and internal tools in October.

The exposed data includes user IDs, full names, email addresses and organization role labels. The company found no sign that investigation graphs, cases, notes, query results, passwords, MFA secrets or session tokens were accessed.

Chainalysis has not disclosed how many users or organizations were affected and says the incident is unrelated to the recent Binance theft.

The firm has notified all customers, brought in outside security experts and is patching the exploited vulnerabilities. Names, work emails and roles could still be used for targeted phishing against customer staff.

Malaysia's Securities Commission ordered Binance to stop operating in the country in July 2021, after finding it was illegally running a digital asset exchange. The exchange is now in talks to obtain a Malaysian license, aiming to return after a five-year absence.

As recently as July 2026, Malaysia's Ministry of Finance said Binance was not licensed or registered with the SC to carry out capital market activities, and that its website and app remained blocked for local users.

A license would reopen a regulated Southeast Asian market to the largest exchange by trading volume. Until then, Malaysian users can only trade on SC-registered platforms.

A wave of frontend hijacks hit DeFi apps overnight, with security firm Blockaid flagging sites that were actively serving the Step Drainer to visitors. The first alert covered flap.sh and Kintsu, and the list later grew to include pickle.finance, echelon.market, origami.finance, fluxbeam.xyz, stakepoint.app and others.

The affected domains rely on different DNS providers, but all of them are registered with Name.com. Developer banteg pointed to the registrar as the likely common point of compromise, which Name.com has not confirmed so far.

At least 12 DeFi frontends were flagged as serving the drainer.

A registrar-level breach would let attackers redirect domains without touching the protocols' smart contracts. Users are advised not to sign transactions on the affected sites until the teams confirm the issue is resolved.

A full list of Major Upcoming Events, to be updated

A day after attackers drained its hot wallets, Binance laid out a recovery timeline in its second security incident update. Withdrawals stay suspended for now, while deposits and other unaffected services keep running.

The team aims to start resuming withdrawals within roughly 34 hours, in phases and subject to completed security checks. An initial Proof of Reserves snapshot is planned within 12 hours, with results due on Monday, November 2.

Binance has set aside more than $6.34B in company funds, about 80% of the loss already held in the stolen assets, and roughly $3B has been frozen on-chain.

The exchange says users will not bear the loss and that no wallet private key leak has been found, though the probe has uncovered additional points of breach beyond the compromised laptop. Further technical findings are expected within about 48 hours.

Everything that moved crypto today, in one card.

Today's headliners: Uber, FBI, Circle, Binance, Tether, Polymarket, Coinbase, Strategy, Jupiter, Celestia

Binance said on Friday it is cooperating with law enforcement worldwide after the record exploit, and a source named the FBI and the US Secret Service among the agencies involved. The exchange's own post did not specify which agencies it is working with.

The focus is recovery: about $3B of the stolen funds has already been frozen by industry partners, and Binance is working with authorities to get those assets back.

Binance has reserved more than $6.34B of company funds to cover the losses, with $5B already held in the exact tokens that were stolen.

US agencies have recovered exchange-hack loot before: in 2022 the FBI helped seize 94,000 BTC tied to the 2016 Bitfinex hack, then worth $3.6B.