Binance's USD 6.3 billion theft: what Abu Dhabi has said and what UAE firms should check
Binance says attackers took about USD 6.3 billion from its hot wallets on 29 and 30 October. The Abu Dhabi regulator is monitoring. No UAE rule has changed, but the incident tests the controls that UAE-licensed firms already have to run.
Binance, the largest crypto exchange by volume, disclosed on 30 October 2026 that attackers had made unauthorised withdrawals of about USD 6.3 billion from its hot wallets. Blockchain analytics firms put the figure at USD 6.36 billion (TRM Labs) and USD 6.43 billion (Elliptic), both at the prices of the day. Most of the money left within about 20 minutes, starting around 20:05 UTC on 29 October, on TRM's timeline. It would be the largest crypto theft on record.
What is established, and what is not
Binance says an early investigation pointed to a compromised laptop belonging to an engineer, and that it has found no evidence that wallet private keys leaked. TRM Labs, an analytics firm, attributes the attack with "high confidence" to TraderTraitor, a North Korean group, and thinks the signing systems for the hot wallets were compromised. Binance has not published a root cause, and no government has attributed the attack.
Binance has paused deposits and withdrawals while it runs checks. It says about USD 3 billion has been frozen with help from stablecoin issuers and other partners, and Elliptic puts it nearer USD 2.84 billion. Freezing stops the funds moving. It does not return them. Binance has promised to cover all losses from its Secure Asset Fund for Users (SAFU) and company resources, and says it has set aside more than USD 6.34 billion. That is a pledge, and we have no figure yet for what has been paid out.
| Said so far | Still open | |
|---|---|---|
| Cause | Compromised engineer laptop (Binance, early investigation) | No root cause published |
| Attacker | TraderTraitor, with high confidence (TRM Labs) | No government has attributed the attack |
| Frozen funds | About USD 3 billion (Binance); USD 2.84 billion (Elliptic) | Freezing does not return the money |
What Abu Dhabi has said
On 30 October the Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market said it was aware of a security incident involving unauthorised withdrawals at the Binance exchange. It is "engaging closely with Binance and monitoring the incident", with the protection of clients and orderly markets as its priorities. The statement does not name the Binance entity or licence it has in mind, and it does not say whether UAE customers were affected. We found no statement from VARA or the Central Bank on the incident.
What it means in practice
No UAE rule changed this week. What changes is what examiners ask. Central Bank licensees already run under Circular C 1/2026, which sets a 4-hour notification clock for events that affect critical operations and a 24-hour summary report. A VASP or an ADGM-authorised custodian will not be on that circular, but should expect its own regulator to ask the same questions: who can move assets from a hot wallet, how many approvals it takes, who holds the signing infrastructure, and what the firm would tell clients in the first hour.
Public leak-site trackers also count UAE-linked organisations that attackers claim to have breached. Their counts differ, because each tracker uses its own method, and they measure what attackers say rather than what is confirmed. We do not quote a figure.
This piece appeared in Jurisdicta, Issue 003. General information only; not legal, tax or investment advice.