$6.4 Billion Left Binance in One Afternoon - and $2.8 Billion Was Frozen Within Hours

What the October 2026 Binance incident, the ADGM FSRA statement and the Mercado Bitcoin freeze mean for crypto businesses in Cyprus

What happened

According to Chainalysis, at around 4:20 p.m. ET on 29 October 2026 funds began leaving Binance hot wallets across multiple blockchains. The unauthorised transfers totalled approximately USD 6.4 billion. Freezing began at 5:14 p.m. ET, fifty-four minutes later, and Chainalysis reports that approximately USD 2.8 billion has been frozen so far. Chainalysis describes part of the movement as a swap of USD 325 million in stablecoins into USD 285 million of ETH, with the remaining USD 175 million in stablecoins sent to stopover wallets.

Chainalysis attributes the incident to TraderTraitor, a group it identifies as North Korean. That is an on-chain assessment by a private analytics firm, strengthened in its account by commingling with an earlier theft already attributed to North Korean actors. It is not a court finding, and Chainalysis states that its investigation is ongoing. We report it here as their assessment and nothing more.

The regulator’s response

On 30 October 2026 the Financial Services Regulatory Authority of Abu Dhabi Global Market published a short statement confirming that it was aware of the matter, that it was engaging closely with Binance and monitoring the incident, and that protecting the interests of clients and supporting the integrity and orderly functioning of markets remain its key priorities. The statement makes no findings and announces no measures.

A second incident, four days later

On 2 November 2026 Chainalysis published an account of an attack on Mercado Bitcoin, described as Brazil’s largest crypto exchange, involving approximately USD 49 million in stolen funds drained in waves across seventeen blockchains. Chainalysis reports that law enforcement was contacted within thirty minutes of the first call, that roughly USD 4 million in stolen stablecoins was locked by that morning, and that approximately USD 9 million in total freezes followed, with Tether freezing over USD 4 million.

What this means for a crypto business in Cyprus

Two incidents a few days apart, on two continents, with very different sums involved, point to the same operational conclusion.

Recovery is a speed problem before it is a legal one. In both cases the funds that came back came back because somebody reached stablecoin issuers, exchanges and law enforcement within the hour. Nothing in a legal strategy drafted after the fact recovers money that has already been bridged and mixed. The practical question for a board is not whether it has an incident response policy, but whether the named people in it answer their phones at three in the morning and already hold the contacts they would need.

Your regulatory clock does not wait for the forensics. A crypto-asset service provider authorised in Cyprus operates under the Markets in Crypto-Assets Regulation and the operational resilience and reporting framework that sits alongside it. Those obligations are triggered by the incident, not by the conclusion of the investigation. An exchange that spends the first day tracing wallets and the second day drafting its notification has already made a supervisory problem out of a security problem.

Custody arrangements are now the centre of the compliance file, not an annex to it. Hot wallet exposure, segregation of client assets, key management, withdrawal controls and the ability to evidence all of it are what a supervisor will ask about first. So will an auditor, and so will a client considering whether to place assets with you.

The attribution question will reach your AML file. Where a private analytics firm attributes an incident to a sanctioned-state-linked group, every counterparty exposed to the tainted flows inherits a screening and reporting question. Firms that already run on-chain analytics against their inflows are in a position to answer it. Firms that do not will be answering it by hand.

What we suggest reviewing this month

• Test the incident response plan rather than reading it: who calls whom, in what order, and with which contacts already in hand.
• Confirm who in the firm can authorise an approach to issuers, exchanges and law enforcement outside working hours, and that this does not require a board meeting.
• Map the regulatory notifications an incident would trigger and the time limits attached to each, and keep draft templates ready.
• Re-examine the split between hot and cold storage, client asset segregation and withdrawal limits, and document the reasoning.
• Check that inbound transaction screening would flag exposure to funds from a publicly reported incident, and record what happens when it does.
• Review the insurance position and what it actually covers.

How we can help

CYAUSE Audit Services works with crypto-asset service providers, investment firms and crypto investors in Cyprus on licensing, audit and assurance, AML and compliance review, and the tax treatment of crypto-asset activity. Where custody arrangements, client asset segregation or incident readiness are in question, we review them against the firm’s regulatory obligations and document the position before a supervisor or an auditor asks for it.

This article is for general information only. It is not investment, tax, legal or audit advice, and no action should be taken on the basis of it without specific professional guidance on your own circumstances.

Sources

• Chainalysis, “The $6.4 Billion Binance Hack: Tracing the North Korea Link”, 30 October 2026.
• ADGM FSRA, “FSRA Statement Regarding Security Incident Involving Binance”, 30 October 2026.
• Chainalysis, “Disrupting the Mercado Bitcoin Attack”, 2 November 2026.

Contact Us

Contact Us: enquiries@cyprusaccountants.com.cy
Website: www.cyprusaccountants.com.cy
Telephone: +357 22 336 309