A major global crypto exchange reported a security incident on October 30, 2026, with an estimated total impact of approximately $6.3 billion. The exchange said around $3 billion of affected assets had already been frozen on-chain as of its latest official update.
The $6.3 billion figure should not yet be treated as the final realized loss. It represents the exchange’s preliminary estimate of affected assets. The amount ultimately lost will depend on how much can be frozen, recovered or otherwise prevented from being used by the attacker.
A Compromised Laptop May Have Opened the Withdrawal Path
According to the exchange’s preliminary investigation, the incident may have started with a compromised laptop belonging to a DevOps engineer.
The attacker reportedly used that access to enter a service container and submit unauthorized withdrawal transactions. The exchange said it had found no evidence that wallet private keys were leaked.
That distinction matters. A private-key compromise could require a broader wallet migration and raise questions about the security of multiple wallets. A compromised internal service instead points toward access controls, employee-device security and withdrawal authorization systems.
The conclusion remains preliminary. The exchange said it would publish a detailed technical post-mortem after completing its investigation and verifying the facts.
How the Exchange Responded After Detecting the Incident
The exchange temporarily suspended crypto deposits and withdrawals while its security teams checked the affected systems. As of 12:58 p.m. UTC+8 on October 30, no verified official update confirming the full restoration of these services had been identified.
It also revoked the affected address authorization, contacted law-enforcement agencies and brought in blockchain intelligence companies to trace the outgoing funds.
More importantly for customers, the exchange stated that losses would be covered using its emergency user-protection fund and company funds. It also promised to publish an updated Proof of Reserves after remediation is completed.
The Proof of Reserves update may be more important than the initial compensation promise. It should help the market assess whether customer liabilities remain fully backed after frozen funds, recoveries and replacement capital are taken into account.
Stablecoin Issuers Froze More Than $2.3 Billion
Stablecoin issuers provided the most immediate form of industry assistance.
One issuer said it froze more than $1.5 billion in stablecoins associated with the incident. Another reported freezing over $800 million in coordination with law enforcement. Together, these actions prevented more than $2.3 billion from moving freely through the market.
Stablecoin freezing is possible because certain issuers can blacklist specific blockchain addresses. This does not reverse the original transaction, but it can make the affected tokens unusable until legal ownership and recovery procedures are resolved.
The same mechanism does not apply directly to decentralized assets such as Bitcoin and Ether. Those assets can still be tracked through public blockchain records, but no central issuer can simply freeze them at the token level.
DeFi Protocols Moved to Contain Secondary Risks
The response extended beyond the exchange and stablecoin issuers.
LlamaRisk reported that the attacker supplied approximately 60 million USDT to a major lending protocol and borrowed 19,762 WETH before the first freeze was executed. The position remained overcollateralized and was subject to the protocol’s normal liquidation rules.
The protocol’s risk teams subsequently froze 175 reserves across 16 networks in its V3 markets and another 117 reserves across four V4 networks. This prevented the attacker from opening new supply or borrowing positions while still allowing existing users to repay debt, withdraw assets and participate in liquidations.
This action did not recover the stolen funds. Its purpose was to stop the compromised assets from being converted into additional borrowing power and spreading the risk into DeFi liquidity pools.
Blockchain intelligence firms were also tracing the attacker’s wallet cluster across Ethereum, Arbitrum, Optimism and Avalanche. The funds had reportedly been divided among more than 20 wallets, making coordination between issuers, protocols, investigators and law enforcement necessary.
MEXC View: The Recovery Rate Matters More Than the Headline Number
The $6.3 billion estimate is large enough to dominate headlines, but the more useful figure for traders will be the final unrecovered balance.
Approximately $3 billion had already been frozen when the exchange published its update. That means the gross affected amount and the eventual economic loss could be very different. However, frozen assets are not automatically recovered assets; ownership, technical and legal processes may still take time.
The next meaningful checkpoints are the restoration of deposits and withdrawals, publication of an updated Proof of Reserves and release of the promised technical post-mortem. Together, these will show whether the incident has been contained at the operational, financial and security-control levels.
The wider market has already priced in part of the uncertainty. According to the Bitcoin price page on MEXC, BTC traded at approximately $78,292 and was down 4.23% over 24 hours as of 12:43 p.m. UTC+8 on October 30. The Ethereum price page on MEXC showed ETH near $2,248, down 5.12% over the same interval as of 12:47 p.m.
These declines show a broader reduction in risk appetite, but they do not establish that the exchange incident was the only cause of the market move.
FAQ
Were customer funds lost in the exchange incident?
The exchange said user funds remained safe and promised to cover all losses through its emergency protection fund and company funds. An updated Proof of Reserves has also been promised, but had not yet been published at the time of writing.
Is the confirmed loss $6.3 billion?
Not necessarily. The exchange described $6.3 billion as the estimated total impact. Around $3 billion had already been frozen, so the final unrecovered amount may be lower.
How did the crypto industry assist the exchange?
Stablecoin issuers froze more than $2.3 billion, blockchain intelligence firms traced the attacker’s wallets, law enforcement joined the investigation, and DeFi risk teams restricted markets that could have been used to borrow against stolen assets.
Have deposits and withdrawals resumed?
The exchange initially suspended deposits and withdrawals for security checks. As of 12:58 p.m. UTC+8 on October 30, a verified announcement confirming full restoration had not been identified.
Risk Warning
This remains a developing security incident. The affected amount, frozen balance, recovery total and service status may change as the investigation progresses. Users should rely on verified platform announcements and remain alert to phishing messages, fake compensation forms and fraudulent recovery links. Cryptocurrency prices can move sharply during major security events, and this article does not constitute financial advice.
Research checked outside article body: the exchange’s official Security Incident Update, Associated Press reporting, Reuters reporting, stablecoin issuer statements, and LlamaRisk’s incident response report.
