Skip to content
Subscribe

Binance's $6.3bn hack: what it means for Pakistanis using its P2P market

Binance says attackers took about $6.3 billion from its wallets and that it will cover every dollar. Withdrawals are paused. On its rupee P2P market, USDT is now about Rs3 cheaper than on Bybit's. Here is what we know, what Pakistan's rules would demand of a licensed exchange, and what to do if your

Ammar Khan

Ammar Khan

5 min read
Network cables in a server rack, lit green in a dark room.
Photo by Tyler on Unsplash

Key takeaways

  • Binance says the "estimated total impact sits at around $6.3B", about Rs1.74 trillion. It says about $3 billion has been frozen on-chain and that it will cover all losses from its SAFU fund and its own money.
  • Withdrawals from Binance are suspended. Deposits are working. Binance's own notice gives no time for withdrawals to restart.
  • On Binance's PKR P2P market, USDT was offered at around Rs283.56 on Friday afternoon. On Bybit's it was Rs286.64.
  • Binance holds a PVARA no-objection certificate (NOC), not a licence. Pakistan's licensing rules would require a licensee to report an incident like this without delay and keep customer assets matched one for one. No exchange is licensed yet.

What Binance says happened

In a notice titled "Security Incident Update (2026-10-30)", Binance says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

It puts the loss at "around $6.3B" and says: "We have found no evidence of any wallet private key leak." With blockchain partners, it says, "~$3 billion" has been "frozen on-chain so far". According to AFP, Tether's chief executive Paolo Ardoino said his company froze about $1.6 billion, and Circle's Jeremy Allaire said Circle froze more than $800 million of USDC.

AFP also reports that the blockchain analytics firms TRM Labs and Elliptic have linked the attack to North Korea. Binance has not said who was behind it.

Different outlets carried different totals on Thursday night, from $5.5 billion to $5.8 billion, as the outflows were still being counted. The $6.3 billion figure is Binance's own. Binance has said it "may continue to increase".

What Binance says about customers' money

"Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," the notice says. SAFU is an emergency fund Binance set up and holds itself. Binance says it will publish an updated proof of reserves "once the remediation is complete".

As a precaution, Binance has "temporarily suspended withdrawals". It later updated the notice to say deposits "remain unaffected and continue to operate as normal". AFP reports that at about 9:00 GMT on Friday (2 pm in Pakistan) Binance said it was "on track to resume withdrawals in 45 hours", which would be around Sunday morning, Pakistan time. That estimate does not appear on Binance's notice, so treat it as a target, not a promise.

These are Binance's statements. No independent audit of the SAFU fund or of customer balances has been published.

What happened to the rupee price

Binance's P2P market is still listing PKR ads. When we checked at 7:31 pm PKT on Friday, it was listing USDT ads on both sides, at a median mid-price of Rs283.56. On Bybit's PKR market the mid-price was Rs286.64.

Measured against the official rate of Rs276.60, that puts the premium at 2.51% on Binance and 3.63% on Bybit. Our daily P2P series, which tracks Binance only, recorded 3.03% on Thursday morning and 2.33% on Friday morning. That is its lowest reading since 17 October. The gap between buyers and sellers on Binance also widened, from Rs0.43 to Rs1.25.

One reading of this is that USDT that cannot leave Binance for now is worth a little less to some buyers than USDT on an exchange where withdrawals work. We cannot prove that from one day of prices. The premium was still inside its 30-day range of 2.23% to 3.63%, so watch the next few days before drawing conclusions.

Bitcoin traded at about $76,771 at 7:30 pm PKT, down 4.5% in 24 hours, according to CoinGecko. That is about Rs21.2 million at the official rate. Binance's own token, BNB, was down 6.5%.

The US Federal Reserve held its policy rate at 3.75% to 4% on 28 October, by a 10-2 vote. The two dissenters wanted a quarter-point rise.

What Pakistan's rules would demand of a licensee

The Pakistan Virtual Asset Services Regulations, 2026 bind licensed exchanges. Binance is not one. In December 2025 it received an NOC from PVARA, which PVARA has said is not a full operating licence; its deadline to apply for a licence falls around 21 November. Nothing below applies to Binance today. It describes what a licensed exchange would face.

  • Tell the regulator. A licensee must notify PVARA "without delay" when it is failing, or likely to fail, a requirement, and file a remedial plan (regulation 35(2)).
  • Keep customer assets separate and counted. Client assets "are not owned by the Licensee" (regulation 109(2)). They must be reconciled at least daily (111(1)), any material shortfall reported "without delay" (111(3)), and liabilities to clients fully matched by reserves (112(1)).
  • Carry outside insurance. PVARA can require a licensee's insurance to include cyber cover (36(2)(c)). An exchange "shall not represent insurance as a guarantee of customer recovery" (36(5)).
  • Expect consequences. PVARA may suspend a licence after "a material cybersecurity, operational, or safeguarding incident" (13(1)(d)).

As with Bitget's $388 million theft last month, the contrast is in who pays. Binance is covering the loss from a fund it controls. Pakistan's rules would look to an outside insurer and to assets that are segregated and counted every day.

PVARA had said nothing about the incident on its news page as of Friday evening. Its newest item is still the December 2025 notice of the Binance and HTX NOCs. We have not yet asked PVARA or Binance for comment.

What this means for Pakistani users

  • Binance says your balance is intact, but you can't withdraw it yet. Check your balance yourself once withdrawals reopen, and keep a screenshot of it now.
  • Be careful with P2P trades while withdrawals are paused. A P2P sale on Binance moves USDT inside Binance; it does not need a withdrawal. Keep to the escrow flow, and never release coins until the rupees are in your account.
  • Expect scammers. Big incidents bring fake "Binance support" and "recovery" offers on WhatsApp and Telegram. Binance will not ask for your password or 2FA codes. Nobody can speed up your withdrawal for a fee.
  • Expect a queue when withdrawals reopen. Prices on other exchanges may move as coins leave Binance.
  • No Pakistani regulator stands behind any exchange today. If an offshore exchange cannot pay, your recourse is its own terms and the funds it chooses to keep.

What we're watching

  • Whether withdrawals reopen on Sunday, and whether Binance publishes the updated proof of reserves it has promised.
  • Whether the gap between Binance and Bybit P2P prices closes once withdrawals restart. Our daily series will show it.
  • Whether PVARA says anything about the incident, or about how exchanges in its process should report one, before the 21 November deadline.

Sources

Share WhatsApp X LinkedIn

More on

All stories