Why Bitcoin Fell Below $77,000 as Binance Disclosed a $6.3 Billion Incident

Bitcoin fell below $77,000 late Thursday as Binance’s security incident added a direct exchange-risk shock to an already unsettled market. In a new October 30 update, Binance estimated the incident’s impact at approximately $6.3 billion and said about $3 billion of affected assets had been frozen on-chain.

The exchange said it would cover losses using its SAFU protection fund and company resources. Its initial notice announced a temporary suspension of deposits and withdrawals while checks continued. These are Binance’s statements about its response and obligations; they are not an independently completed audit of the loss, recovery or reimbursement process.

A later update from the official Binance News account said deposits were operating normally while withdrawals remained paused for a security overhaul. The company expected withdrawals to resume within forty-eight hours. That is an operational target, not a confirmed reopening, and the reviewed post did not establish a precise deadline.

The update materially advances the information available in TTN’s initial report on the investigation and issuer freezes. That earlier account described competing transfer estimates while the scope remained unsettled. Binance has now provided its own impact estimate and a preliminary explanation, while leaving the final technical findings open.

Forced closures amplify a fall that starts elsewhere

The Block reported bitcoin at $76,664 at 10 p.m. Eastern on October 29, equivalent to 02:00 UTC on October 30, down 4.5% over the preceding twenty-four hours. Ether was down 5.2% at $2,190 in the same report. A later Reuters Asian-session report put bitcoin back above $78,000, at $78,171.16. The rebound shows why the earlier low should not be presented as a live quotation.

The report cited CoinGlass data showing $1.55 billion in rolling twenty-four-hour liquidations, including $1.34 billion in long positions. That places approximately 86% of the measured liquidations on the side expecting higher prices, calculated from the reported totals. The rolling window changes over time and should not be treated as the current total for the entire incident.

A leveraged position uses collateral to support market exposure larger than the trader’s initial cash commitment. As prices move against a long position, the remaining collateral can fall below the platform’s maintenance requirement. The position can then be reduced or closed automatically, adding orders that the trader did not voluntarily choose at that moment.

This process can intensify a decline, especially where nearby buyers offer limited depth. It does not mean the liquidation total equals money stolen from Binance or the amount withdrawn from investment funds. Liquidated position value, customer collateral losses and an exchange’s security loss measure different things. Adding them together would produce a misleading damage estimate.

Binance’s technical account remains preliminary

Binance said its initial investigation pointed to a compromised DevOps engineer’s laptop, followed by access to a service container and unauthorized withdrawal transactions. It said it had found no evidence of a wallet private-key leak. The company promised a detailed technical postmortem once its investigation was complete and the facts verified.

That distinction changes the questions investigators must resolve. Unauthorized access to a system that can request withdrawals can create risk without proving that the underlying cryptographic signing key was exposed. The company’s preliminary account does not yet establish precisely which safeguards failed, how authorization was bypassed or the identity of the attacker.

Binance also said it revoked the affected address authorization and was working with law enforcement and blockchain-intelligence partners. Those containment steps are separate from the decision to reopen transfers. Reopening requires operational confidence; recovering assets may depend on tracing, counterparties and legal action that follow a different timetable.

Frozen assets are not the same as recovered cash

The approximately $3 billion frozen should not be described as a completed repayment. A restriction can prevent an identified token balance from moving while ownership and recovery procedures remain unresolved. The wider impact estimate and frozen total are also approximate figures, so subtracting one from the other does not establish a final, audited net loss.

As explained in TTN’s guide to stablecoin risks, a dollar reference price and the ability to transfer or redeem an asset are separate issues. Issuer controls can help contain some incidents, but a freeze involving particular tokens does not immobilize every cryptocurrency held by the same address.

The broader market backdrop matters too: technology stocks and equity futures were already under pressure over AI spending returns. The reviewed evidence does not permit a precise division of bitcoin’s decline between that risk aversion, the exchange incident and leverage. Nor does a falling price prove that identified stolen coins were sold into the market.

For the next stage, the decisive information is a reconciled incident total, verified recovery progress, transfer-restoration details and the promised postmortem. Binance’s commitment to absorb losses addresses who it says will bear the cost. Demonstrating secure operations and reconciling assets address the separate confidence problem that can keep markets volatile after the initial announcement.