Abu Dhabi Regulator Monitors Binance After $6.3 Billion Hot Wallet Breach

The Financial Services Regulatory Authority (FSRA) of Abu Dhabi Global Market (ADGM), which has supervised Binance's global platform since January 2026, said it is engaging closely with Binance and monitoring a security incident involving unauthorised withdrawals of assets from the exchange on 30 October 2026. Binance said attackers compromised its hot wallets at around 20:05 UTC on 29 October 2026 and took token assets worth approximately $6.3 billion.

In its statement, the FSRA said protecting the interests of clients and supporting the integrity and orderly functioning of markets remain its key priorities. The regulator did not announce any measure against Binance or its licensed entities. Binance has suspended withdrawals, says it will cover all losses from its Secure Asset Fund for Users (SAFU) and corporate funds, and says user funds are safe.

What Binance Has Disclosed So Far

Binance published two official updates on 30 October 2026. The first said its initial investigation suggested that a compromised laptop belonging to a DevOps engineer allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The second update, signed by the company's two co-CEOs, said the subsequent investigation had uncovered additional points of breach. Both updates state that Binance has found no evidence that wallet private keys were leaked.

According to Binance, around $3 billion of the affected assets had been frozen on-chain with the help of blockchain partners, law enforcement, asset issuers and other industry participants at the time of the second update. The company said it had set aside more than $6.34 billion in company funds, including $5 billion held in the same token assets that were stolen, such as USDC, USDT, BTC, ETH and BNB, which it described as covering approximately 80% of the impacted amount. It said it was buying the remaining token assets through market and OTC channels.

As immediate precautions, Binance said it contained the compromised infrastructure, revoked the affected authorisations, strengthened security checks and temporarily suspended withdrawals while security reviews and remediation are completed. Deposits and other unaffected services continue to operate, according to the company.

Why the ADGM Regulator Is Involved

The FSRA approved Binance's global platform, Binance.com, in December 2025, and the ADGM-regulated structure took effect on 5 January 2026. Under that structure, services are provided through three ADGM entities. Nest Exchange Limited is a Recognised Investment Exchange that operates a multilateral trading facility and handles on-exchange spot and derivatives trading. Nest Clearing and Custody Limited is a Recognised Clearing House with an additional permission to provide custody; Binance describes it as the central counterparty for on-exchange derivatives and as the custodian of user digital assets. Nest Trading Limited is a broker-dealer for off-exchange services such as OTC trading, Convert and Earn.

Binance said at the time that the rights and obligations under existing Binance.com terms of use were novated to these ADGM entities from 5 January 2026. This means that, for users of the global platform, the contractual counterparties and the custodian of their assets are firms authorised and supervised by the FSRA, which explains why the Abu Dhabi regulator, rather than another authority, issued the first official regulatory statement on the incident.

Binance also operates separately licensed businesses in other markets, including Binance FZE, which holds a VASP licence from Dubai's Virtual Assets Regulatory Authority (VARA). Binance's announcements do not say whether any locally licensed affiliate was affected, and no statement on the incident from VARA or other national regulators had been published on their websites when this article was prepared.

What Happens Next

Binance has set out four immediate priorities. First, it plans to resume withdrawals in phases: in the second update it said its technical team aimed to start restoring the withdrawal service within approximately 34 hours, subject to completing security checks. Second, it said it would take an initial Proof of Reserves snapshot and publish the result by Monday, 2 November 2026, to show platform holdings and the backing of user balances. Third, it will continue working with law enforcement, blockchain analytics firms, token issuers and other exchanges to trace and recover the stolen assets. Fourth, it will publish a detailed post-mortem, with further verified technical findings expected within about 48 hours of the second update.

For the FSRA, the incident is a test of the supervisory framework it applied to the largest crypto exchange it oversees. The regulator's statement does not specify any review, direction or enforcement step, and any such measure would be announced by the FSRA. Users of Binance.com can check the current status of the three Nest entities on the FSRA public register and should rely on Binance's official announcement pages for information on withdrawals and the reserve report, as the company has asked.