The Binance hack on 29 October 2026 took an estimated $6.3 billion out of the exchange’s wallets in unauthorized withdrawals. Binance says roughly $3 billion has since been frozen on-chain and that it will cover every loss from its own reserves. Withdrawals remain suspended, while deposits run normally.
What Binance Has Confirmed
Binance’s own account of the incident is short, and narrower than most of the coverage built on it. The exchange, which operates the global Binance.com platform, published a security incident update at 02:23 UTC on 30 October 2026 and revised it at 11:36 UTC the same day.
In that notice, Binance’s security incident update says “the estimated total impact sits at around $6.3B” and that approximately “$3 billion frozen on-chain so far”. On the cause, it says its “initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop” — a member of the team that runs the company’s deployment and server infrastructure — which was used to reach a service container and submit unauthorized withdrawal transactions. It adds that Binance has “found no evidence of any wallet private key leak”.
The notice names no attacker. It refers only to criminals that law enforcement is working to identify. It also makes three forward commitments: that Binance “will cover all losses from the SAFU fund and the company’s funds”, that it will publish an updated Proof of Reserves once remediation is complete, and that it will release a technical post-mortem once the investigation is finished and the facts are verified.
As of 31 October 2026, that notice remains the company’s formal position: an estimated $6.3 billion affected, about $3 billion frozen, no named culprit, and no stated time for withdrawals to restart.
The figures and the withdrawal suspension apply to Binance.com, the global exchange. Binance.US, which serves customers in the United States, said on 29 October that it is “a separate, independent platform” and was not affected by the incident.
Why the Loss Estimates Range From $5.9 Billion to $6.4 Billion
No two organizations tracking the theft have published the same number, because they are measuring different things at different moments. Prices moved while the funds did, so a total struck at the time of theft differs from one struck hours later.
| Source | Figure | What it measures |
|---|---|---|
| Binance | About $6.3 billion | Estimated total impact, per its 30 October notice |
| TRM Labs | About $6.36 billion | Value leaving Binance wallets across ten blockchains |
| Chainalysis (company) | About $5.912 billion | Value at the time of the theft |
| Jonathan Levin, Chainalysis chief executive | $6.4 billion | Figure he posted on X |
| Elliptic | About $6.43 billion | Excludes $169 million it believes Binance moved itself |
Binance’s own $6.3 billion is the only figure the company stands behind, and it is explicitly an estimate. Treating any of these numbers as a settled loss would be premature while roughly half the money is frozen rather than returned.
Who Has Blamed North Korea, and Who Has Not
The attribution is the part of this story most often flattened in headlines. Private blockchain analytics firms have pointed to North Korea; Binance has not, and no government has formally attributed this incident to anyone.
- TRM Labs: attributed the attack to TraderTraitor with “high confidence”, which it said was “based on robust on and off-chain intelligence”, citing overlaps with earlier thefts.
- Chainalysis: chief executive Jonathan Levin wrote on X that the hack was “likely done by DPRK group TraderTraitor due to links to previous hack”. DPRK is the Democratic People’s Republic of Korea, the formal name for North Korea.
- Elliptic: co-founder Tom Robinson described the theft as state-sponsored.
- ZachXBT: the on-chain investigator said the funds were commingled with proceeds of the earlier Bitget exploit, indicating “the same actor is likely behind both incidents”.
- Binance: co-chief executive Richard Teng said the company’s investigation “has not attributed responsibility to any individual”.
- The FBI: said it was aware of the incident and was in contact with “relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps”. That is a statement of engagement, not of attribution.
The distinction matters because the FBI has formally named TraderTraitor before, for a different theft. In the FBI’s public service announcement of 26 February 2025, alert number I-022625-PSA, the bureau said North Korea “was responsible for the theft” of approximately $1.5 billion in virtual assets from the exchange Bybit on or about 21 February 2025, and said it “refers to this specific North Korean malicious cyber activity as ‘TraderTraitor'”. No equivalent announcement has been issued for the Binance incident. North Korea has previously denied such accusations and called them United States propaganda.
Analytics-firm attribution of this kind has often been borne out later, but it is evidence offered by commercial firms, not a finding by a court or a government. Readers following how North Korea-linked operations are formally attributed may recall the WaterPlum fake job interview campaign, which seven government agencies in four countries jointly attributed in September 2026 — the shape a formal attribution takes.
Which Assets Were Frozen, and by Whom
The roughly $3 billion Binance describes as frozen was not frozen by Binance. Most of it is stablecoin — tokens pegged to a currency such as the dollar and issued by a company that retains the technical ability to blacklist addresses holding them.
| Issuer or body | Asset | Amount frozen |
|---|---|---|
| Tether | USDT | More than $1.567 billion |
| Circle | USDC | More than $800 million |
| Arbitrum Security Council | ARB and ETH | About $30.5 million |
| World Liberty Financial | USD1 and WLFI | $27 million and $2 million |
| Ripple | RLUSD | Not disclosed |
| First Digital | FDUSD | Not disclosed |
Tether’s chief executive Paolo Ardoino and Circle’s chief executive Jeremy Allaire each confirmed their company’s freeze publicly, Allaire saying Circle acted in coordination with law enforcement. The published freeze figures do not reconcile neatly: Binance co-founder Changpeng Zhao put Tether’s freeze at about $971 million and Circle’s at about $823 million, below both companies’ own stated totals.
Frozen Is Not the Same as Returned
A freeze stops tokens moving; it does not send them back. Returning frozen stablecoin to Binance would require the issuers to reissue it, and no issuer has published a timetable for doing so.
The assets that cannot be frozen this way are the ones with no issuer to call. Bitcoin and ether have no central party able to blacklist a balance. TRM Labs said the attackers still held more than 420,000 ether and 18,270 bitcoin, worth about $2.4 billion, and expected those funds to be moved through bridges, swap services and over-the-counter brokers. Elliptic estimated that the attackers retained control of more than $3 billion that token issuers cannot directly freeze.
That is the practical shape of the loss: the stablecoin half is largely immobilised, and the half held in bitcoin and ether is not.
When Binance Says Withdrawals Will Resume
Binance’s formal notice gives no restart time. Every figure in circulation came from executives’ posts during 30 October, and the estimate shortened through the day.
- 04:17 UTC, 30 October: Binance said withdrawals remained paused for a security revamp and were expected to resume within 48 hours.
- About 08:37 UTC, 30 October: Binance reported “additional points of breach” and gave a 45-hour estimate.
- 14:34 UTC, 30 October: co-chief executive Richard Teng gave an estimate of within 40 hours, and said a reserves report would follow by Monday.
Those timestamps are as logged by Cointelegraph’s running account of the company’s updates; the 48-hour figure was reported independently by several outlets. Deposits were briefly suspended at 00:07 UTC on 30 October and later described by Binance as operating normally. None of the three estimates is a commitment, and all of them are the company’s own.
What Binance Has Promised Customers
Binance’s commitment is to absorb the loss rather than pass it to account holders. Teng said that “your money is safe, and we’re covering every loss”.
SAFU, the Secure Asset Fund for Users, is a reserve Binance established in 2018 and funds from its own revenue to cover losses in incidents of this kind. The notice commits both SAFU and company funds. Teng said Binance had set aside more than $6.34 billion to cover the affected assets, and the company said it held $5 billion in matching tokens in custody, declining to disclose the wallet addresses.
What has not been published is any mechanism. There is no claim process, no form, no eligibility rule and no date by which balances will be made whole, because Binance’s position is that user funds are safe rather than that users must claim. The company’s announcements page is where the post-mortem, the updated Proof of Reserves — a periodic published attestation that an exchange holds assets matching customer balances — and any reimbursement detail are due to appear.
How the Attacker Took Over an Ethereum Hot Wallet
The mechanism on Ethereum is the best-documented part of the attack, and it did not involve stealing a private key. A hot wallet is an exchange wallet connected to the internet so it can process withdrawals automatically, as distinct from cold storage held offline.
According to TRM Labs’ analysis, the attacker held 50 authorizations signed in advance by Binance, each tied to a different nonce — the sequential counter that fixes the order of a wallet’s transactions — and submitted them in a single transaction. Only one matched, because the hot wallet was still processing withdrawals at the time. That one authorization was enough to turn a Binance hot wallet into an address running the attacker’s own sweeper contract.
The authorizations relied on EIP-7702, an Ethereum change that lets an ordinary wallet address temporarily execute code from a smart contract. Developers have pushed back on reading this as a flaw in the protocol: Derek Chiang of Ethlabs argued that EIP-7702 was not broken, and that it made the theft faster only once the attacker could already produce valid signatures. The feature does not let a stranger seize an arbitrary wallet.
Teng said the attack was not a single “one-click” action, and Binance later said it had found additional points of breach beyond the laptop without specifying them. TRM Labs assessed that on chains other than Ethereum, Binance’s hot wallet signing infrastructure was compromised. Exchange breaches have repeatedly begun at the operational edge rather than in the cryptography: the 2024 theft of about $234.9 million from the Indian exchange WazirX also turned on compromised signing rather than a broken chain.
What the Hack Did to Crypto Prices
Prices fell as the scale became clear, then partly recovered. These are point-in-time readings, and crypto prices move continuously.
At 01:19 UTC on 30 October 2026, CoinGecko data cited by Cointelegraph put bitcoin at about $76,937, down 4.9% over the preceding 24 hours; BNB, the token of Binance’s own chain, at about $693, down 8%; and ether at about $2,211, down 5.7%. CoinDesk reported that the episode triggered about $1.57 billion in liquidations — the forced closure of leveraged positions when collateral no longer covers them. Bitcoin traded below $79,000 through 30 October, recovering into the $78,000s later in the day.
BNB fell further than bitcoin in most readings, which is consistent with the loss being specific to Binance rather than to crypto markets generally.
What Is Still Unknown
- The final loss: how much of the roughly $3 billion frozen is ultimately returned, and how much of the bitcoin and ether is recovered.
- The additional points of breach: Binance has confirmed they exist but has not said what they were or which controls failed.
- How signing authority was obtained: how the attacker came to hold valid Binance-signed authorizations, and whether the method on other chains matched the Ethereum method.
- Reimbursement mechanics: no process, eligibility rule or date has been published.
- Formal attribution: whether any government will name a culprit, as the FBI did for Bybit in 2025.
- The freeze arithmetic: why figures given by Binance’s co-founder and by the stablecoin issuers do not match.
- Timing: when withdrawals actually restart, and when the Proof of Reserves and post-mortem are published.
Binance Hack FAQ
How Much Was Taken in the Binance Hack?
Binance estimates the total impact at about $6.3 billion, in a notice dated 30 October 2026. Independent estimates range from about $5.912 billion to about $6.43 billion because they measure value at different moments. Roughly $3 billion has been frozen on-chain.
Did North Korea Carry Out the Binance Hack?
TRM Labs attributes it to the North Korean group TraderTraitor with high confidence, and Chainalysis and Elliptic have reached similar conclusions. Binance says its investigation has not attributed responsibility to anyone, and as of 31 October 2026 no government had formally attributed this incident.
When Will Binance Withdrawals Resume?
Binance’s formal notice gives no restart time. During 30 October 2026 its executives estimated 48 hours, then 45, then within 40 hours. Deposits were described as operating normally.
Will Binance Customers Be Repaid?
Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe. It has not published a claim process, eligibility rule or date, and has promised an updated Proof of Reserves after remediation.
Was Binance.US Affected?
Binance.US said on 29 October 2026 that it is a separate, independent platform, that it was not affected, and that customer funds and services were operating normally. The suspension applies to the global Binance.com platform.
Is This the Largest Crypto Theft on Record?
TRM Labs and several other firms describe it as the largest on record. It is roughly four times the approximately $1.5 billion taken from Bybit on or about 21 February 2025, which the FBI attributed to North Korea.
