Last updated: October 30, 2026
On October 29, 2026, attackers drained about $6.3 billion from Binance's hot wallets across ten blockchains, the largest crypto theft on record and roughly four times the 2025 Bybit hack. Binance says user funds are safe and that losses will be covered from its SAFU fund and company money. About $2.7–3 billion was frozen within hours, mostly by stablecoin issuers. Blockchain analytics firms TRM Labs and Chainalysis attribute the attack to North Korea's TraderTraitor group. Withdrawals were paused, and Binance expected to start resuming them within 48 hours of its October 30 update. Below: what happened, what it means if you have funds on Binance, and the scams to expect next.
- ~$6.3B stolen
- 10 blockchains hit
- ~$2.7B+ frozen within hours
- 4× the Bybit hack
What happened: timeline
| Time (UTC) | Event |
|---|---|
| Oct 28, morning | The attackers' operator wallet is funded with small Tornado Cash withdrawals |
| Oct 29, earlier in the day | Attack code tested on three wallets, then deployed against a Binance hot wallet |
| Oct 29, 20:05–20:09 | 233.46 million XRP leaves five Binance XRP wallets |
| Oct 29, 20:10–20:24 | Solana, Optimism, Bitcoin (18,270 BTC), Tron and Ethereum hot wallets are drained within minutes |
| Oct 29, 21:01–22:26 | Tether, Circle, Ripple and World Liberty Financial freeze stablecoins held by the attackers |
| Oct 29, 22:15 | Binance halts withdrawals |
| Oct 30, 04:17 | Co-CEO Yi He says withdrawals should begin resuming within 48 hours; deposits work normally |
According to TRM Labs, the stolen assets included about 200,630 ETH, 18,270 BTC, 233 million XRP, 970,500 SOL and more than $3 billion in USDT and USDC, across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
How the attackers got in
Binance's preliminary finding: a DevOps engineer's laptop was compromised. That gave the attacker access to a service container that could submit withdrawal transactions, so the withdrawals looked like Binance's own. Binance says it found no evidence that wallet private keys leaked.
On Ethereum, the attacker used EIP-7702, a 2025 feature that lets an ordinary wallet delegate to smart-contract code. They pre-signed 50 delegations for 50 consecutive transaction numbers, so one of them was sure to match, and turned the hot wallet into a sweeper that obeyed only them. New deposits arriving at that wallet were swept several more times that night. The same pattern — a compromised work computer, then legitimate-looking signing — was behind the Bybit hack in 2025.
Is your money on Binance safe?
Binance says yes: no customer balances will be cut, and the gap between stolen and frozen funds — roughly $3.3 billion — will be covered by SAFU and company funds. Binance held about $144–155 billion in assets before the hack, so the loss is around 4% of that, and analysts quoted by the press don't see it as a solvency threat. Binance has also promised an updated proof of reserves and a detailed post-mortem.
That's the best case for a hacked exchange, not the usual one. Some exchanges covered losses; others cut balances or went bankrupt — see what happens when a crypto exchange is hacked. Even with full coverage, you can't move your coins while withdrawals are paused.
What Binance users should do now
- Don't panic-sell on the exchange. Prices dropped (BTC about 5%, BNB about 8%) and spreads widen in moments like this.
- Ignore "withdrawal unlock" offers. Expect fake support agents, "priority withdrawal" links and fake compensation forms. Binance warned users not to trust unofficial links or messages — see fake support scams.
- Check announcements only in the app or on the official site, not through links in DMs or search ads.
- When withdrawals reopen, expect queues. Reopening will likely go network by network, possibly with lower limits at first.
- Then move what you don't trade to your own wallet. A hot wallet at an exchange is someone else's wallet — not your keys, not your coins. Long-term savings belong in a cold wallet.
Where the stolen money goes — and why it matters to you
The attackers are already converting stablecoins to ETH, borrowing against stolen USDT and splitting the bitcoin into 1,000 BTC and 100 BTC pieces. Investigators expect bridges, swap services and OTC brokers next. Instant exchanges screen incoming coins against hack lists. If coins you receive have passed through the attackers' wallets, a swap can be held for review — see AML risk scores and what to do if an exchange freezes your funds. Be careful taking crypto from strangers or unusually cheap OTC deals in the coming weeks.
The freezes are a lesson too: Tether froze about $1.77 billion USDT and Circle about $825 million USDC within hours. That helped here, but the same power applies to any address — read can Tether freeze USDT.
Frequently asked questions
How much was stolen in the Binance hack?
About $6.3 billion according to Binance; TRM Labs counted about $6.36 billion at the time of theft across ten blockchains. Roughly $2.7–3 billion was frozen within hours, mostly USDT and USDC.
Who hacked Binance?
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group linked to the Lazarus Group and blamed for the 2025 Bybit hack. Binance hasn't publicly named the attacker.
Will Binance users lose money?
Binance says no: it will cover all losses from its SAFU fund and company funds, and user balances stay intact. Withdrawals were paused while the withdrawal system is rebuilt.
When will Binance withdrawals resume?
On October 30 Binance said it expected to begin resuming withdrawals within 48 hours, while deposits work normally. Check the status only in the Binance app or on its official site.
How did the Binance hack happen?
Binance's initial investigation points to a compromised DevOps engineer's laptop that gave access to a service container able to submit withdrawals. On Ethereum the attacker also used EIP-7702 delegation to turn a hot wallet into a sweeper.
When you swap, you don't need to leave coins on an exchange: compare live offers on /swap, for example BTC → XMR or USDT → BTC. Coins go straight to your own wallet. No account, no ID, no logs.
Sources: TRM Labs, CoinDesk, TechCrunch, Al Jazeera.