On the evening of Thursday, October 29, 2026, Binance's hot wallets (the online wallets an exchange uses to pay out withdrawals) were drained on ten blockchains within a few hours. According to TRM Labs' reconstruction, all times UTC:
Binance's initial investigation says a DevOps engineer's laptop was compromised, which gave the attacker access to an internal service used to submit withdrawals. Binance says it found no evidence that wallet private keys leaked, and co-CEO Richard Teng said it was not a single "one-click" action. On Ethereum, TRM Labs found the attacker used a pre-signed EIP-7702 delegation to turn a Binance hot wallet into a contract they controlled. On the other nine chains, which use different keys and signing systems, funds left through normal-looking signed transfers, so TRM assesses that Binance's hot-wallet signing infrastructure was compromised. Binance has promised a full technical post-mortem; until then, the exact root cause is not confirmed.
| Chain | Main assets | Approx. value |
|---|---|---|
| Ethereum | 200,630 ETH, 1.88B USDT, 823M USDC, 88.5M RLUSD | $3.79B |
| Bitcoin | 18,270 BTC | $1.47B |
| Tron | 612.7M USDT, 46.4M TRX | $628M |
| XRP Ledger | 233.5M XRP | $296M |
| Solana, L2s, Avalanche, Polygon | various | $173M |
Stablecoins were the attacker's weak spot. TRM counts about $2.7 billion frozen by issuers: Tether about 1.77 billion USDT, Circle about 825 million USDC, plus Ripple (RLUSD), World Liberty Financial (USD1) and Arbitrum's Security Council; Binance puts the total at about $3 billion. Before the freezes, the attacker swapped about 325 million USDT into ETH at a discount of more than 10% and borrowed ETH on Aave against stolen USDT. Bitcoin and ether cannot be frozen this way: the attacker still holds about 18,270 BTC and over 420,000 ETH, and TRM expects them to be laundered through bridges, swap services and OTC brokers.
Binance says customers will not lose anything: it will cover all losses with SAFU (Secure Asset Fund for Users, set up in 2018, holding roughly $1 billion in bitcoin) and its own company funds. Founder Changpeng Zhao said he expects user funds to be fully covered. The numbers make this plausible: Binance held roughly $144–155 billion in assets before the hack, so the stolen amount is about 4% of that, and part of it is frozen and may be returned. Binance says it has set aside more than $6.34 billion, about $5 billion of it already held in the same tokens that were stolen. What would confirm it is the updated proof of reserves Binance has promised by Monday. We will update this page when it is out.
Bitcoin fell about 5% to below $77,000 after the news, ether about 6% and BNB about 8%. At 21:05 UTC on October 30 BTC traded at about $76,800 on Crypto.com Exchange, down about 2.5% on the day. Aave briefly froze some markets as a precaution and reopened them on October 30.
If you have funds on Binance: you cannot withdraw right now, and selling in panic will not make your balance safer. Follow only binance.com and Binance's official X account. Expect a wave of scams: fake "Binance support" messages, "compensation" forms and recovery services asking for your login, 2FA codes or recovery phrase. Binance will never ask for them. When withdrawals reopen, there may be a queue; you do not need to be first.
For everyone: this is the old rule again. An exchange is a place to buy and sell, not a savings account. Keep only what you actively trade on any exchange, spread larger amounts across more than one provider, and move long-term savings to a wallet you control. If you choose a hardware wallet, buy it directly from the manufacturer and check it before setup.
Compare hardware wallets →Disclosure first: Binance is one of our affiliate partners, and I used Binance myself from November 2021 to June 2026, when I moved my crypto to Kraken. I moved because of the EU's MiCA rules, not because of security. Binance's response so far is fast and open: a public timeline, a loss estimate within hours and a promise to cover everything. The test is the proof of reserves and a smooth restart of withdrawals. The bigger lesson is not about Binance: even the largest exchange in the world lost about $6 billion from its hot wallets in an evening. Our Binance review now carries a note on the hack.
Binance says yes: it states that user funds are safe and that it will cover all losses from its SAFU emergency fund and company funds. It says it has set aside more than $6.34 billion for this, and about $3 billion of the stolen assets have been frozen by issuers such as Tether and Circle. Your account balance should not change. Binance has promised an updated proof-of-reserves report so outsiders can check that customer assets are fully backed.
Binance paused withdrawals shortly after midnight UTC on October 30, 2026. In its latest updates on October 30 it said it plans to restart withdrawals in phases within about 40 hours, subject to security checks, which points to the weekend of October 31 to November 1. That is a target, not a guarantee, so follow announcements on binance.com and Binance's official X account only.
Blockchain analytics firms TRM Labs and Chainalysis, and investigator ZachXBT, link the attack to North Korea. TRM attributes it with high confidence to TraderTraitor, the North Korean group the FBI also tied to the $1.5 billion Bybit hack in 2025. Binance says it is working with law enforcement, including the FBI, and has not named an attacker itself.
Binance's initial investigation points to a compromised laptop of a DevOps engineer, which gave the attacker access to internal systems used to submit withdrawals from Binance's hot wallets. Binance says it found no evidence that wallet private keys leaked. TRM Labs traced funds leaving hot wallets on ten blockchains within a few hours on October 29, including 18,270 BTC and more than 200,000 ETH.
Do not rush while withdrawals are paused, and ignore anyone who contacts you offering help or compensation: scammers use events like this. When withdrawals reopen, the lesson applies to every exchange, not only Binance: keep on an exchange only what you trade, move long-term savings to a wallet you control, and do not keep everything with one company.
Join The Crypto Edge — our free weekly briefing for sober crypto investors. New subscribers get our DCA ebook. No spam, no hype.
Subscribe free →HomeCryptoInvest is independent — no sponsored rankings, written by an investor who uses his own money. If our coverage saved you time, you can buy us a coffee.
Buy me a coffee →