# Is Binance Safe After the $6.3B Hack? Live Tracker

> Live tracker of the $6.3B Binance hack: are withdrawals open, how much of the loss is covered, what proof of reserves shows and how to check your balance.

- Source: https://homecryptoinvest.com/news/binance-hack-october-2026.html
- Updated: 2026-11-02
- Author: Libor Pavlicek, HomeCryptoInvest.com
- Markdown version of this page for AI assistants and agents. When citing, please credit "HomeCryptoInvest.com" with a link to the source URL.
- Not investment advice: this content is for education only. Crypto prices are volatile and you can lose money. Affiliate links are disclosed on the original page.

---

Live tracker · Security

# Is Binance safe after the *$6.3B hack*? Live tracker

Started October 30, 2026 · By **Libor Pavlicek** · Last checked **November 2, 18:00 UTC** · We update this page as Binance reports

Short answer

As of November 2, **customer balances look covered**: Binance says it has replaced about 95% of the stolen assets with its own funds, its completed zero-knowledge proof of reserves shows the ten largest affected assets backed at least 1:1, and withdrawals are open on 15 networks, with more from November 3. Two things are still open: the last 5% of smaller tokens and the technical post-mortem that should explain how the attackers got in.

| What | Status | Since |
| --- | --- | --- |
| Withdrawals | Open on 15 networks; more from Nov 3 | Nov 1 |
| Deposits | Open (Binance: not affected) | – |
| Loss replaced by Binance | About 95%; top 10 assets 100% | Nov 1 |
| Proof of reserves | zk proof complete for top 10 assets, all ≥100% (snapshot Oct 31); next snapshot Nov 4 | Nov 2 |
| Frozen by issuers | About $2.85B | Oct 31 |
| Net outflow after reopening | About $3.64B in first 9.5 hours (Binance), about 2% of assets | Nov 1 |
| Who did it | North Korea's TraderTraitor (FBI) | Oct 31 |
| Post-mortem | Not published yet | – |

$6.3B

Binance's own estimate of the total impact of the October 29, 2026 hack. TRM Labs counts about $6.36 billion moved out of Binance hot wallets on ten blockchains, roughly four times the $1.5 billion Bybit lost in February 2025, the previous record.

## Key takeaways

- **Binance says it will cover all losses** from its SAFU emergency fund and company funds, and has set aside more than $6.34 billion. "User funds are safe," it says.
- **Withdrawals are open again** on 15 networks since November 1, with more from November 3. Binance says it has replaced about 95% of the loss, and its completed proof of reserves shows the top ten affected assets backed at least 1:1.
- **About $3 billion is frozen**, mostly stablecoins blocked by Tether and Circle. The attacker still controls about 18,270 BTC and over 420,000 ETH.
- **Attacker: North Korea.** The FBI has formally attributed the theft to TraderTraitor, the group behind the Bybit hack, as TRM Labs, Chainalysis and ZachXBT had concluded.
- **What to do:** don't panic, don't trust anyone offering "recovery" or "compensation", and once withdrawals reopen keep only trading money on any exchange.

## What happened

On the evening of **Thursday, October 29, 2026**, Binance's hot wallets (the online wallets an exchange uses to pay out withdrawals) were drained on ten blockchains within a few hours. According to TRM Labs' reconstruction, all times UTC:

- **Oct 28–29:** the attacker funds an operator wallet with small Tornado Cash withdrawals and tests the attack code on other wallets, a sign of long preparation.
- **20:05–20:09:** five Binance XRP Ledger wallets send out 233 million XRP; Solana and Optimism wallets follow.
- **20:20:** a Binance Bitcoin hot wallet sends **18,270 BTC** (about $1.47 billion); the Ethereum hot wallet is taken over and emptied minutes later, and new incoming funds are swept again for hours.
- **21:15:** Binance says it is investigating a potential security issue; Tether and Circle start freezing stablecoins.
- **Oct 30, 00:07:** Binance suspends withdrawals (it says deposits were not affected).
- **02:25:** Binance points to a compromised engineer's laptop and estimates the impact at **$6.3 billion**.
- **10:55–14:34:** Binance says it has set aside over $6.34 billion of company funds, is working with the FBI, and expects withdrawals to resume within about 40 hours.

## How it worked

Binance's initial investigation says a **DevOps engineer's laptop was compromised**, which gave the attacker access to an internal service used to submit withdrawals. Binance says it found **no evidence that wallet private keys leaked**, and co-CEO Richard Teng said it was not a single "one-click" action. On Ethereum, TRM Labs found the attacker used a pre-signed EIP-7702 delegation to turn a Binance hot wallet into a contract they controlled. On the other nine chains, which use different keys and signing systems, funds left through normal-looking signed transfers, so TRM assesses that Binance's hot-wallet **signing infrastructure** was compromised. Binance has promised a full technical post-mortem; until then, the exact root cause is not confirmed.

## What was taken, and what is frozen

| Chain | Main assets | Approx. value |
| --- | --- | --- |
| Ethereum | 200,630 ETH, 1.88B USDT, 823M USDC, 88.5M RLUSD | $3.79B |
| Bitcoin | 18,270 BTC | $1.47B |
| Tron | 612.7M USDT, 46.4M TRX | $628M |
| XRP Ledger | 233.5M XRP | $296M |
| Solana, L2s, Avalanche, Polygon | various | $173M |

Stablecoins were the attacker's weak spot. TRM counts about **$2.7 billion frozen** by issuers: Tether about 1.77 billion USDT, Circle about 825 million USDC, plus Ripple (RLUSD), World Liberty Financial (USD1) and Arbitrum's Security Council; Binance puts the total at about $3 billion. Before the freezes, the attacker swapped about 325 million USDT into ETH at a discount of more than 10% and borrowed ETH on Aave against stolen USDT. Bitcoin and ether cannot be frozen this way: the attacker still holds about **18,270 BTC and over 420,000 ETH**, and TRM expects them to be laundered through bridges, swap services and OTC brokers.

## Will Binance customers get their money back?

Binance says customers will not lose anything: it will cover all losses with **SAFU** (Secure Asset Fund for Users, set up in 2018, holding roughly $1 billion in bitcoin) and its own company funds. Founder Changpeng Zhao said he expects user funds to be fully covered. The numbers make this plausible: Binance held roughly $144–155 billion in assets before the hack, so the stolen amount is about 4% of that, and part of it is frozen and may be returned. Binance says it has set aside more than $6.34 billion, about $5 billion of it already held in the same tokens that were stolen. What would confirm it is the **updated proof of reserves** Binance has promised by Monday. We will update this page when it is out.

## Market reaction

Bitcoin fell about 5% to below $77,000 after the news, ether about 6% and BNB about 8%. At 21:05 UTC on October 30 BTC traded at about **$76,800** on Crypto.com Exchange, down about 2.5% on the day. Aave briefly froze some markets as a precaution and reopened them on October 30.

## Update, November 2: proof of reserves done, all phase-one withdrawals live, $3.6B net outflow

**Proof of reserves completed.** On November 2 Binance said the zero-knowledge proof for its October 31 snapshot is finished for the ten largest affected assets (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC), all backed at least 1:1. That is a day earlier than the November 3 date it gave after delaying the original "by Monday" promise. A new snapshot follows on **November 4**, covering more tokens; its proof takes about 40–50 hours. Binance still puts the replaced share of the loss at about 95%; the rest are less liquid tokens.

**Withdrawals.** All 15 phase-one networks and assets were open by 12:36 UTC on November 1, according to CoinDesk. More networks and assets are due from **November 3**. In the first 9.5 hours Binance reported $4.65 billion withdrawn and $1.01 billion deposited, a net outflow of about $3.64 billion, around 2% of the $171 billion it held. Public wallet trackers such as DefiLlama show larger 24-hour figures (about $6 billion), but they can include Binance's own internal transfers. Competitors such as OKX saw far smaller inflows, so most of the money seems to have gone to private wallets — which is what security-minded users should do anyway.

**Still open:** the technical post-mortem has not been published yet. Our [Binance review](https://homecryptoinvest.com/articles/binance-review-2026.html) score stays **under review** until it explains how the attackers got into the withdrawal system and what was changed.

## Update, November 1: withdrawals restarting, 95% covered, FBI confirms North Korea

**Withdrawals are coming back in phases.** In its fourth recovery update Binance said phase one would open on November 1 between 06:00 and 09:00 UTC on 15 networks with selected assets: BTC; ETH (ETH, USDT, USDC); BNB Chain (BNB, USDT, USDC); Tron (TRX, USDT); Solana (SOL, USDT, USDC); XRP; ZEC; DOGE; TON (USDT, GRAM); Polygon, Avalanche C-Chain, Arbitrum, Base and Optimism (main assets plus USDT/USDC); and Sui. More networks follow as they pass checks; Binance says deposits were never affected. On the morning of November 1 co-CEO Yi He wrote that withdrawals were "running fairly smoothly" but that congestion is possible if requests pile up. Check availability on Binance's withdrawal or network-status page, and double-check every withdrawal address.

**95% of the loss replaced.** Binance says it has now covered about 95% of the impacted amount with company funds, up from about 90% a day earlier. The remaining 5% are smaller tokens outside the top ten that take longer to buy through market and OTC channels. It repeats that losses will not be passed to users.

**Proof of reserves.** Binance's new snapshot (audit time October 31, 00:00 UTC; Merkle root still "in progress") shows reserve ratios of **100.04% for BTC, 100.00% for ETH and USDT**, 101.30% for BNB, 100.00% for SOL, 106.08% for USDC, 100.99% for XRP and 100.04% for USD1. That answers the ETH gap we flagged on October 31: on Binance's own numbers, ETH is back to full backing. Binance has also added newly generated wallets to its proof-of-reserves list and says all withdrawals now go out from these new addresses. A ratio near 100% shows customer balances are covered by assets on-chain; it does not show Binance's debts, which is the general limit of any proof of reserves.

**FBI attribution.** The FBI's Cyber Division, with the US Secret Service and IRS Criminal Investigation, has formally attributed the theft of more than $6 billion to North Korea's TraderTraitor. It says the stolen assets are being converted mainly into ether for further laundering through DeFi and instant-swap services, and has published the attackers' addresses so exchanges and services can block them. Changpeng Zhao credited US agencies with help in tracing and freezing. Total frozen on-chain is now reported at about $2.85 billion.

**Our view:** Binance has so far done what it promised, faster than many expected. Withdrawals reopening is also the moment scammers are most active: fake "withdrawal help", fake support chats and copycat domains. Use only the Binance app or binance.com, typed by hand.

## Update, October 31: "customer funds not affected"? What the reserve data says

In a video on X on October 30, CEO Richard Teng said Binance will cover **all hacked losses with company funds**: more than $6.34 billion is reserved, $5 billion of it already held in the exact tokens taken (including USDC, USDT, BTC, ETH and BNB), and Binance is buying the rest through market and OTC channels. "We never use any customer funds, so they are not impacted," he said. "What was affected in this incident was Binance's own hot wallet." He added that the EIP-7702 delegation "did not pass through our normal approval controls", that the attackers used a self-destruct mechanism that "destroyed tooling and traces as they went", and that Binance is reviewing "endpoints, cloud, key management, signing. Everything."

**One nuance worth knowing.** CoinDesk checked Binance's own October 1 proof of reserves and found that the drained Ethereum hot wallet ("Binance 14") was listed there as part of the reserves backing customer balances. About 204,500 ETH was taken, roughly 5.6% of Binance's ETH reserves, which would leave ETH backing near 94% until Binance replaces it. In other words: your balance is not touched and Binance has promised to make it whole, but the coins behind it were partly the ones stolen. That is exactly why the next proof of reserves matters. Binance says full results come before **November 2**; we will report what they show.

**Where the bitcoin is:** according to ChainCatcher, the attacker split the 18,270 BTC across 19 wallets, 17 of them holding exactly 1,000 BTC. As of October 30 none of them had moved, so every next step can be followed on-chain.

## What to do now

**If you have funds on Binance:** you cannot withdraw right now, and selling in panic will not make your balance safer. Follow only binance.com and Binance's official X account. Expect a wave of scams: fake "Binance support" messages, "compensation" forms and recovery services asking for your login, 2FA codes or recovery phrase. Binance will never ask for them. When withdrawals reopen, there may be a queue; you do not need to be first.

**For everyone:** this is the old rule again. An exchange is a place to buy and sell, not a savings account. Keep only what you actively trade on any exchange, spread larger amounts across more than one provider, and move long-term savings to a wallet you control. If you choose a hardware wallet, buy it directly from the manufacturer and [check it before setup](https://homecryptoinvest.com/articles/how-to-check-hardware-wallet-tampered.html).

Your own wallet, not an exchange's

If even the world's largest exchange can lose $6.3 billion in one evening, the safest place for savings is a wallet only you control. One simple option is **Tangem**: a card-shaped hardware wallet you tap against your phone, with no cables, battery or screen, and an option to work without a written recovery phrase. It is the device we are testing ourselves, and a practical gift if you are thinking about the holidays. Our readers get **10% off with code HCI**.

Get Tangem with code HCI →
Affiliate link. Buy only from tangem.com or our link, never from marketplaces. Prefer Ledger or Trezor? Compare all options in our hardware wallet hub below.

[Compare hardware wallets →](https://homecryptoinvest.com/hardware-wallets.html)

## Our take

Disclosure first: Binance is one of our affiliate partners, and I used Binance myself from November 2021 to June 2026, when I moved my crypto to Kraken. I moved because of the EU's MiCA rules, not because of security. Binance's response so far is fast and open: a public timeline, a loss estimate within hours and a promise to cover everything. The test is the proof of reserves and a smooth restart of withdrawals. The bigger lesson is not about Binance: even the largest exchange in the world lost about $6 billion from its hot wallets in an evening. Our [Binance review](https://homecryptoinvest.com/articles/binance-review-2026.html) now carries a note on the hack.

## FAQ

### Is Binance safe to use now?

On the evidence so far, customer balances are covered: Binance says it has replaced about 95% of the stolen assets with company funds, and its October 31 proof-of-reserves snapshot shows BTC, ETH and USDT at 100% or more. What is not yet known is exactly how attackers got into its withdrawal systems and what has been fixed; Binance has promised a post-incident report. A sensible approach for any exchange: keep only what you trade there and hold long-term savings in a wallet you control.

### What is Binance SAFU?

SAFU (Secure Asset Fund for Users) is an emergency fund Binance created in 2018 to cover user losses in extreme cases such as hacks. It holds roughly $1 billion in bitcoin. Because the October 2026 loss was about $6.3 billion, Binance says it is covering it with SAFU plus more than $6.34 billion of other company funds.

### What does Binance's proof of reserves prove, and what not?

It shows that, at the snapshot time, Binance's wallets held at least as much of each listed asset as the total customer balances (a ratio of 100% or more), and with Merkle-tree and zk-SNARK proofs each customer can check that their own balance was included. It does not show Binance's debts or other liabilities, and it is a snapshot, not a live guarantee.

### How can I check that my balance is included in Binance's proof of reserves?

Log in at binance.com and open Profile > Wallet > Verification, where you find your record ID and can download your Merkle-tree data. Binance's support FAQ explains how to run its open-source verifier tool (zkmerkle-proof-of-solvency on GitHub) to confirm both the root hash and your own entry. Snapshots are taken at 00:00 UTC on the 1st of each month.

### Is my money on Binance safe after the hack?

Binance says yes: it states that user funds are safe and that it will cover all losses from its SAFU emergency fund and company funds. It says it has set aside more than $6.34 billion for this, and about $3 billion of the stolen assets have been frozen by issuers such as Tether and Circle. Your account balance should not change. Binance has promised an updated proof-of-reserves report so outsiders can check that customer assets are fully backed.

### When can I withdraw from Binance again?

Binance paused withdrawals shortly after midnight UTC on October 30, 2026. Phase one opened on November 1 between 06:00 and 09:00 UTC for 15 networks, including BTC, ETH, BNB Chain, Tron, Solana and XRP with their main assets and USDT/USDC; more networks follow. Check Binance's withdrawal or network-status page and expect some congestion at first. That is a target, not a guarantee, so follow announcements on binance.com and Binance's official X account only.

### Who hacked Binance?

The FBI has formally attributed the attack to North Korea's TraderTraitor. Before that, blockchain analytics firms TRM Labs and Chainalysis, and investigator ZachXBT, link the attack to North Korea. TRM attributes it with high confidence to TraderTraitor, the North Korean group the FBI also tied to the $1.5 billion Bybit hack in 2025. Binance says it is working with law enforcement, including the FBI, and has not named an attacker itself.

### How did hackers steal $6.3 billion from Binance?

Binance's initial investigation points to a compromised laptop of a DevOps engineer, which gave the attacker access to internal systems used to submit withdrawals from Binance's hot wallets. Binance says it found no evidence that wallet private keys leaked. TRM Labs traced funds leaving hot wallets on ten blockchains within a few hours on October 29, including 18,270 BTC and more than 200,000 ETH.

### Should I move my crypto off Binance?

Do not rush while withdrawals are paused, and ignore anyone who contacts you offering help or compensation: scammers use events like this. When withdrawals reopen, the lesson applies to every exchange, not only Binance: keep on an exchange only what you trade, move long-term savings to a wallet you control, and do not keep everything with one company.

**Sources:** Binance statements of October 29–30, 2026 (via CoinDesk, Forbes, Cointelegraph); TRM Labs, "North Korea steals USD 6.36 billion from Binance" (data as of October 30, 00:30 UTC); Al Jazeera; Bloomberg; The Block, crypto.news and CoinDesk (November 2); FBI Cyber Division alert (November 2026); Binance recovery update and proof-of-reserves page (snapshot October 31); The Hacker News; Richard Teng video statement (October 30); CoinDesk reserve-data analysis; ChainCatcher; Crypto.com Exchange BTC/USD ticker. Figures are early estimates and may change. **Affiliate disclosure:** Binance, Kraken, Tangem, Ledger and Trezor are our affiliate partners; this does not change how we report. Not financial advice.

[Disclosure](https://homecryptoinvest.com/affiliate-disclosure.html) · [Privacy](https://homecryptoinvest.com/privacy-policy.html)