Binance Hack 2026: What Happened, Who Did It and Is Your Money Safe?

Last updated: November 6, 2026. By Veer. Facts checked against Binance’s official updates on X, the FBI’s October 31 alert, on-chain analysis from TRM Labs and Chainalysis, and reporting by CNBC, the BBC, Reuters and CoinDesk. This is a researched explainer, and we’ll update it as withdrawals reopen and Binance publishes its post-mortem.

Update, November 3, 2026: Binance says it has completed the zero-knowledge proof of reserves for its October 31 snapshot, so holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC can now check for themselves that their balances are backed 1:1. In its November 2 recovery update, Binance repeated that it has replenished about 95% of the stolen assets with its own funds, with the rest in less-liquid tokens it’s still buying. It plans another reserves snapshot on Wednesday, November 4, and co-CEO Yi He said the full proof takes about 40 to 50 hours to generate after a snapshot. Binance also said it expects to start restoring withdrawals for more networks and assets on Tuesday, November 3 (The Block).

Update, November 6, 2026: In Recovery Update #7 (November 4, 2026), Binance said it has replenished about 98% of the impacted amount and is still buying the remaining ~2% of less-liquid tokens through market and OTC channels. It also took a new Proof of Reserves snapshot at 2026-11-04 00:00 UTC covering 44 tokens (up from 10), with the zero-knowledge proof expected to take about 50–60 hours to generate. Users holding covered tokens will then be able to verify 1:1 backing on Binance’s PoR site.

What happened in the Binance hack?

On Thursday, October 29, 2026, an attacker drained Binance hot wallets on ten blockchains, starting at 20:05 UTC (4:05 p.m. ET). Blockchain analytics firm TRM Labs says about $6.36 billion left Binance wallets, “most of it in about 20 minutes.” Chainalysis puts the total at about $6.4 billion. Binance itself uses “around $6.3B.”

A hot wallet is a crypto wallet that stays connected to the internet so an exchange can process customer withdrawals quickly. Exchanges keep most customer funds in offline “cold” storage, but hot wallets at the world’s largest exchange still held billions.

According to TRM Labs, the theft started on the XRP Ledger, where five Binance wallets sent 233.46 million XRP to one attacker address between 20:05 and 20:09 UTC. Solana and Optimism followed. At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to the attacker, and within two minutes a Tron hot wallet sent 612.7 million USDT. A second wave around 23:05 UTC hit Binance wallets on Avalanche and Polygon.

Binance’s first public statement came at 21:29 UTC: “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.” Hours later the exchange paused deposits and withdrawals and promised: “Binance will cover all losses.”

How much was stolen in the Binance hack, and from which blockchains?

About $6.36 billion across ten blockchains, by TRM Labs’ count, valued at the moment each transfer happened. Ethereum accounts for the biggest share, about $3.79 billion, followed by Bitcoin at about $1.47 billion. At prices on October 30, TRM says the same assets were worth about $6.23 billion.

Source: TRM Labs, October 29–30, 2026. Figures reflect on-chain data as of October 30, 00:30 UTC.

For scale, TRM says the Binance theft is “about four times the USD 1.5 billion Bybit hack of February 2025,” which was the previous record. In a separate October 30 report, TRM says crypto hacks have produced $8.7 billion in losses in 2026 so far, the highest on record, and that North Korea accounts for 85% of that.

Who hacked Binance?

The FBI says North Korea did it, through the hacking operation it calls TraderTraitor. In an alert dated October 31, 2026, the FBI said North Korea “was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.”

TraderTraitor is a North Korean state-backed hacking unit that targets crypto exchanges and their staff. US officials and analysts generally place it within the wider Lazarus Group. The FBI also blamed TraderTraitor for the $1.5 billion Bybit theft in 2025.

The FBI’s attribution followed two private-sector assessments:

• TRM Labs attributed the attack to TraderTraitor on October 29 “with high confidence.” TRM pointed to small Tornado Cash withdrawals funding an operator wallet, staging that began “at least 36 hours before the theft,” and signatures prepared in advance, all features it saw in the Bybit and April 2026 KelpDAO thefts.
• Chainalysis reached the same conclusion early on October 30 after watching funds stolen from Binance mix on-chain with funds from last month’s Bitget theft, which had been attributed to North Korea.

The FBI, working with the US Secret Service and IRS Criminal Investigation, said the hackers are converting stolen assets “primarily into Ethereum (ETH)” and listed the addresses involved. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address in the notice. Chainalysis CEO Jonathan Levin told CoinDesk he expects the number of laundering addresses to grow to “tens of thousands over the coming weeks.”

How did hackers get into Binance?

Binance hasn’t published a root cause yet. Its first explanation, on October 30, was that the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Binance said it found “no evidence of any wallet private key leak.”

Later the same day Binance said its investigation “has uncovered additional points of breach” and called it “a complex attack.” Co-CEO Richard Teng told reporters the breach involved a compromised laptop and malicious software designed to delete evidence of its activity, according to Reuters. The BBC quotes Teng saying the attackers used a “self-destruct mechanism.”

The on-chain evidence points in the same direction. TRM Labs found that on Ethereum, the attacker used EIP-7702, a feature added in Ethereum’s May 2025 Pectra upgrade that lets an ordinary wallet hand control to a smart contract by signing an authorization. The attacker submitted 50 pre-signed authorizations from a Binance hot wallet, one for each of the next 50 transaction numbers, so one would still be valid when it went through. That turned the wallet into a sweeper only the attacker could command. Three minutes and 24 seconds later, it sent out 167,464 ETH and 1.615 billion USDT in a single transaction.

Wallets on the other nine chains simply signed normal transfers to the attacker. “These wallets use different chains, key types and signing schemes,” TRM wrote. “In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains.”

That matches TRM’s wider finding about North Korea’s methods. Fake recruiters or investors persuade an employee to run a “coding test,” the test installs malware, and the malware leads to the systems that sign transactions. TRM calls the sequence “Code to Custody.” Binance hasn’t confirmed how its engineer’s laptop was compromised.

How much of the stolen crypto has been frozen?

About $2.7 billion was frozen within hours, roughly 42% of the total. Stablecoin issuers can freeze tokens they issue, and they acted fast. Bitcoin and Ether have no issuer, so once the attacker swapped stablecoins into them, nobody could freeze them.

Source: TRM Labs. Binance has since described “~$3 billion frozen on-chain,” and CNBC uses the same figure.

The attacker raced the freezes. Chainalysis says it swapped $325 million in stablecoins for $285 million in ETH in about 20 minutes, taking a big loss to get assets that can’t be frozen. TRM says another wallet put 60 million USDT into the lending protocol Aave and borrowed about 19,760 ETH against it, and Aave then froze the affected markets. As of October 30, TRM says the attacker still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

Is my money safe on Binance?

Binance says yes: it will cover all customer losses from its own funds, and users won’t bear the cost. “Binance will absorb the financial impact of these stolen funds, not our users,” the exchange said in its October 31 update, as reported by CNBC.

Here’s where the promise stands as of November 1, 2026:

• Money set aside: Binance said on October 30 that it had reserved more than $6.34 billion of company funds to cover the losses.
• Tokens replenished: On October 31, Binance said it had replaced about 90% of the stolen tokens, and that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were “fully backed 100%.” In its November 1 update, Binance put the figure at about 95%, and Recovery Update #7 (November 4) put it at about 98%, according to TechFlow’s summary of the announcement. The rest is “less liquid” smaller tokens that it’s still buying.
• Where the money comes from: Part of Binance’s Secure Asset Fund for Users (SAFU), an emergency reserve set up in 2018, plus surplus from its futures insurance fund and its corporate treasury. Binance said on October 31 that the SAFU transfer, a 7,499 BTC transaction (about $581 million, per Whale Alert), was complete.
• Proof it holds your balance: Binance took a new proof-of-reserves snapshot at 00:00 UTC on October 31, and on November 2 it said the full zero-knowledge proof for that snapshot was complete. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC can now check their own balance is backed 1:1. A broader snapshot is planned for November 4, with the proof expected about 40 to 50 hours later (The Block).

One important nuance from CNBC: “restored backing for about 90%” does not mean Binance recovered 90% of the funds from the attacker. Binance replaced them with its own money. Most of the stolen crypto that wasn’t frozen is still with the hackers.

A promise from an exchange is not the same as a deposit guarantee. Crypto held on an exchange isn’t covered by the FDIC in the US or the FSCS in the UK, so you’re relying on Binance’s balance sheet. That’s worth remembering whatever you decide to do next.

When will Binance withdrawals resume?

Binance says withdrawals start reopening in phases on Sunday, November 1, 2026, with the first window from 06:00 to 09:00 UTC. That’s 6–9 a.m. in the UK and the early hours of Sunday morning on the US East Coast. The exchange announced the timing in “Recovery Update #4” at 04:11 UTC on November 1.

According to TokenPost and TechFlow, the first phase covers BTC, ETH, BNB, TRX, SOL, XRP, ZEC, DOGE, TON, POL, AVAX, ARB, BASE, OP and SUI. Other assets and networks will follow “as they are ready,” in an order Binance says is based on user demand over the past week. Binance warns that heavy traffic at the start may cause delays or failed withdrawals. If yours fails, try again later.

Deposits were paused briefly on October 29–30, but Binance clarified on October 30 that “deposits remain unaffected and continue to operate as normal.” Binance says its other unaffected services stayed open.

Is Binance.US affected by the hack?

No. Binance.US says it was not affected. Binance.US, the separate exchange that serves US residents, posted on X on October 30 that it is independently operated and that customer funds and services “are secure and operating normally,” PANews reported. The BBC also reports that the hack hit Binance’s global exchange, Binance.com, and that Binance.US “said it has not been affected.”

If you’re in the US and use the Binance.US app, your account is on that separate platform. If you’re in the UK or elsewhere and use Binance.com, you’re on the exchange that was hit, but Binance says your balance is covered.

What should Binance users do now?

Don’t panic-sell, don’t move funds because a message tells you to, and lock down your own account. Binance says no customer action is needed to be made whole. The bigger risk for ordinary users is scammers exploiting the news.

1. Check your balance only in the official Binance app or a bookmarked binance.com. The BBC notes experts recommend doing this “through the official app and website.” Don’t follow links in emails, texts or DMs.
2. Treat every “your funds are at risk” message as a scam. NordVPN CTO Marijus Briedis told the BBC to watch for “an email claiming your funds are at risk,” “a fake support account offering help” or “a message urging you to move your cryptocurrency to a ‘safe’ wallet.”
3. Never share codes or recovery phrases. “Never give anyone your password, verification codes or wallet recovery phrase,” Briedis said. No real support agent will ask for them.
4. Upgrade your two-factor authentication. If you still use SMS codes, switch to an authenticator app or a passkey. Our guide to whether SMS 2FA is safe explains why.
5. Expect delays when withdrawals reopen. Binance says early withdrawals may fail under heavy load. Retry later rather than contacting “support” accounts that reach out to you first.
6. Think about self-custody for long-term holdings. A hardware wallet you control isn’t exposed to an exchange’s hot wallets. It brings its own risks, as the Ledger reseller hack showed, so buy only from the manufacturer.
7. Keep your phone patched. Crypto scams often start with a compromised phone. Install security updates promptly (our iOS 26.7.1 security update guide covers older iPhones) and learn the signs your phone is hacked.

If you’ve been targeted by a scam tied to the hack, US readers can report it to the FBI’s Internet Crime Complaint Center at ic3.gov, which the FBI’s alert also points to for tips. UK readers can report fraud through the national fraud reporting service run by the City of London Police.

Binance hack timeline

The theft took minutes; the fallout has run for days. Times are UTC.

Sources: TRM Labs, Chainalysis, Binance on X, FBI, CNBC, CryptoWatchDesk, TokenPost, TechFlow.

What does the Binance hack mean for crypto?

It shows that even the biggest exchange can lose billions if attackers reach the people and systems that sign transactions. No smart-contract bug was involved. TRM says that since 2022, about 76% of the value North Korea stole came from attacks on keys, servers and signing systems, and 88% once Binance is included.

It also showed how much stablecoin issuers can do. About $2.7 billion was frozen because Tether, Circle and others acted within minutes to hours. “While that does not diminish the scale of the theft, the response shows an industry increasingly able to act quickly,” Chainalysis wrote.

Expect more scrutiny. Jennifer Craven, a fraud expert at law firm Pinsent Masons, told the BBC that “regulators will inevitably ask what that means for smaller, less mature platforms and currencies.” CryptoWatchDesk reports that the theft has already fed the push for new US exchange rules in Washington.

FAQ

What happened in the Binance hack?

On October 29, 2026, an attacker moved about $6.3 billion out of Binance hot wallets on ten blockchains, most of it in about 20 minutes. It is the largest crypto theft on record, about four times the 2025 Bybit hack.

Who was behind the Binance hack?

The FBI said on October 31, 2026 that North Korea was responsible, through the hacking operation it calls TraderTraitor. TRM Labs and Chainalysis had reached the same conclusion from on-chain evidence.

Will Binance users lose money?

Binance says no. It has pledged to cover all losses from its SAFU emergency fund, its futures insurance fund and company money. It said it had replenished about 90% of stolen tokens on October 31, about 95% by early November, and about 98% in Recovery Update #7 on November 4, with the remaining ~2% still being acquired.

When can I withdraw from Binance again?

Binance says withdrawals reopen in phases starting November 1, 2026, with the first window from 06:00 to 09:00 UTC for BTC, ETH, BNB, SOL, XRP and other major assets. Other tokens and networks follow later, and early withdrawals may be delayed.

Was Binance.US hacked?

No. Binance.US, the separate exchange for US residents, said on October 30 that it was not affected and that customer funds and services were operating normally.

How much of the stolen crypto was recovered?

About $2.7 billion in stablecoins and tokens was frozen within hours, and Binance now cites about $3 billion. The attacker still controlled about $2.4 billion in ETH and BTC as of October 30, which can’t be frozen by an issuer.

Should I move my crypto off Binance?

That’s your call, but don’t do it because a message tells you to. If you move funds, start the transfer yourself in the official app, expect delays while withdrawals reopen, and consider a hardware wallet bought directly from the manufacturer.

Sources: Binance on X, FBI alert (Oct 31, 2026), TRM Labs (Oct 29–30), TRM Labs North Korea report (Oct 30), Chainalysis (Oct 30), CNBC (Oct 29), CNBC (Oct 31), BBC, CoinDesk (Oct 31), Reuters via Arab News (Oct 31), CryptoWatchDesk (Oct 31), TokenPost (Nov 1), TechFlow (Nov 1), PANews (Oct 30).