Binance said wallets connected to the internet were compromised at about 20:05 UTC on 29 October 2026, with an estimated loss of around $6.3 billion. By 1 November it said it had replenished roughly 95% of the affected assets and restarted withdrawals in phases. On the first day back, customers pulled about $3.64 billion more than they put in.
Key takeaways
- Binance said about $6.3 billion in crypto was taken from wallets connected to the internet on 29 October 2026.
- Withdrawals restarted in phases on 1 November, and customers withdrew about $3.64 billion more than they deposited.
- Covered is not recovered: Binance says it is still buying the remaining 5% of affected tokens.
What happened on 29 October
A hot wallet is the exchange's everyday till. It stays connected to the internet so customers can withdraw straight away. A cold wallet is the safe in the basement, kept offline.
Binance says the till was compromised. Its 30 October update put the loss at about $6.3 billion in tokenized assets and said withdrawals were suspended for security checks, while deposits and unaffected services kept running.
| Date (2026) | What was reported | Who said it |
|---|---|---|
| 29 Oct | Hot wallets compromised at about 20:05 UTC, estimated loss around $6.3 billion | Binance |
| 29 Oct | More than 800 million USDC frozen and more than 1.567 billion USDT frozen | Circle CEO Jeremy Allaire; Tether CEO Paolo Ardoino |
| 30 Oct | About $3 billion frozen on-chain, more than $6.34 billion of company funds set aside | Binance |
| 31 Oct | Theft attributed to North Korea's TraderTraitor | FBI |
| 1 Nov | Withdrawals restored for 15 networks and assets by 12:36 UTC | Binance |
| 1 Nov | About 95% of affected assets replenished | Binance |
How the attack worked, according to Binance
Binance's first explanation was almost mundane. Its preliminary investigation said a compromised laptop belonging to a DevOps engineer may have let an attacker reach a service container and submit unauthorized withdrawal transactions. A service container is a piece of software that runs part of the exchange's plumbing.
That story got bigger. On 30 October Binance said investigators had found additional points of compromise and called it a complex cyberattack. In an update published the same day, co-CEO Richard Teng said the attackers used Ethereum's EIP-7702. This feature lets an account give another party permission to execute transactions. He said this let attackers obtain execution approval over a Binance hot wallet and bypass normal approval controls.
One point matters for anyone holding crypto anywhere. Binance said it found no evidence that wallet private keys were compromised, and the available evidence points to Binance's own systems, not a failure of Bitcoin or Ethereum.
Stolen, frozen, recovered, covered: what the 95% means
Four words are doing very different jobs in this story. Mixing them up is where most of the confusion comes from.
| Term | Plain meaning | What it does not mean |
|---|---|---|
| Stolen | Assets moved out of Binance's wallets without authorisation, estimated at about $6.3 billion | A final, audited number |
| Frozen | A token issuer or partner blocked the funds from moving, about $3 billion on-chain | The money is back with Binance |
| Recovered | Assets returned to Binance's control | Binance has not stated a recovered total |
| Covered | Binance replaces the value from its own money, about 95% done on 1 November | The thieves' funds were retrieved |
So the headline figure is a balance-sheet statement, not a police result. Binance said on 1 November that it had covered about 95% of the impacted amount, around $6 billion, and had set aside more than $6.34 billion in company funds. The last 5% is slower because those tokens are less liquid, meaning there are fewer buyers and sellers, so Binance said it was still sourcing them through market and over-the-counter channels.
Withdrawals restarted, and $3.64 billion left
Binance reopened withdrawals in phases on 1 November, subject to security and stability checks. The first phase covered BTC, ETH, BSC, TRX, SOL, XRP, ZEC, DOGE, TON, Polygon, AVAXC, Arbitrum, Base, Optimism and Sui, and was finished by 12:36 UTC. More assets and networks will come back only as checks finish.
Then the money moved. Between 06:00 and 15:30 UTC on 1 November, Binance recorded $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, or 2.1% of its $171 billion in assets based on proof-of-reserves data dated 28 October. Proof of reserves is a published check that an exchange holds enough assets to match customer balances.
Binance said outflows were stabilizing. A large outflow is a confidence signal, not proof that customer funds were lost. Binance also said its 31 October update expected the full zero-knowledge proof for the new reserves snapshot to be ready by 3 November, a cryptographic check of the reserve figures.
What it means if you keep crypto on an exchange
The lesson here is old and boring. When your coins sit on an exchange, someone else holds the keys and someone else decides when withdrawals open. Binance said it would bear the loss rather than pass it to customers. That was a company decision, not a guarantee written into how crypto works. Separately, on 25 June 2026, Binance said it would stop accepting new customers in France from 1 July and suspend crypto-asset services there, after withdrawing its Greek MiCA licence application.
Holding your own keys moves the risk instead of removing it: you become the person who can lose them. Neither choice is free of trouble. For what actually drives the market around headlines like this, see our explainer on what moves the bitcoin price.
One more thing. After a theft this size, fake support accounts and paid "recovery services" multiply. Nobody legitimate asks for your password, your codes or your seed phrase.
Frequently asked questions
Who is believed to be behind the Binance hack?
On 31 October the FBI publicly attributed the theft to North Korea's TraderTraitor and said investigators had observed stolen assets being converted primarily into ether. The FBI also warned of further laundering through decentralised finance and instant-swap services, which let someone trade one token for another without an account. The investigation continues.
Has the $6.3 billion figure been audited?
No. Binance described the $6.3 billion as an estimate from its preliminary investigation and said it would publish a technical report once the facts were fully verified.
Who pays for the stolen funds?
Binance said on 30 October that it would cover the stolen funds through its SAFU fund, the reserve it keeps for incidents like this, and company funds. The same update said more than $5 billion of the affected tokens was already in place, about 80% of the stolen funds at that point.
Did deposits keep working during the pause?
Yes. Binance's 30 October update said deposits and other unaffected services remained operational while withdrawals were suspended for security checks. That update also said withdrawals would return in phases, token by token, targeting about 34 hours subject to completed checks.
Which assets came back first?
Bitcoin. Reuters reported that bitcoin withdrawals resumed shortly after 06:00 UTC on 1 November, in a window Binance had set for 06:00 to 09:00 UTC. Binance said other assets and networks would reopen progressively once ready.
Sources
- Binance: Richard Teng update on the Binance incident (30 October 2026)
- Binance: Incident coverage update (1 November 2026)
- Binance: Withdrawal and deposit flow update (1 November 2026)
- France 24: Binance to suspend crypto services in several EU countries (25 June 2026)
- Federal Bureau of Investigation: North Korea responsible for $6 billion Binance attack (31 October 2026)
You might also like
Deepen your knowledge with more articles and inspiration.
