Binance Hack: Everything We Know About the $6.3B Theft

12h ago•

bullish:

bearish:

Binance Hack: Everything We Know About the $6.3B Theft

On October 29, 2026, attackers took about $6.3 billion in crypto from Binance hot wallets. It is the largest crypto theft on record, and the FBI says North Korea did it. Binance reopened withdrawals on November 1 for 15 networks and says it has replaced about 95% of the stolen assets with its own money. Below are the full timeline, where the money is now, and what users should do.

Key Facts

Question	Answer
When	October 29, 2026, from about 20:05 UTC
Amount	About $6.3 billion (Binance estimate)
What was hit	Binance hot wallets on ten blockchains
Who	North Korea’s TraderTraitor group, per the FBI
Frozen	About $3 billion, mostly USDT and USDC
User losses	Binance says users will not lose funds
Coverage	About 95% of stolen assets replaced (November 1, 04:11 UTC)
Withdrawals	Restarted November 1 at 06:00 UTC, 15 networks open by 12:36 UTC
Proof of Reserves	Snapshot taken October 31, 00:00 UTC; full proof still pending
Post-mortem	Not published yet

Full Timeline

StealthEX graphic. Data: Binance, FBI, TRM Labs, US Secret Service

October 29

~20:05. Funds start leaving Binance wallets on ten chains, according to TRM Labs.
20:24. One Ethereum transaction drains the hot wallet “Binance 14”, including about 1.6 billion USDT.
21:01–22:10. Tether, Circle, Ripple, and World Liberty Financial freeze stolen stablecoins.
21:24. Binance says it is aware of “a potential security issue”.

October 30

00:13. Binance pauses deposits and withdrawals and promises to cover all losses.
02:25. Binance shares first findings: a compromised DevOps laptop and a loss of about $6.3 billion.
04:36. Deposits work again. Withdrawals stay paused.
08:47. Binance reports “additional points of breach”.
19:58. Recovery Update #2: over $6.34 billion set aside, about 80% covered.

October 31

00:00. Binance takes a new Proof of Reserves snapshot.
14:30. Update #3: 90% covered. Ten major tokens are fully backed.
16:15. Binance confirms a 7,499 BTC transfer from its SAFU fund.
22:36. The FBI names North Korea as responsible.

November 1

04:11. Update #4: 95% covered. Withdrawals will restart in phases.
06:00. Phase one of withdrawals begins. Bitcoin opens first.
06:53. Binance adds new wallet addresses to its Proof of Reserves list. All withdrawals now come from these new wallets.
12:36. All 15 networks in phase one are open.
16:12. Binance publishes its first withdrawal figures.
18:11. The US Secret Service says it froze “a significant portion” of the funds within minutes.

How Did the Attack Happen?

Binance’s first security update said the attack may have started with a compromised DevOps engineer’s laptop. That gave the attacker access to a service container, where they sent unauthorized withdrawals. Binance says it found no sign that wallet private keys leaked.

Source: Binance on X, October 30, 2026

At 08:47 UTC on October 30, Binance said it had found “additional points of breach”. It has not shared those details yet.

On Ethereum, the attacker used EIP-7702. This feature lets a normal wallet run smart contract code after the wallet signs a permission. The Binance 14 wallet signed that permission, and one call then sent its funds out. On the other chains, Binance wallets sent funds through normal signed transfers.

How Much Was Stolen and Where Are the Funds Now?

TRM Labs counts about $6.36 billion taken. About $3.79 billion was on Ethereum, $1.47 billion was in BTC (18,270 BTC), and the rest was spread over eight other chains.

StealthEX graphic. Data: Binance, TRM Labs

Frozen

Stablecoin issuers can freeze tokens, and they acted within about an hour. TRM counted these freezes by 00:30 UTC on October 30:

Tether: about 1.77 billion USDT.
Circle: about 825 million USDC.
Ripple: 40.5 million RLUSD.
World Liberty Financial: 27.8 million USD1.
Arbitrum Security Council: 8,426 ETH and 74.6 million ARB.

Source: Paolo Ardoino on X, October 29, 2026

Binance puts the frozen total at about $3 billion. The frozen funds have not been returned to Binance yet. Binance says it is working to recover them.

Still Held by the Attacker

BTC, ETH, SOL, and XRP have no issuer that can freeze them. The attacker has kept moving these funds since October 29:

Lookonchain tracked over 130 altcoins sold on EVM chains for about 123,400 ETH.
Elliptic said the main Tron wallet paid out every hour for 31 hours, a sign of automated laundering.
Chainalysis said the attackers drained $500 million from Tron staging wallets and started moving funds to Solana.
Lookonchain saw the attacker swapping 970,522 SOL into BTC on November 1.

A THORChain emergency pause on October 31 also slowed some swaps, according to Chainalysis.

Who Is Behind the Attack?

On October 31, the FBI said that North Korea was responsible. It calls this group “TraderTraitor”. The FBI says the attackers are converting stolen assets mostly into ETH, and it published a list of attacker addresses.

Source: FBI Cyber Branch on X, October 31, 2026

The FBI, the Secret Service, and IRS-CI asked exchanges, DeFi services, and node operators to block these addresses. TRM Labs and Chainalysis had linked the attack to North Korea earlier.

How Has Binance Responded?

Compensation and SAFU

Binance says users will not pay for the loss. It is replacing the stolen assets with three sources of money:

part of its SAFU emergency fund (about half of the fund’s address, per co-CEO Yi He);
part of its Futures insurance fund;
its own company treasury.

Since October 31, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC have been fully backed. The last 5% is in smaller tokens that are harder to buy in large amounts. Binance plans to refill SAFU to about $1 billion.

StealthEX graphic. Data: Binance, as of November 1, 2026

Withdrawals

Phase one opened 15 networks between 06:00 and 12:36 UTC on November 1:

BTC, ETH, BNB Smart Chain, XRP, and Base.
Dogecoin, Optimism, Arbitrum, Tron, and Solana.
Polygon, Avalanche C-Chain, Zcash, TON, and Sui.

StealthEX graphic. Data: Binance, as of November 1, 2026

Between 06:00 and 15:30 UTC, users withdrew $4.649 billion and deposited $1.01 billion. The net outflow of about $3.64 billion equals 2.1% of Binance’s $171 billion in assets, per its October 28 reserves data. Other networks are still being tested, with no date yet.

Source: Binance on X, November 1, 2026

Proof of Reserves

Binance took a new snapshot at 00:00 UTC on October 31. The zero-knowledge proof takes 40–50 hours to compute. On November 1, Binance said the report should appear on its Proof of Reserves page “tomorrow”.

Market Impact

BNB fell from about $744 at 20:00 UTC on October 29 to about $695 at 01:00 UTC on October 30, a drop of about 7%. It traded near $707 at 20:30 UTC on November 1, per CoinGecko.

What Is Still Unknown?

The full attack path. Binance has not explained the “additional points of breach”.
The post-mortem date. Binance first said technical findings would come “within about 48 hours” of October 30, 19:58 UTC. No report is out yet.
When the remaining networks and tokens reopen for withdrawal.
How much of the $3 billion frozen will go back to Binance, and when.
Where the unfrozen funds will end up.

What Should Binance Users Do Now?

Use only official channels: binance.com, @binance, and @BinanceHelpDesk on X.
Ignore “compensation” or “cash voucher” links. Yi He warned that no cash voucher campaign exists.
Never enter your login, 2FA code, or seed phrase on a link sent to you.
Before you withdraw, check that your network is open, and check the address twice.
Expect delays during busy hours. If a withdrawal fails, try again later.
Check your API keys and saved withdrawal addresses.

Not Your Keys, Not Your Coins

When your coins sit on an exchange, the exchange holds the keys. You hold a balance in its database. For about 54 hours, no Binance user could withdraw, even though the attacker hit Binance’s own wallets.

Binance is covering this loss from company funds. If an exchange cannot cover a loss, its users can lose their balances.

Self-custody means you hold your own private keys:

Use a software or hardware wallet. Buy hardware wallets only from the maker’s official store.
Write your seed phrase on paper. Never store it in email, cloud notes, or screenshots.
Keep only trading money on exchanges. Move long-term savings to your own wallet.

Swap Without Leaving Coins on an Exchange

StealthEX is a non-custodial exchange. StealthEX never holds your funds. You send coins from your wallet and get the new coins straight to your wallet address. There is no account balance for a hacker to drain.

StealthEX supports 1,500+ coins, and most swaps need no sign-up. In some cases, StealthEX may ask for verification before a swap is completed.

Swap from your own wallet on StealthEX.

FAQ

Did Binance Users Lose Money in the Hack?

Binance says no. The attacker took funds from Binance’s own hot wallets, and Binance is covering the loss with SAFU, insurance fund, and company money.