Binance Hack 2026: $6.3B Stolen, Are Funds Safe?

Binance, the world’s largest crypto exchange, was hit by a hack with an estimated impact of about $6.3 billion on October 29, 2026, making it the biggest crypto theft on record. The company says user funds are safe and that it will cover every loss from its SAFU emergency fund and its own money. Withdrawals are paused for now, and Binance says it expects to start restoring them within roughly 45 to 48 hours. Here’s what happened, who investigators think is behind it, and what account holders should do while they wait.

What Happened in the Binance Hack

According to blockchain analytics firm Chainalysis, funds began leaving Binance’s hot wallets (the internet-connected wallets an exchange uses to process everyday withdrawals) at around 4:20 p.m. Eastern Time on October 29. The transfers spread across multiple blockchains. TRM Labs, another blockchain intelligence firm, estimated that about $6.36 billion in digital assets moved out of Binance wallets across 10 blockchains, with most of it transferred within about 20 minutes, CNBC reported.

Binance’s own figure is “around $6.3B.” Chainalysis puts it at about $6.4 billion and calls it “the largest in the history of crypto, and one of the single-largest financial crimes of all time.” For comparison, the previous record was the roughly $1.5 billion Bybit hack in February 2025.

How the attackers got in

In its official security incident update, Binance said its initial investigation suggests the incident “may involve a compromised DevOps engineer’s laptop,” which let an attacker reach a service container and submit unauthorized withdrawal transactions. The exchange said it found “no evidence of any wallet private key leak” and promised a detailed technical post-mortem once the investigation is complete.

A few hours later, Binance said it had uncovered additional “points of breach” beyond the laptop, according to the BBC’s live coverage. Co-CEO Richard Teng said the attack “was not a simple ‘one click’ action” but a “more complex attack process.”

Who Is Behind It?

Binance itself has not named a culprit, and Teng said the investigation had not yet attributed responsibility to any individual. But two major blockchain intelligence firms point to North Korea:

TRM Labs attributed the attack “with high confidence” to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI previously linked the same group to the Bybit hack. TRM said preparations began at least 36 hours before the theft, with the attackers funding their wallets through the crypto mixer Tornado Cash.
Chainalysis reached the same conclusion after watching, in real time, funds stolen from Binance mix with funds from last month’s Bitget exploit, which had already been attributed to North Korean actors.

The Associated Press also reported the North Korea link and noted that Binance has engaged law enforcement to trace and recover the funds.

Is My Money Safe on Binance?

Binance’s official answer is yes. Its announcement says: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” SAFU (short for Secure Asset Fund for Users) is an emergency reserve the exchange set up to cover losses like this one. Binance also says it will publish an updated Proof of Reserves once remediation is finished, which should let users check that customer balances are fully backed.

Outside analysts so far agree the hit looks survivable. Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, told CNBC the hack “does not currently appear to create meaningful solvency risk for Binance.” He estimated about $3.3 billion remains unfrozen and that the SAFU fund, which he put at roughly $1.2 billion, could cover about a third of that, with the rest coming from Binance’s own funds. He added that the key thing to watch is how quickly withdrawals resume and whether outflows stay orderly.

That’s analysis, not a guarantee. If you hold crypto on any exchange, the safest assumption is that your balance there depends on that company’s security and finances.

When Will Binance Withdrawals Resume?

Binance first paused withdrawals on multiple networks as a precaution, and its announcement said deposits and withdrawals were both temporarily suspended while security checks were completed. Later on Friday, the exchange said deposits were unaffected and operating as normal, and that it was “on track” to resume the withdrawal service in about 45 hours. Binance executive Yi He separately said withdrawals were expected to begin resuming within the next 48 hours, TokenPost reported.

Those are estimates, not confirmations. Binance says it will post progress on its official channels, so check the Binance app or its official announcements page rather than social media screenshots.

The exchange also temporarily suspended trading on Binance Alpha, its platform for early-stage tokens, according to the BBC timeline.

Can the Stolen Crypto Be Recovered?

About $3 billion of the stolen assets has been frozen on-chain, according to Binance, with Chainalysis putting its own count at about $2.8 billion when it published. Stablecoin issuers moved quickly: Chainalysis said the attacker tried to swap $325 million in stablecoins into ether in a race against freezes, but freezes began by 5:14 p.m. Eastern.

Freezing isn’t the same as getting money back, though. “A freeze stops the money from moving, and recovery follows through legal process,” Ari Redbord, global head of policy at TRM Labs, told CNBC. He said stablecoins such as USDT and USDC are the most recoverable because their issuers can freeze, burn and reissue tokens. Bitcoin and ether have no issuer, so investigators have to trace them until they hit an exchange or service that can step in.

Eric Jardine, head of research at Chainalysis, told CNBC there is “no standard recovery timeline,” adding that returning funds “can take months or years.”

How the Hack Hit Crypto Prices

Bitcoin fell about 5% after the attack, the BBC reported, and CNBC said it was trading below $78,000 on Friday. Because Binance says it handles roughly 35% of the crypto market, traders are watching closely for any sign of a rush to pull money out once withdrawals reopen.

What Binance Users Should Do Right Now

Big security incidents are a magnet for scammers. Binance itself warned users to “remain cautious of scams” and not to trust unofficial links, messages or requests for account information, TechCrunch reported. A few common-sense steps:

Use only the official Binance app or website. Type the address yourself instead of clicking links in texts, emails or direct messages.
Ignore anyone offering to “speed up” your withdrawal or “recover” funds. Binance says it is covering losses itself; there’s no fee or form to fill out.
Never share your password, 2FA codes or recovery phrase, even with someone claiming to be Binance support.
Watch for fake QR codes and lookalike sites. Our guide on how QR code scams work covers the warning signs.
Be wary of “guaranteed return” pitches that use the hack as a hook. Here’s how to spot fraudulent investment schemes.

Data company Experian, quoted by the BBC, also notes that many crypto holders keep long-term holdings in a hardware wallet, a physical device that keeps keys offline. Whether that suits you depends on how you use crypto. For broader habits like strong passwords and two-factor authentication, see our guide to reducing cybersecurity risks.

Frequently Asked Questions

How much was stolen in the Binance hack?

Binance estimates the total impact at around $6.3 billion. TRM Labs estimated $6.36 billion and Chainalysis about $6.4 billion. Roughly $3 billion has been frozen so far.

Did Binance customers lose money?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. The stolen crypto came from Binance-controlled hot wallets.

Can I withdraw from Binance right now?

Not yet, as of Friday, October 30. Binance said it expects to start restoring withdrawals within about 45 to 48 hours. Deposits are working normally, according to the company.

Was it North Korea?

TRM Labs and Chainalysis both attribute the hack to North Korea’s TraderTraitor group. Binance hasn’t officially named an attacker.

Were Binance passwords or private keys leaked?

Binance said it found no evidence of any wallet private key leak. It has not reported that customer passwords were exposed, but it’s still smart to be alert for phishing.

This is a developing story and will be updated as Binance restores withdrawals and publishes its post-mortem. This article is for general information and is not financial advice.

Featured image: “Binance t-shirt and bag” by Bretwa, via Wikimedia Commons, licensed under CC BY-SA 4.0.