Binance Hack Update: What We Know About the $6.3 Billion Theft

Binance estimates that about $6.3 billion in crypto was taken from its hot wallets in a hack that began around 20:05 UTC (4:05 p.m. EDT) on Thursday, Oct. 29, 2026. The exchange has warned that the figure may continue to increase. When we last checked, at 18:16 UTC (2:16 p.m. EDT) on Friday, Oct. 30, withdrawals on Binance.com were still suspended and deposits were working normally. Binance says user funds are safe and that it will cover all losses itself. Binance.US, the separate exchange for US residents, says it was not affected. This hack is also unrelated to the October 2022 BNB Chain bridge exploit, which still turns up in searches.

Every figure below is given with its source and the time it was given. The story is still moving, and the numbers have changed several times since Thursday night.

What happened at Binance, and when?

Binance confirmed a “security incident” on the evening of Oct. 29, 2026, in which an attacker drained its hot wallets; TRM counts ten affected blockchains and Elliptic 11. A hot wallet is an exchange wallet kept online to pay out withdrawals. The main events in the timeline, with UTC first and Eastern Daylight Time second:

• 20:05 UTC (4:05 p.m. EDT): TRM and Elliptic say the first theft hit Binance wallets on the XRP Ledger, which sent about 233 million XRP to one attacker address. Chainalysis instead dates the start to around 4:20 p.m. ET (20:20 UTC).
• 20:20–20:24 UTC (4:20–4:24 p.m. EDT): On Ethereum, the attacker submitted one transaction carrying 50 pre-signed authorizations for the Binance hot wallet known as “Binance 14”. According to TRM and Elliptic, the wallet was then emptied of 167,464 ETH and 63 tokens, including about 1.6 billion USDT. Elliptic says two-thirds of the Ethereum losses, $2.53 billion, left in that single transaction.
• About 23:05 UTC (7:05 p.m. EDT): TRM reports a second wave that hit Binance wallets on Avalanche and Polygon.
• 23:56 UTC (7:56 p.m. EDT): Elliptic says the attacker swept new deposits into Binance 14 four more times after the main sweep, the last at this time.
• 02:23 UTC Oct. 30 (10:23 p.m. EDT Oct. 29): Binance published “Security Incident Update (2026-10-30)”. It updated the notice at 11:36 UTC (7:36 a.m. EDT) to say deposits are unaffected.

TRM says most of the theft happened in about 20 minutes. Binance has not said exactly when it paused withdrawals.

How much was stolen, and how much has been frozen?

Binance’s own estimate is about $6.3 billion in “estimated total impact”, with about $3 billion frozen on-chain. Binance warned on X that the total “may continue to increase”, according to Al Jazeera. Late on Oct. 29, at 23:35 UTC (7:35 p.m. EDT), Binance had reported a verified frozen total of $2.54 billion, per TRM’s account. The independent firms’ counts are close to Binance’s but not identical.

The table shows each source’s stolen and frozen totals in US dollars, at the time that source gave them. Chainalysis did not publish a time with its figures.

Those dollar totals are estimates. The token amounts are what actually moved on-chain. TRM’s breakdown as of 00:30 UTC on Oct. 30:

• Ethereum: 200,630 ETH plus 185 other tokens, including 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD
• Bitcoin: 18,270 BTC
• Tron: 612.7 million USDT and 46.4 million TRX
• XRP Ledger: 233.46 million XRP
• Solana: 970,500 SOL

Elliptic’s total leaves out a further $169 million that left Binance after withdrawals were suspended. Elliptic says that money appears to be Binance moving its own funds.

Not everything taken can be frozen. In its 13:10 UTC update on Oct. 30, Elliptic estimated that the attacker controls around $3.28 billion that no issuer can freeze, spread across about 72 addresses and including 519,104 ETH and 18,270 BTC. TRM’s earlier figure, as of 00:30 UTC, was about $2.4 billion beyond any issuer’s reach. Elliptic says the stolen XRP, SOL and NEAR, worth around $438 million, had not moved since the theft.

Who froze the stolen funds?

Stablecoin issuers did most of the freezing, because they can block their own tokens in a given wallet; native bitcoin and ether have no issuer that can do that. TRM’s tally as of 00:30 UTC on Oct. 30:

• Tether: about 1.77 billion USDT. Its first freeze, 971.1 million USDT, came at 21:01 UTC (5:01 p.m. EDT), 37 minutes after the main sweep. Chainalysis separately says freezes began by 5:14 p.m. ET.
• Circle: about 825 million USDC, frozen in coordination with law enforcement, starting at 21:04 UTC.
• Ripple: 40.5 million RLUSD.
• World Liberty Financial: 27.8 million USD1.
• Arbitrum Security Council: forced 8,426 ETH and 74.6 million ARB, about $30 million, out of the attacker’s wallet at 00:08 UTC on Oct. 30.

Elliptic adds that Paxos and First Digital froze further stablecoins, that Tether froze tokenized gold and that Binance froze its own WBETH token. Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire both confirmed their companies’ freezes publicly, CNBC reported. Elliptic also notes that nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen.

How did the attackers get into Binance?

Binance’s first finding was that the incident “may involve a compromised DevOps engineer’s laptop”, but it has since said it found “additional points of breach”. Binance’s full account, in the order it was given:

• Initial finding: the compromised laptop “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Binance added: “We have found no evidence of any wallet private key leak.”
• Later update on X, Oct. 30: Binance said its investigation “has uncovered additional points of breach” and called it “a complex attack”. It has not said what the other breach points were.
• Co-CEO Richard Teng, in a video on Oct. 30: Teng said the attack “was not carried out by one person” and that it used a self-destruct mechanism to wipe tooling and traces. He said it also used an EIP-7702 delegation, an Ethereum feature that lets an ordinary wallet run smart-contract code, that “did not pass through our normal approval controls” (as quoted by Decrypt). Binance is reviewing endpoints, cloud systems, key management and signing, and says it will publish a technical post-mortem once the investigation is complete.

The on-chain detail comes from the analytics firms, not from Binance. TRM and Elliptic both say the 50 Ethereum authorizations were validly signed with Binance 14’s key, and that wallets on other chains sent funds through ordinary signed transfers. Elliptic’s assessment is that the attacker got Binance’s own systems to sign transactions for them rather than stealing private keys. That is the firms’ reading; Binance has not confirmed it. Binance has not named the engineer and has not blamed any individual, and neither do we.

Who is behind the Binance hack?

Three blockchain-analytics firms link the attack to North Korea, but no government has confirmed it, and Binance has not said who was responsible. The firms differ in how they put it:

• TRM Labs attributes it to TraderTraitor, a North Korean state-backed hacking group. TRM says it makes that judgment “with high confidence”, based on on-chain and off-chain intelligence.
• Chainalysis also attributes it to TraderTraitor. It says stolen Binance funds were mixed on-chain with funds from the September 2026 Bitget theft, which it describes as attributed to North Korea.
• Elliptic says it has attributed the theft to North Korea-linked actors (“Elliptic believes that DPRK-linked actors perpetrated the Binance theft”) but does not name a specific group, and it lists reasons for caution. Elliptic says some of the stolen Tron funds reached an address that also received proceeds of the Bitget exploit, but only a small share has done so. It adds that the attacker’s slow laundering, which let more than $2.6 billion be frozen, is unlike typical North Korean groups. It also notes there has been no FBI attribution so far; by contrast, the FBI attributed Bybit within five days.

Teng said Binance’s investigation “has not attributed responsibility to any individual.” According to CNBC, the FBI said it is aware of the incident and is coordinating with public and private partners. The US Secret Service told NBC News it is working with partners including Circle to freeze, trace and recover funds, alongside the US Attorney’s Office for the District of Columbia. It said its investigation is at an early stage. North Korea routinely denies involvement in such attacks.

Are Binance customers’ funds safe?

Binance says yes. It has pledged to cover all losses from its SAFU fund and company funds, but an outside review has raised a question about the wallets it used to back customer balances. Here are both sides, as each has put them:

• Binance’s position: “User funds are safe,” the announcement says. Teng said Binance has reserved more than $6.34 billion of company funds to cover the losses. About $5 billion of that is already held in the same tokens that were stolen, and the rest is being bought through market and over-the-counter trades. He said the attack hit Binance’s own hot wallet, not customer funds: “We never use any customer funds, so they are not impacted.” Binance says it will publish updated proof of reserves.
• CoinDesk’s finding: CoinDesk reports that the Binance 14 wallet appears in Binance’s Oct. 1, 2026 proof-of-reserves report. That report lists the wallets Binance counts as backing customer balances. CoinDesk estimates the ether taken is about 5.6% of Binance’s ETH reserves, which CoinDesk says has likely left ETH backing below 100% until Binance replaces it. Binance did not immediately respond to CoinDesk, and the exchange’s next reserve snapshot is due Nov. 1, per CoinDesk.

SAFU is Binance’s emergency fund for users. Sean Farrell of Fundstrat Global Advisors put its size at about $1.2 billion (CNBC), which would mean company funds cover most of the pledge. Binance itself has not published a SAFU figure in its incident notice.

When will Binance withdrawals resume?

Binance has not given a time, only a target: Teng says he hopes to restore withdrawals by Sunday, Nov. 1. The guidance so far, by source:

• Co-founder and co-CEO Yi He: Binance expects to begin resuming withdrawals within the next 48 hours, as CNBC paraphrased her.
• Binance on X, Oct. 30: “on track” to resume them in 45 hours (Decrypt, Al Jazeera).
• Teng (CoinDesk, 12:31 p.m. EDT Oct. 30): hopes to restore withdrawals “by Sunday”, which CoinDesk put at about 40 hours away.

Binance has not said whether every network will restart at once, and it had not announced any resumption at our last check. US clocks fall back at 2 a.m. on Sunday, Nov. 1, so any US Eastern time from then on is EST (UTC-5).

Deposits: Binance’s first statement said all deposits and withdrawals were temporarily suspended, as the Guardian quoted it. Binance then updated its announcement to say deposits “remain unaffected and continue to operate as normal.”

Trading: Binance’s announcement suspends withdrawals only, not trading. Its public system-status endpoint read “normal” and its spot market was printing trades when we checked at 18:16 UTC on Oct. 30.

Proof of reserves: Teng said Binance will publish an initial view before Monday and a full proof-of-reserves report by Monday, Nov. 2.

Does the Binance hack affect US users?

Binance.US says it was not affected. Binance.com, the global exchange that was hacked, is not offered to US residents. Americans use Binance.US, a separate exchange, which the BBC describes as serving US residents specifically. The US connection runs through the investigation and the issuers instead: the FBI and the Secret Service are involved, and US-based Circle froze about 825 million USDC. On CNBC, CFTC chairman Michael Selig said the breach “proves our exact point” about his agency’s Oct. 5 proposal for a federal registration option for crypto exchanges.

Will the frozen money be returned?

Not automatically: a freeze stops the money from moving, but getting it back takes a legal process. TRM’s Ari Redbord told CNBC that law enforcement typically gets a court order or seizure warrant before stablecoin issuers release or reissue frozen tokens. Chainalysis’s Eric Jardine told CNBC there is “no standard recovery timeline”, and that returning funds “can take months or years”. Bitcoin and ether cannot be frozen by an issuer, but both firms say they can still be traced and possibly stopped when they reach an exchange or another platform that cooperates.

What should Binance users do now?

Binance’s own advice is to rely only on official Binance channels for updates and to contact Binance Customer Support with questions. Teng said users can check their balances in their accounts. Experts quoted by the BBC suggest doing that through the official app or website only. Beyond Binance’s guidance, the usual anti-phishing rules apply after any big hack:

• Don’t trust emails, texts or direct messages saying your funds are at risk, even if they look official.
• Ignore any “support” account that contacts you first or offers to help.
• Never move your crypto to a “safe” wallet because someone told you to.
• Never share your passwords, two-factor codes or seed phrases.

This page is not investment advice.

What don’t we know yet?

Several key facts are still open as of 18:16 UTC (2:16 p.m. EDT) on Oct. 30.

• Root cause: what the “additional points of breach” were, and how the EIP-7702 delegation got past Binance’s controls, are still unexplained. Binance has promised a post-mortem.
• Restart time: when withdrawals actually come back, and on which networks first.
• Reserves: what Binance’s reserve ratios look like after the hack, until the proof-of-reserves reports come out.
• Final figures: the totals stolen and frozen are still moving as the attacker shifts funds across chains, and so are any eventual recoveries.
• Attribution: whether the FBI or any other government will officially name who carried out the attack.

Sources

• Binance: Security Incident Update (2026-10-30)
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• Elliptic: The largest theft in history: Sanctioned actors linked to North Korea behind the $6.4 billion Binance hack
• Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link
• CNBC: Circle, Tether freeze funds impacted by Binance security issue
• CNBC: Billions in crypto frozen in Binance hack, here’s what happens next
• NBC News: Binance pledges to cover billions in stolen assets
• CoinDesk: Binance hack drained wallets backing customer assets, reserve data shows
• CoinDesk: Binance uncovers wider breach, targets Sunday withdrawal restart
• Decrypt: Binance sets aside $6.34B to cover hack losses
• Decrypt: Binance finds additional points of breach in $6.3B hack
• The Guardian: Binance crypto exchange hack
• BBC News: Who could be behind the Binance hack and what we know so far
• Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history