Binance hack: what we know about the estimated $6.3 billion theft, and the scams that follow

Developing story — as of Oct 30, 2026, 11:30 UTC; we'll update this page. We're not affiliated with Binance. This page summarizes public statements and reports; it is not financial advice.

Binance, the world's largest crypto exchange, says a security incident on Thursday, October 29, 2026 had an estimated total impact of around $6.3 billion. Blockchain analytics firms Elliptic, Chainalysis and TRM Labs each describe it as the largest crypto theft on record. Binance says around $3 billion has been frozen so far, that user funds are safe and that it will cover all losses. Withdrawals remain paused. All times below are UTC.

Where things stand

As of October 30, 11:30 UTC, according to Binance unless noted:

• Withdrawals: paused. In its 08:47 UTC update, Binance said it is "still on track towards the expected timeline to resume the withdrawal service in 45 hours", which by our arithmetic points to around 05:45 UTC on Sunday, November 1. That is Binance's target, not a confirmed restart.
• Deposits: Binance said at 00:13 and 01:36 UTC, and in the original version of its 02:23 UTC announcement, that deposits and withdrawals were temporarily suspended. Since 04:36 UTC it has said deposits "remain unaffected". At 11:17 UTC it edited the announcement to say only withdrawals were suspended, adding that it was updated "to clarify deposits remain unaffected and continue to operate as normal". Binance hasn't explained its earlier statements.
• Trading: Binance said at 23:06 UTC on October 29 that Binance Alpha trading was temporarily suspended. Axios reported that Binance halted trading, but we found no Binance statement announcing a wider halt.
• Cause: Binance has not yet published a root-cause report or post-mortem.
• Attribution: private analytics firms point to North Korea. We found no government confirmation.

What happened: a timeline

• October 29, about 20:05: funds began leaving Binance hot wallets, starting on the XRP Ledger, according to Elliptic. Within 30 minutes, wallets on nine more blockchains had been drained. Chainalysis dates the first outflows to around 20:20 (4:20 p.m. ET).
• 20:24: about $2.53 billion left Binance on Ethereum in a single transaction (Elliptic).
• About 21:01 to 21:14: stablecoin issuers began freezing funds. Elliptic says Tether froze the attacker's main Ethereum wallet 37 minutes after 20:24, around 21:01; Chainalysis says the freezes started at 5:14 p.m. ET.
• 21:29: Binance's first post on X said it was "aware of reports of a potential security issue". At 22:27, TechCrunch quoted a Binance spokesperson saying withdrawals had been suspended on multiple networks.
• Shortly after 23:00: a second wave of withdrawals hit Binance wallets on Avalanche and Polygon (Elliptic).
• October 30, 00:13: Binance said all deposits and withdrawals were temporarily suspended.
• 02:23: Binance's official announcement gave the suspected cause and its estimate of the impact.
• 04:36: Binance said deposits were unaffected and that it expected withdrawals to resume within 48 hours.
• 08:47: Binance reported "additional points of breach" and said it was on track to resume withdrawals in 45 hours.
• 10:55: Binance said it had reserved over $6.34 billion of company funds to cover the incident.
• 11:17: Binance edited its 02:23 announcement so that it lists only withdrawals as suspended, with a note that it was updated "to clarify deposits remain unaffected and continue to operate as normal".

How much was taken, and how much is frozen

Binance estimates the total impact at "around $6.3B" (02:23 UTC). The analytics firms' figures differ slightly because they use different methods and snapshot times. TRM Labs counts about $6.36 billion across 10 blockchains (figures as of 00:30 UTC). Elliptic counts $6.43 billion across 11 blockchains (08:00 UTC). Chainalysis says approximately $6.4 billion (09:34 UTC), up from an earlier $5.912 billion.

Binance says around $3 billion has been frozen, up from $2.54 billion at 23:22 UTC on October 29. The analysts' counts are a little lower: $2.84 billion verified by Elliptic, approximately $2.8 billion according to Chainalysis, and about $2.7 billion according to TRM (as of 00:30 UTC). Stablecoin issuers did most of the freezing:

• Tether: more than 1.567 billion USDT, CEO Paolo Ardoino said on X (21:25 UTC, October 29).
• Circle: more than 800 million USDC, CEO Jeremy Allaire said on X (21:18 UTC).
• Ripple: Binance co-founder Yi He thanked Ripple for freezing "approximately 200 million"; TRM says it has confirmed 40.5 million RLUSD frozen on-chain.
• Others: Yi He says World Liberty Financial froze $27 million in USD1. Elliptic says Paxos and First Digital also froze stablecoins, and the Arbitrum Security Council moved assets out of the attacker's reach.

Assets such as bitcoin and ether have no issuer who can freeze them. Elliptic estimates the attacker controls about $3.33 billion in such assets (around 07:00 UTC); TRM's earlier estimate was about $2.4 billion.

How it happened, according to Binance

In its October 30 announcement (02:23 UTC), Binance said its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop", which allowed an attacker "to gain access to a service container and submit unauthorized withdrawal transactions". Binance added: "We have found no evidence of any wallet private key leak." It says it revoked the affected address authorization and brought in law enforcement and blockchain intelligence partners.

Binance has since widened that account. At 04:36 UTC it said the incident "stems from multiple factors". At 08:47 UTC it said its subsequent investigation "has uncovered additional points of breach" and called it "a complex attack". Co-CEO Richard Teng wrote on X that the attacker did not simply use one engineer's permissions, and that Binance's investigation "has not attributed responsibility to any individual". Binance hasn't said what the additional points of breach are or how the laptop was compromised. It has promised a detailed technical post-mortem.

Elliptic says the on-chain evidence is consistent with Binance's first account: rather than stealing private keys, the attacker appears to have got Binance's own systems to sign transactions on its behalf. In TRM's assessment, the evidence points to a compromise of Binance's hot wallet signing infrastructure.

Who is suspected

Binance has not named an attacker. It says it is working with law enforcement partners "to confirm the identity of these criminals". Three blockchain analytics firms point to North Korea, with different degrees of certainty:

• TRM Labs attributes the attack to TraderTraitor, which it calls North Korea's elite hacking unit, and says it makes this judgment "with high confidence".
• Chainalysis assesses the hack to be the work of TraderTraitor, citing stolen Binance funds that mixed with funds from September's Bitget exploit.
• Elliptic now says it "has attributed the theft to DPRK" (North Korea); until about 10:59 UTC its wording was "likely" and "not yet certain". It still lists "reasons for caution", including that the small overlap with Bitget "may point to a launderer", since laundering networks can serve more than one client.

These are private companies' assessments, not official findings; Elliptic itself notes that "No government or law enforcement agency has confirmed attribution". As of October 30, 11:30 UTC, we found no statement on the incident from the FBI, the Justice Department or the Treasury Department. AFP reported that the Justice Department and the FBI did not immediately respond to requests for comment, and Reuters notes that North Korea routinely denies such accusations. For context, the FBI said in February 2025 that TraderTraitor stole about $1.5 billion from the exchange Bybit.

What Binance says about customer funds

The following are Binance's own statements. We can't independently verify them.

• "User funds are safe." (announcement, 02:23 UTC; repeated at 08:47 UTC)
• "Binance will cover all losses from the SAFU fund and the company's funds." Reuters, citing Binance's website, describes SAFU as a $1 billion bitcoin reserve; a Fundstrat analyst quoted by CNBC estimates it at about $1.2 billion.
• At 10:55 UTC, Binance said it had "reserved over $6.34B of company funds to cover this incident", and that the figure does not include frozen or protected assets. This is a reserve, not a new estimate of the loss.
• Binance says it will publish an updated Proof of Reserves once remediation is complete.

NBC News points out that, unlike bank deposits, funds held with crypto exchanges are not automatically insured, which leaves any refunds to the exchange's discretion.

Expect scams after the hack

Binance's first post on the incident warned that users "should remain cautious of scams and should not trust unofficial links, messages, or requests for account information". The FBI has warned (PSA I-080124, August 1, 2024) about scammers who pose as crypto exchange employees, claim there's a problem with your account and push you to share your login, click a link or hand over identification. In a November 2022 alert written after a major crypto exchange failed, the FTC warned about so-called recovery services that contact people who have lost money.

What to do now

These steps come from Binance's help pages, the FBI and the FTC.

1. Get updates only from official Binance channels. Binance asks users to "rely only on official Binance channels for updates".
2. Check before you trust. Binance Verify checks whether a URL, email address, phone number, Telegram or social media account is officially from Binance. Binance advises staying cautious even when a source appears verified, and says it "will never request funds or tokens via private communications".
3. Don't trust support calls. Binance says its support "is only available on the official Binance website" and that anyone calling and claiming to be from Binance is a scammer. For calls or messages about an account problem, the FBI says not to respond, even if they appear official: hang up and go to the exchange's official website yourself.
4. Never hand over your login. The FBI says that if anyone asks for your account log-in information at any point, don't provide it, and to avoid links and attachments in unsolicited messages.
5. Don't pay for "recovery". The FTC says: "Don't pay anyone who contacts you, offering to recover money you lost to a scam." Binance warns that recovery services may be run by the same scammers.
6. Report it. The FBI asks victims to report to its Internet Crime Complaint Center at ic3.gov. The FTC asks people who spot a recovery scam to tell it at ReportFraud.ftc.gov. For account questions, Binance points to its Customer Support.

To protect your accounts more generally, the FTC recommends turning on two-factor authentication and using a password manager.

Where the figures disagree

• Total taken: from Binance's "around $6.3B" to Elliptic's $6.43 billion; Chainalysis first said $5.912 billion. The sources use different methods and snapshot times.
• Scope: TRM counts 10 blockchains and Elliptic 11 (TRM's list leaves out NEAR). TRM says most of the funds moved in about 20 minutes; Elliptic describes drains over a few hours.
• Frozen total: around $3 billion according to Binance, and $2.7 billion to $2.84 billion according to TRM, Chainalysis and Elliptic.
• Deposits: suspended in Binance's posts from 00:13 to 02:23 UTC, then "unaffected" from 04:36 UTC; at 11:17 UTC Binance edited its announcement to drop the deposit suspension. The withdrawal target also moved, from "within 48 hours" (04:36 UTC) to "in 45 hours" (08:47 UTC).
• Bybit, for comparison: about $1.5 billion according to the FBI, and $1.46 billion according to Elliptic.

What we don't know yet

• How the engineer's laptop was compromised, and what the "additional points of breach" are.
• Exactly when Binance paused withdrawals, and when they will actually resume.
• Whether any government will confirm who is responsible.
• What Binance means when it says it "has begun recovering affected assets for users", and whether customer balances match Binance's statements, which its promised Proof of Reserves should address.

After a hack this size, the follow-up scams are the part you can control. Use only official Binance channels, never share your login, and never pay anyone who offers to recover your money.