Binance, the world’s largest crypto exchange by trading volume, lost about $6.3 billion in a hack on October 29, 2026. It is the biggest crypto theft ever recorded, far above the $1.5 billion Bybit hack of February 2025. As of November 1, 2026, Binance says it will cover the losses itself, has replaced about 95 percent of the stolen assets and has started reopening withdrawals in phases. This guide explains what happened, who is behind it, whether your funds are safe and what to do now. Details are still changing, so always check Binance’s official security updates for the latest. This is general information, not financial advice.
Quick Answer
| Question | Short answer |
|---|---|
| What happened? | An attacker moved about $6.36 billion out of Binance wallets across ten blockchains on October 29, 2026, most of it in roughly 20 minutes. |
| Who is behind it? | TRM Labs and Chainalysis point to TraderTraitor, a North Korean state-backed hacking group. The FBI confirmed North Korea was responsible on October 31. |
| Are user funds safe? | Binance says users will not bear the loss and that major assets are fully backed. The investigation is still ongoing. |
| Can I withdraw? | Partly. Phase one of withdrawals began on November 1 with Bitcoin and assets on 15 networks. No date has been announced for phase two. |
| Did Bitcoin crash? | Bitcoin fell to around $77,000 after the news and was trading near that level on November 1. No wider market collapse was reported. |
What Happened to Binance?
The timeline so far
- October 29, 2026: Hackers moved funds out of Binance wallets, reportedly starting around 4:05 p.m. Eastern. TRM Labs counted about $6.36 billion leaving Binance wallets across ten blockchains, most of it in about 20 minutes. Binance suspended withdrawals on several networks.
- October 29 to 30: Binance estimated the impact at about $6.3 billion and said around $3 billion of the affected assets had been frozen with the help of blockchain partners, including about $2.3 billion in USDT and USDC stablecoins. Co-CEO Richard Teng said the team was working nonstop to resolve the incident and promised that Binance would cover all losses.
- October 31: The FBI said North Korea was behind the attack. Binance reported that it had replaced about 90 percent of the stolen assets, up from 80 percent a day earlier.
- November 1: Binance began phase one of reopening withdrawals, starting with Bitcoin and assets on 15 networks, and said it had now covered about 95 percent of the impacted amount.
How big is this hack?
Reports describe it as the largest cryptocurrency theft on record. For comparison, the Bybit exchange hack in February 2025 involved about $1.5 billion. Before the incident, Binance held roughly $144 billion in assets on its platform, according to DefiLlama data cited by CoinDesk, so the stolen amount is a small share of the total but still enormous in absolute terms. A separate and much smaller breach also hit the prediction market Polymarket the same day, with losses reported under $3 million.
How Did the Binance Hack Happen?
The full technical story is not public yet, and Binance says its security teams are still deep in the investigation. Here is what is known so far:
- Binance said an early investigation suggested the incident may have involved a compromised laptop, and a later review found additional points of breach.
- Binance’s co-CEO confirmed that Binance’s own hot wallet was affected. A hot wallet is a wallet connected to the internet that handles day to day withdrawals.
- TRM Labs observed that on one chain the attacker used a way of taking control of a wallet, while on the other nine chains Binance wallets sent funds to the attacker through ordinary signed transfers. TRM concluded that this points to a compromise of Binance’s hot wallet signing infrastructure, meaning the systems that approve transactions.
- TRM also said the attack matched earlier North Korean operations, including preparation well before the theft and transaction signatures obtained in advance.
- One security expert quoted by PBS described the likely method as a single signature that gave the attacker a long lasting, full access permission to a Binance hot wallet.
Because the investigation is active, some of these details may change. We will update this guide when Binance publishes a full report.
Who Is Behind the Binance Hack?
TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking unit backed by the North Korean state. Chainalysis also said the attack was likely carried out by the same group, and the FBI confirmed on October 31 that North Korea was responsible. Law enforcement links the group to a sophisticated unit inside the North Korean military with a record of crypto heists. The same group was blamed by the FBI for the $1.5 billion Bybit hack in 2025.
Tracking firms also report that the laundering of the stolen money is running around the clock. Elliptic said a Tron wallet pushed funds out every hour for 31 hours in a row, with much of it moving through the THORChain network. Recovering stolen crypto from state-backed hackers is difficult, which is why Binance’s decision to cover losses from its own reserves matters so much for users.
Are Your Funds on Binance Safe?
Binance’s public position is that user assets are protected and that the company, not its customers, will bear the financial loss. Here is how it is handling the gap:
- Replacement of stolen assets: Binance says it has covered about 95 percent of the impacted amount by buying replacement tokens through market and over the counter channels. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are reported as fully backed.
- Where the money comes from: Binance is using its corporate treasury, part of its futures insurance fund and part of SAFU, the Secure Asset Fund for Users. Reports say about $581 million was taken from SAFU, and Binance has promised to restore SAFU to about $1 billion.
- Proof of reserves: Binance says users can verify reserves through its proof of reserves snapshot, and it plans to publish a full cryptographic verification of its new proof of reserves on November 3.
An analyst at Fundstrat Global Advisors told CNBC that the breach does not currently appear to pose a significant solvency risk for Binance. Even so, the investigation is not finished, and independent confirmation of Binance’s reserves is worth waiting for before you assume everything is settled.
Binance Withdrawals: What Is Open Now?
Binance resumed phase one of withdrawals on November 1 between 06:00 and 09:00 UTC. Bitcoin was the first network to reopen, followed by assets on 14 other networks, including ether, BNB, Solana, XRP and Dogecoin. The exchange warned that users may see delays or longer processing times during the first rollout because of heavy traffic. Further phases depend on security and stability checks, and no date has been announced for phase two. Check Binance’s official status page for the current state of each coin and network.
What Does the Hack Mean for Bitcoin and Crypto Prices?
Crypto prices slid on the news, with Bitcoin falling back to around $77,000 according to CoinDesk. The market impact stayed limited because Binance said it would cover all losses and most of the affected assets were being replaced. Still, a hack of this size shakes trust in centralized exchanges, and prices can move quickly when new details come out. Check live prices from a trusted source before making any decision.
What Should Binance Users Do Right Now?
- Do not panic sell or panic withdraw based on rumors. Follow Binance’s official website and verified social accounts for security updates.
- Watch out for scams. Hackers and fraudsters often send fake emails, messages and websites about refunds, compensation or account verification after a big incident. Do not click links in such messages.
- Turn on two factor authentication with an authenticator app or a security key, not SMS alone, and set up the anti-phishing code in your account.
- Enable withdrawal address whitelisting so funds can only go to addresses you approved.
- Delete or restrict API keys you do not use, and never share your seed phrase, passwords or codes with anyone.
- Consider keeping only the amount you actively trade on any exchange and storing long term holdings in a hardware wallet that you control.
- Check the proof of reserves verification once it is published.
Lessons From the Binance Hack for Businesses and Website Owners
The incident shows how a single point of failure in the systems that sign transactions can put billions at risk. For any business that handles digital assets or customer data, the basics matter: keep only small balances in internet connected wallets, require multiple approvals for large transfers, separate and monitor signing systems, and protect employee devices, since an early finding pointed to a compromised laptop. Website owners can also read our guide to PHP2Shell and SSL attacks and the other website hacks of 2026 for practical protection steps.
Final Thoughts
The Binance hack is the largest crypto theft on record and a reminder that even the biggest exchanges can be breached. The reassuring part for users is that Binance says it will absorb the loss, has replaced most of the stolen assets and is reopening withdrawals in phases. The open questions are how the attackers got in, whether the remaining 5 percent gap gets closed and what the proof of reserves verification shows. We will keep this guide updated as new facts come out.
Frequently Asked Questions
Was Binance really hacked?
Yes. Binance confirmed a security incident on October 29, 2026, with about $6.3 billion in assets affected, and the FBI later attributed the attack to North Korea.
How much was stolen from Binance?
TRM Labs estimated that about $6.36 billion was moved out of Binance wallets across ten blockchains. Binance put the impact at around $6.3 billion, and about $3 billion was frozen in the first day.
Who hacked Binance?
TRM Labs and Chainalysis linked the attack to TraderTraitor, a North Korean state-backed group. The FBI confirmed on October 31 that North Korea was responsible.
Are my funds on Binance safe?
Binance says users will not bear any loss and that major assets are fully backed, as shown by its proof of reserves. The investigation is still ongoing, so keep following official updates.
Has Binance resumed withdrawals?
Partly. Phase one began on November 1 with Bitcoin and assets on 15 networks. Further phases depend on security checks, and no date has been announced for phase two.
Will Binance pay back the losses?
Binance says it will absorb the full financial impact using company funds, part of its SAFU reserve and its futures insurance fund. It reports that about 95 percent of the impacted amount has been covered so far.
What is SAFU?
SAFU stands for Secure Asset Fund for Users. It is an emergency reserve that Binance created in July 2018 to protect users in extreme incidents. Binance plans to restore it to about $1 billion after this hack.
Is this the biggest crypto hack ever?
Yes. Reports describe it as the largest crypto theft on record, ahead of the $1.5 billion Bybit hack in February 2025.
Did the Binance hack crash Bitcoin?
Bitcoin dipped to around $77,000 after the news, but no wider market collapse was reported. Crypto prices change fast, so check live data.
Should I move my crypto off exchanges?
That is a personal decision. Many security experts suggest keeping only what you actively trade on an exchange and storing long term holdings in a hardware wallet you control. This is general information, not financial advice.
Sources
- TRM Labs: North Korea steals $6.36 billion from Binance
- CoinDesk: Binance opens withdrawals in phases starting with Bitcoin
- PBS NewsHour: What to know about the $6.3B hack on Binance
- NPR: A simple explainer of the $6.3 billion crypto heist at Binance
- Forbes: Binance reopens withdrawals, says company cash covered 95 percent of hack