Last updated: 30 October 2026, 07:30 UTC. This is a developing story. Figures come from on-chain investigators and Binance's own statements, and some are still moving. We will update this page as Binance publishes its full report.
This article is general education about crypto security, not financial advice.
Binance, the largest crypto exchange in the world, was drained of around $6.36 billion on the night of 29 October 2026. This page is for anyone with money on Binance, or on any exchange, who wants to know what actually happened, what is confirmed and what is not, and what to do this week to stay safe.
What happened in the Binance hack?
Attackers emptied Binance hot wallets on ten different blockchains at once, taking about $6.36 billion, most of it in roughly 20 minutes starting at 20:05 UTC. A hot wallet is the online wallet an exchange uses to pay out customer withdrawals, so it holds a lot of money and is always connected to the internet.
According to TRM Labs, the blockchain analytics firm that has published the most detailed tally, the haul breaks down roughly like this, valued at the time of the theft:
| Blockchain | What was taken | Approximate value |
|---|---|---|
| Ethereum | 200,630 ETH plus 185 tokens, including 1.875 billion USDT and 823 million USDC | $3.79 billion |
| Bitcoin | 18,270 BTC | $1.47 billion |
| Tron | 612.7 million USDT and 46.4 million TRX | $628 million |
| XRP Ledger | 233.46 million XRP | $296 million |
| Solana | 970,500 SOL | $96 million |
| Arbitrum, Optimism and Base | ETH and tokens, including 74.6 million ARB | $39 million |
| Avalanche and Polygon | Various tokens | $38 million |
That makes it the largest crypto theft ever recorded, more than four times the $1.5 billion taken from Bybit in February 2025. Binance's own estimate of the impact is about $6.3 billion, so the exchange and the investigators broadly agree on the size.
Where the $6.36 billion came from. Ethereum carried most of the value, but 18,270 BTC also left, and unlike the stablecoins, nobody could freeze it.
How did hackers get into Binance?
Binance says its first findings point to one compromised laptop. In its latest update on X on 30 October, the exchange said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It added that it has found no evidence that wallet private keys were leaked.
The on-chain evidence fits that picture. TRM found that on Ethereum the attacker used a feature called an EIP-7702 delegation to hand control of a Binance hot wallet to code the attacker had written, with 50 authorisations signed in advance. On the other nine chains the money simply left through normal, properly signed transfers. TRM's reading is that the attacker gained the ability to make Binance's own signing system approve whatever transactions it wanted.
This was planned, not opportunistic. The attacker's wallets were funded through the Tornado Cash mixer from the morning of 28 October, at least 36 hours before the theft. Binance has not yet published a full root cause, and has said a post-mortem will follow, so treat the laptop explanation as preliminary.
Who was behind the Binance hack?
TRM Labs attributes the attack, with high confidence, to TraderTraitor, a North Korean state hacking unit. It is the same group the FBI named as responsible for the Bybit theft, and its trademark is exactly this kind of patient attack on the people and systems around a wallet rather than on the blockchain itself.
No government has confirmed the attribution for this hack yet, and Binance itself has not named anyone. It is the leading theory from the firm with the most data, which is a strong position but not a court finding.
Are funds on Binance safe, and can you withdraw?
Binance says user funds are safe and that it will cover the losses from its SAFU emergency fund and its own corporate money. Binance says the theft hit its own hot wallets rather than individual customer accounts, and that customer balances are covered.
What you cannot do right now is take your money out. Binance suspended withdrawals across multiple networks on the night of the hack while it rebuilds its withdrawal service, and as of 30 October it says it expects them to resume within 48 hours, according to CyberInsider. Deposits are still working. Binance also says it will publish an updated proof of reserves once the work is done.
We have watched exchanges say "funds are safe" before. Sometimes it is true, as it was after Bybit, and sometimes it is not, as FTX customers found out in November 2022. The honest position today is that Binance has the money to cover this on paper, and that you are relying on its word until withdrawals reopen. For a wider checklist on judging any exchange, see how to check whether a crypto exchange is safe.
Why could Tether and Circle freeze the stolen money?
Because USDT and USDC are not like Bitcoin. Their issuers can block any address they choose, and within about an hour of the theft they did. TRM counts about 1.77 billion USDT frozen by Tether and about 825 million USDC frozen by Circle, plus smaller freezes by Ripple of its RLUSD stablecoin and by World Liberty Financial of USD1. Even Arbitrum's security council moved stolen ETH and ARB into a frozen wallet. Binance later put the total frozen at roughly $3 billion.
Most people are cheering, because it is a thief's money. But notice what just happened: a handful of companies decided money on a public blockchain could no longer move, and switched it off in minutes, with no court involved. That is how a central bank digital currency would work, and it works the same way on an innocent wallet as on a hacker's. We explain the comparison in CBDCs versus cryptocurrency and the issuer controls in USDT versus USDC.
The 18,270 BTC are a different story. Nobody could freeze them, because no company controls Bitcoin. That cuts both ways, and the thief still holds them. TRM says the attacker still controls more than 420,000 ETH and the full 18,270 BTC, worth about $2.4 billion.
Did the hacker use Aave, and is there bad debt?
Yes, the attacker used Aave, the largest crypto lending platform, to swap stablecoins that could be frozen for ETH that could not. According to Aave's risk team, one wallet linked to the attacker supplied 60 million USDT between 20:58 and 21:01 UTC and borrowed 19,762 WETH, worth about $44.6 million, against it.
There is no bad debt. The loan is over-collateralised, with about $59.9 million of USDT backing about $43.8 million of debt, and Aave says suppliers are not at risk. Its emergency guardians still froze 175 markets on Aave V3 across 16 networks and 117 on Aave V4, which blocks new deposits and borrowing while repayments and withdrawals carry on.
The risk to watch is the next case. If a stablecoin issuer freezes collateral that is sitting inside a lending pool, that loan cannot be liquidated, and the loss can land on ordinary depositors who had nothing to do with the hack. Our guide to how crypto liquidation works explains why that matters.
What scams will follow the Binance hack?
Fake Binance support, on a scale we have not seen before. Every major exchange incident is followed by a wave of impersonation, and this one gives scammers the perfect script: "your account was affected", "claim your compensation", "your funds must be moved to a safe wallet before withdrawals reopen". Expect emails, texts, phone calls and messages on Telegram and WhatsApp, many of which will know your name and email, because exchange customer data has leaked many times over the years.
This time a lot of it will be automated. AI can now write a flawless email, clone a calm, professional voice, and hold thousands of convincing conversations at once. If Binance itself was undone by one compromised laptop, assume the messages coming for you will look and sound real. Keep these rules:
- Binance will not call you. If someone contacts you first, claiming to be Binance or any exchange, treat it as a scam and end the conversation.
- Nobody legitimate asks for your seed phrase, your 2FA code or remote access to your computer. Not support, not a refund team, not law enforcement.
- No refund requires you to send crypto first. Binance says it will cover losses itself, and nothing about this hack needs action from you.
- There is no "safe wallet". Any instruction to move coins to an address someone gives you is theft in progress.
- Go to the source yourself. Type binance.com into your browser or open the official app. Never click a link in a message about the hack.
We break down the tactics in detail in our guide to fake crypto support scams, and the wallet-draining links that often come with them in token approval phishing explained. If you are unsure about a message, you can paste it into Ask Crypto AI and ask whether it looks like a known scam pattern before you reply.
What should you do now?
Sit tight on Binance, stay sceptical of every message, and use this as the push to fix where your coins live. If your crypto is not being actively traded, it should not be sitting on any exchange, Binance or otherwise.
- Do not panic or chase rumours. Binance says customer balances are covered, and fake "urgent" withdrawal tools are the bigger danger this week.
- Turn on app-based 2FA and an anti-phishing code in your exchange security settings if you have not already. The code appears in genuine Binance emails, so a message without it is fake.
- When withdrawals reopen, move long-term holdings to a wallet you control. Send a small test transaction first, then the rest. Our guide to self custody for Bitcoin walks through it.
- Protect your recovery phrase properly. Write it down offline and never type it into a website. See what a seed phrase is and how to store it.
- For larger amounts, remove the single point of failure. Binance lost billions to one compromised laptop. A multisig wallet needs two of three keys, on separate devices in separate places, so one stolen key or one fooled person is not enough.
Heidi explains why one hardware wallet is not enough in her multisig video. For more on staying safe, browse the Scams and Risk hub.
Frequently asked questions
How much was stolen in the Binance hack?
About $6.36 billion, according to TRM Labs, valued at the time of the theft on 29 October 2026. The money came from Binance hot wallets on ten blockchains, led by about $3.79 billion on Ethereum and 18,270 BTC worth about $1.47 billion. Binance's own estimate is about $6.3 billion. It is the largest crypto theft on record.
Who hacked Binance?
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state hacking unit that the FBI also blamed for the 2025 Bybit theft. No government has confirmed the attribution for the Binance hack yet, and Binance has not named the attacker, so it remains the leading theory rather than an official finding.
How did the Binance hack happen?
Binance's preliminary investigation says a DevOps engineer's compromised laptop may have let the attacker reach a service container and submit unauthorised withdrawals. Binance says it found no evidence that wallet private keys leaked. On Ethereum the attacker used an EIP-7702 delegation to take control of a hot wallet. A full post-mortem has not been published yet.
Is my money safe on Binance after the hack?
Binance says user funds are safe and that it will cover all losses from its SAFU fund and company money. The theft hit Binance's own hot wallets rather than customer balances. Withdrawals were suspended after the hack, and Binance said on 30 October it expected them to resume within 48 hours. Until then you cannot move funds out.
Will Binance contact me about the hack?
Assume any call, text, email or direct message about the hack that you did not ask for is a scam. Genuine support never asks for your seed phrase, 2FA codes or remote access, and never asks you to move funds to a safe wallet. Check news and your account only through the official Binance app or by typing binance.com yourself.
Why could Tether freeze the stolen USDT but not the Bitcoin?
Tether and Circle control their stablecoin contracts and can block any address, so they froze billions within hours of the theft. Bitcoin has no issuer and no freeze function, so the 18,270 BTC could not be stopped by anyone. The same power that froze a hacker's stablecoins can be used on any ordinary holder's wallet.
Did the Binance hacker cause bad debt on Aave?
No. The attacker supplied 60 million USDT to Aave and borrowed 19,762 WETH, about $44.6 million, against it. Aave says the position is over-collateralised, so there is no bad debt and suppliers are not at risk. Aave still froze close to 300 markets across its networks as a precaution while the stolen funds keep moving.
Keep learning
- Fake Crypto Support Scams: How the Con Works
- How to Tell If a Crypto Exchange or Wallet Is Safe
- How to Self-Custody Bitcoin in 2026: The $100 Setup and the Next Steps Up
- How to Set Up a Multisig Wallet: Bitcoin and Ethereum, Step by Step
- CBDCs vs Cryptocurrency: Central Control vs Financial Freedom
- More guides in the Scams and Risk hub
- Free headlines: the Learning Crypto news feed on Telegram
