Quick Answer
Binance says about $6.3 billion in token assets was stolen after hot wallets were compromised on October 29, 2026. The exchange says it will absorb losses and has temporarily suspended withdrawals while remediation proceeds. Users should avoid unsolicited recovery messages, verify account notices through Binance’s official channels, and wait for withdrawal status updates before making a transaction.
Key Takeaways
- Binance says hot wallets were compromised at about 20:05 UTC on October 29, 2026.
- Binance estimates the stolen token assets at about $6.3 billion.
- Binance says customer losses will be covered through company funds and its Secure Asset Fund for Users.
- Binance temporarily paused withdrawals while deposits and unaffected services remained available.
- TRM Labs estimates that assets moved across 10 blockchains in about 20 minutes.
What happened in the Binance hack?
The Binance hack involved the compromise of the exchange’s hot wallets, which Binance says led to the theft of about $6.3 billion in token assets. Binance said the compromise occurred at about 20:05 UTC on October 29, 2026, and the company temporarily suspended withdrawals on October 30 while it conducted security reviews and remediation. Deposits and unaffected platform services remained operational during the withdrawal pause.
Binance initially said its investigation pointed to a compromised laptop, but the company later said it had identified additional breach points. Binance also said it had found no evidence that wallet private keys leaked. That distinction matters because the company’s statement addresses the wallet infrastructure under investigation, but it does not remove the need for account holders to remain alert for phishing attempts that use the incident as a pretext. Binance’s Security Incident Update #2 describes the company’s stated timeline and remediation position.
The Binance withdrawal pause is a platform-level response rather than a direction for users to move funds through unofficial channels. The practical response is to check withdrawal availability only through the Binance app or website and to avoid links sent through text messages, email, or social media accounts claiming to offer early access to funds.
How much was stolen from Binance’s hot wallets?
Binance estimates that about $6.3 billion in token assets was stolen, while TRM Labs estimates that $6.36 billion left Binance wallets across 10 blockchains. The two figures are close but come from different assessments: Binance provided the company estimate, while TRM Labs analyzed the movement of assets on public blockchains.
TRM Labs said the assets left Binance wallets in about 20 minutes and attributed the theft to the North Korea-linked TraderTraitor group with high confidence. The attribution is an assessment by TRM Labs, not a public legal finding. The scale and speed of the transfers show why blockchain tracing, issuer freezes, and exchange coordination became central parts of the response. TRM Labs’ blockchain analysis sets out its estimate and attribution.
| Reported measure | Amount or scope | Source and significance |
|---|---|---|
| Estimated stolen assets | About $6.3 billion | Binance’s estimate of the token assets taken from compromised hot wallets. |
| Assets leaving wallets | $6.36 billion across 10 blockchains | TRM Labs’ estimate of transfers observed over about 20 minutes. |
| Assets frozen on-chain | About $3 billion | Binance’s stated result from work with law enforcement, issuers, and industry partners. |
| Assets without an issuer freeze option | About $2.4 billion | TRM Labs’ estimate of assets the attacker held that could not be frozen by an issuer. |
The different figures should not be treated as interchangeable proof that all stolen assets have been recovered. Asset tracing can show movement and identify tokens that issuers can freeze, but the ability to freeze an asset depends on the token and its issuer controls. Users should rely on Binance’s withdrawal notices rather than interpreting individual blockchain transactions as confirmation of account access or reimbursement.
What does Binance say about customer losses?
Binance says it will absorb the losses rather than pass them to users. On October 30, 2026, Binance said it would use its Secure Asset Fund for Users and corporate treasury to cover the incident’s losses. Binance also said it had set aside more than $6.34 billion in company funds, including $5 billion in the same token assets affected by the breach.
Binance described the amount it had set aside as roughly 80% of the amount needed at that point. The company’s use of “at that point” is important because the value of token assets can change and the final amount needed depends on the ongoing incident review. The public commitment means Binance has stated that users will not bear the stated losses, but users should still monitor official account communications for the operational details that apply to withdrawals and balances.
Independent coverage has also documented Binance’s statement that the exchange would use company resources to address the incident. AP’s report on the Binance security incident provides additional reporting on the breach and the company’s response.
Binance customers should be cautious about anyone claiming that a separate payment, wallet connection, seed phrase, or remote-access session is required to receive protection. Binance’s stated plan concerns the exchange’s own funds and remediation process. A request to move money or reveal recovery information should be treated as suspicious until verified through an official Binance support route.
Why were withdrawals suspended after the Binance breach?
Binance suspended withdrawals to complete security reviews and remediation after the hot-wallet compromise. The exchange said deposits and unaffected platform services remained operational, but it targeted a phased withdrawal resumption within about 34 hours, subject to security checks. The stated target was not an unconditional deadline because the company tied the resumption to the completion of those checks.
The Binance withdrawal suspension affects users differently depending on whether they need immediate transfers, trading access, or deposit confirmation. The main limitation is that a user may see a balance and still be unable to move assets until the relevant withdrawal route returns to service. The most sensible approach is to avoid repeated transfer attempts and to wait for a confirmed status update inside the official account interface.
Security incidents also create an environment in which fake status pages and impersonation messages can spread quickly. Users who manage other online accounts should review their account recovery practices, particularly after major incidents such as the CAPCOM ID email exposure, where breach-related information can be used to make impersonation attempts more convincing. The Binance incident does not establish that Binance account credentials were exposed, so users should not assume either exposure or safety without an official account-specific notice.
What assets have Binance and partners frozen?
Binance says it froze about $3 billion on-chain with assistance from law enforcement, blockchain-intelligence firms, asset issuers, and industry partners. The company presented the freeze figure on October 30 as part of its response to the theft. A freeze can prevent movement of certain assets, but it does not automatically mean those assets have been returned to Binance or credited to users.
TRM Labs gave a narrower breakdown of the issuer-controlled response, stating that stablecoin issuers and the Arbitrum Security Council had frozen nearly $2.7 billion. TRM Labs also said the attacker still held roughly $2.4 billion in assets without an issuer able to freeze them. The difference between a freeze and a recovery is important because frozen assets can remain subject to investigation, legal processes, or technical coordination before their status changes.
Reuters also reported on issuer freeze activity following Binance’s security incident. Reuters reporting on the asset freezes provides additional context on the role of token issuers in restricting transfers.
For most Binance users, the frozen-asset totals are useful as indicators of the response’s scope, not as instructions for self-help action. Users should not attempt to trace stolen funds, contact wallet addresses, or interact with unknown recovery services. The exchange, issuers, law enforcement, and blockchain-analysis firms are the parties Binance identified as participating in the response.
When could Binance withdrawals resume?
Binance said it was targeting a phased resumption of withdrawals within about 34 hours, subject to security checks. The October 30 target describes Binance’s intended restoration schedule, but the company did not present it as a guarantee that every network, token, or account function would return simultaneously. A phased restart can mean that some withdrawal routes become available before others.
Binance also said it planned a proof-of-reserves snapshot by November 2. A proof-of-reserves snapshot is intended to document assets at a particular point in time, but Binance’s announcement does not establish the final scope or results before that date. Users should treat the planned snapshot as a future transparency step rather than an immediate confirmation that all incident questions have been resolved.
The practical action is to check the withdrawal page for the specific asset and network you use. Users should not rely on screenshots, reposted statements, or claimed timelines shared through third-party accounts. Similar caution applies when security notices involve browser or device updates, including situations where users need to install a critical Chrome security update from the official product channel rather than an unsolicited prompt.
What should Binance users do after the security breach?
Binance users should verify account notices through official Binance channels, avoid unsolicited recovery offers, and wait for confirmed withdrawal status updates before making a transfer. Binance says deposits and unaffected services remained operational, but withdrawals were paused for security reviews. The safest interpretation is that normal account activity should be limited to necessary actions until the exchange confirms the relevant service has resumed.
- Open the Binance app or type the official Binance website address directly into your browser.
- Check the withdrawal status for the specific token and network you intend to use.
- Review Binance’s official security incident notices before responding to any message about the breach.
- Ignore requests for seed phrases, private keys, remote access, or a payment to unlock funds.
- Contact Binance through its official support options if your account shows an unexplained change or you receive a notice you cannot verify.
Binance’s statement that it found no evidence of leaked wallet private keys is limited to the company’s investigation findings as of October 30. The statement does not make unsolicited messages trustworthy, and it does not mean users should share recovery information with anyone. Users should stop and use official Binance support if an unfamiliar party asks for account credentials, recovery phrases, or a transaction intended to “secure” assets.
Account security also depends on where users enter sensitive information. Consumers should be particularly careful with messages that imitate security warnings, an approach also addressed by scam detection for complex text messages. The appropriate response to a suspicious message is to close it and independently open the official service, not to reply or use the embedded link.
FAQ
Did Binance say users would lose money from the hack?
No, Binance says it will absorb the losses rather than pass them to users. Binance said it would use its Secure Asset Fund for Users and corporate treasury, although users should still follow official account notices for operational updates.
Were Binance private keys stolen?
Binance says it found no evidence that wallet private keys leaked. Binance also said its investigation uncovered additional breach points after initially identifying a compromised laptop, so the investigation remained active.
Why did Binance pause withdrawals?
Binance paused withdrawals for security reviews and remediation after the hot-wallet compromise. Binance said deposits and unaffected platform services remained operational while the withdrawal pause was in place.
How much did TRM Labs estimate was stolen in the Binance breach?
TRM Labs estimated that $6.36 billion left Binance wallets across 10 blockchains in about 20 minutes. TRM Labs attributed the theft to the North Korea-linked TraderTraitor group with high confidence.
When did Binance plan to restore withdrawals?
Binance targeted a phased withdrawal resumption within about 34 hours, subject to security checks. Binance did not describe that target as a guarantee that every asset and network would resume at the same time.