Binance Hit by Record $6.3 Billion Hack: What We Know and What Users Should Do

What happened

Funds began leaving Binance hot wallets across multiple blockchains at about 4:20 p.m. US Eastern time on Thursday, October 29, which was 21:20 in Vienna, according to Chainalysis. Reuters reports that the bulk of the theft unfolded in around 20 minutes. Binance puts the total impact at roughly $6.3 billion, Chainalysis at about $6.4 billion. The BBC describes it as believed to be the largest crypto hack ever. Binance.us, the exchange for US residents, said it was not affected.

Binance’s initial investigation points to a compromised laptop of a DevOps engineer. That gave an attacker access to a service container, where unauthorized withdrawal transactions were submitted. Binance says it has found no evidence of a wallet private key leak (Binance announcement). Co-CEO Richard Teng added that the attack was not carried out by one person, that the attacker used a delegation on a hot wallet that did not pass Binance’s normal approval controls, and that malicious software erased traces as it went (BBC live coverage, Reuters).

Timeline (Vienna time)

• Thu 29.10., about 21:20: funds start leaving Binance hot wallets (Chainalysis).
• Thu 29.10., about 22:14: the first freezes by industry partners begin (Chainalysis).
• Thu 29.10., late evening: Binance publishes a security incident notice, suspends withdrawals and says user funds are safe.
• Fri 30.10., about 05:30: Chainalysis announces it attributes the attack to the North Korean group TraderTraitor.
• Fri 30.10.: Binance says it is rebuilding the withdrawal service and expects to resume it within about 40 hours, with a full Proof of Reserves report due by Monday.

Are Binance user funds safe?

Binance says yes. In its statement it says it will cover all losses from the SAFU fund and company funds, and Teng wrote on X that Binance never uses customer funds. According to Reuters, Binance has set aside around $6.34 billion of company funds to cover the losses. Deposits are unaffected, while withdrawals stay paused until the rebuilt service passes testing. These are Binance’s own assurances. The independent Proof of Reserves report promised for Monday is the first thing that can back them up. Binance has also not published a list of affected accounts (BBC).

On the recovery side, Binance says about $3 billion has been frozen. Chainalysis counts about $2.8 billion. Reuters reports that Tether froze nearly $1.57 billion and Circle more than $800 million. Reuters notes that Binance did not say what happened to the remaining $3.3 billion.

Who is behind it?

This is not confirmed. TRM Labs and Chainalysis both say they are highly confident that North Korea’s TraderTraitor unit, part of the Lazarus Group, is responsible. Chainalysis points to stolen Binance funds mixing on-chain with funds from last month’s Bitget theft, which was also attributed to North Korea. CoinDesk quotes a person familiar with the investigations who cautioned that the hack is not definitively attributed yet. The FBI says it is aware of the incident and working with partners, and North Korea routinely denies such attacks (Reuters).

What users should do now

This is general security advice, not financial advice.

• Check your balance, transaction history and security notices only in the official Binance app or on the website address you already trust.
• Ignore unsolicited messages. Scammers are expected to exploit the situation with fake support accounts, emails claiming your funds are at risk, or requests to move coins to a “safe” wallet (BBC).
• Never share your password, verification codes or recovery phrase with anyone, including anyone claiming to be Binance support.
• Turn on an anti-phishing code in your Binance security settings and use an authenticator app or passkey instead of SMS codes (Binance security guide).
• If you notice anything unusual, log out of all sessions, review your security settings and change your password. Note that a clean account view does not by itself prove nothing happened.

Account security matters well beyond crypto. Our report on the Capcom ID data breach covers the same basics for gaming accounts.

What we know and what we do not know yet

• Confirmed by Binance: the incident, an estimated $6.3 billion impact, a likely compromised DevOps laptop, paused withdrawals, around $3 billion frozen, and the promise to cover all losses.
• Reported by analysts, not officially confirmed: the North Korean attribution.
• Still open: the full attack path, the fate of the remaining unfrozen assets, the exact restart time for withdrawals, and the independent proof that reserves cover all customer balances. Binance has promised a detailed post-mortem once its investigation is complete.

FAQ

Is my money on Binance safe?

Binance says user funds are safe and that all losses will be covered from its SAFU fund and company funds. Independent verification is still outstanding until the Proof of Reserves report is published.

When can I withdraw again?

Binance targets a restart within about 40 to 45 hours of its Friday updates, so by Sunday, but says it will only switch the service back on once it passes rigorous testing. Deposits work normally.

How big is the hack compared with earlier ones?

Analysts describe it as the largest crypto theft ever. The 2025 Bybit hack, which the FBI attributed to North Korea, was about $1.5 billion.

Should I move my crypto away from Binance?

We cannot give financial advice. Whatever you decide, only act through official apps and websites, and be careful with anyone who urges you to move funds quickly.

Sources: Binance, Reuters, BBC, BBC live, CoinDesk, Chainalysis, Cointelegraph. Status as of Friday, October 30, 2026, around 17:30 Vienna time. We will update this article as Binance publishes more.