The Binance hack that unfolded on 29 October 2026 has become one of the largest suspected cryptocurrency thefts ever reported, with Binance estimating the total impact at about $6.3 billion and saying about $3 billion in crypto assets had been frozen. Binance, the world’s largest cryptocurrency exchange, suspended withdrawals, promised to cover all losses, and said user funds remain safe — even as how the attacker got in remains unconfirmed. Withdrawals began reopening in phases on 1 November, starting with 15 networks including Bitcoin. This explainer separates what Binance and its partners have actually said from what outside analysts estimate, and what it means if you hold crypto on the exchange.
What happened in the Binance hack?
Reports of the Binance hack began on the afternoon of 29 October 2026, Eastern Time in the United States. Miguel Morel, chief executive of blockchain intelligence firm Arkham, told Reuters that data indicated billions of dollars appeared to have been taken by an unknown actor, although the exact cause had not been confirmed, and that the incident began at around 4:30 p.m. Eastern Time and appeared to be ongoing at that stage. Binance itself did not use the word “hack” in its first public language. It described a “potential security issue” under investigation, while its co-founder Changpeng Zhao — who no longer runs the company but remains its largest shareholder, according to The Wall Street Journal — wrote on X that the incident “looked like a hack” and that user funds were safe.
CoinDesk, citing Etherscan records, reported that the attack centred on a hot wallet labelled “Binance 14”. It said the attacker used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software, and that after getting Binance 14’s key to sign that permission, the attacker turned the wallet into a sweeper that forwarded incoming funds to the attacker’s own address. Etherscan records cited by CoinDesk show 167,464 ETH moving from Binance 14 at 20:24 UTC, followed by 28,005.6 ETH from another wallet, Binance 16, into the attacker’s wallet. Binance has not itself confirmed that mechanism, and readers should treat it as a reported technical account, not as Binance’s confirmed explanation. A full post-mortem has been promised once the investigation is complete.
Binance moved quickly to shut the doors. It paused withdrawals at 22:15 UTC, suspended trading on its Binance Alpha platform as a precaution, and then suspended all deposits and withdrawals while its team conducted security checks, froze funds and worked with law enforcement. That sequence matters: freezing assets only helps if the stolen tokens cannot be moved on, so halting deposits as well as withdrawals was aimed at stopping further movement while compromised wallet permissions were cleared. Binance later said deposits were operating normally and withdrawals would resume in phases from 1 November. The first phase, covering 15 networks including Bitcoin, began on 1 November between 06:00 and 09:00 UTC, after Binance said it had covered about $6 billion of the $6.3 billion stolen.
How much was stolen in the Binance hack — and how much is frozen?
There are two different numbers in this story, and confusing them is the easiest way to misunderstand the Binance hack. The first is the amount frozen. Binance said in an update at 00:52 UTC on 30 October 2026 that “the current verified total frozen amount is around $3 billion”, up from $2.54 billion at 23:22 UTC the previous evening. Binance said the frozen total could increase as it worked with law enforcement agencies, token issuers, blockchain intelligence firms and other industry partners to trace and freeze additional assets. The frozen assets were mostly stablecoins, whose issuers can blacklist an address and trap the tokens inside it.
The freeze was a joint effort across the crypto industry. Tether, issuer of the USDT stablecoin, said it had frozen nearly $1.57 billion in assets linked to the incident. Circle, issuer of USDC, froze more than $800 million. Binance co-founder Yi He said crypto firm Ripple had frozen roughly $200 million, and that World Liberty Financial had frozen $27 million in stablecoins and about $2 million worth of its own World Liberty tokens, working with custodian BitGo. The Arbitrum Security Council separately said it had executed a transaction to freeze about $30.5 million, involving 74.6 million Arbitrum (ARB) tokens and 8,425 Ether, moving them to an intermediary frozen wallet. First Digital also confirmed it had frozen FDUSD involved in the attack.
The second number — how much was actually stolen — now has Binance’s own estimate. On 30 October Binance said the estimated total impact was around $6.3 billion, with about $3 billion frozen on-chain. TRM Labs traced about $6.36 billion leaving Binance wallets and Chainalysis estimated $5.9 billion stolen; the estimates differ because analysts count different blockchains, time windows and token types. Binance said it will cover all losses from its SAFU fund and company funds, and will publish an updated Proof of Reserves by 2 November. Until the post-mortem, the $6.3 billion should be treated as Binance’s estimate, not a final audited loss.
Are Binance user funds safe after the hack?
Binance’s answer has been consistent and direct. Co-founder Yi He said: “Binance will cover all hacking losses.” Chief executive Richard Teng wrote: “User funds remain SAFE.” A Binance spokeswoman told The Wall Street Journal: “Rest assured that user funds are completely safe.” Changpeng Zhao added that he expected users to be fully recovered. In practice, as CoinDesk explained, that means customers’ balances will be honoured even though assets behind them were stolen. Binance also runs a Secure Asset Fund for Users, known as SAFU, a reserve held entirely in bitcoin and intended to protect user assets in the event of security breaches. CoinDesk reported that the SAFU fund holds around $1 billion in bitcoin, which could be used to offset losses.
There is, however, an important qualification that CoinDesk’s review of Binance’s own reserve data raised. The wallets emptied in the incident are the same wallets Binance lists as proof that customers’ crypto is fully backed. Binance publishes a monthly list of the wallets it controls and compares those totals with what customers hold. Its most recent report, dated 1 October 2026, included the “Binance 14” wallet, which at that time held 1.26 billion USDT and 89,475 ETH among 37 assets. On 1 October, Binance held exactly enough ETH to cover customer balances — a 100% reserve ratio — and 108.26% of customers’ USDC. CoinDesk estimated that the roughly 204,500 ETH taken would leave ether backing near 94%, with USDC and several other assets also likely below 100%, until Binance replaces what was taken. That is an outside estimate based on the 1 October snapshot, not a figure Binance has confirmed, and Binance’s next reserve snapshot, due on 1 November, will show whether it has replaced the missing assets. For now, “user funds are safe” is Binance’s pledge that balances will be honoured, not independent proof that every backing asset is untouched.
Why frozen crypto is not the same as recovered crypto
When a stablecoin issuer freezes stolen funds, it blacklists the hacker’s wallet address for that token. The tokens cannot be moved, transferred or cashed out, which traps them before the hacker can convert them into other cryptocurrencies or launder them through a mixer. That is powerful, and it explains why the frozen total rose by roughly $460 million in about 90 minutes overnight. But frozen is not recovered. Blacklisted USDT and USDC stay where they are until the issuer reissues or burns them, usually after law enforcement or a court confirms ownership — a process that can take weeks. The same applies to other frozen assets held in intermediary wallets under the control of a security council or governance vote.
So the rising frozen total is good news for limiting the hacker’s ability to profit, but it does not by itself put the money back in Binance’s wallets or restore normal service. The gap between the frozen total and the highest stolen estimates — potentially billions of dollars on the Chainalysis and TRM Labs figures — is the amount Binance would need to cover from its own resources, including SAFU, if those estimates prove right. That is why Binance’s pledge to cover all losses matters more than any single frozen figure, and why its promised post-mortem and confirmed loss total are the next numbers to watch.
Can Binance users withdraw money now?
Partly — yes, for some networks. Binance began reopening withdrawals in phases on 1 November, starting between 06:00 and 09:00 UTC with 15 networks including Bitcoin, Ether, XRP and Dogecoin. Withdrawals on other networks remain suspended while Binance completes further security checks. Deposits are operating normally. That means users on the reopened networks can now move assets off the exchange through normal withdrawal routes, while users on other networks still cannot. Trading on Binance Alpha was also temporarily suspended as a precaution. Binance has not said in its updates cited here whether spot and futures trading continued throughout, so users should check Binance’s own status updates rather than assume trading was or was not available.
One important distinction is Binance.US. Binance.US, a separate cryptocurrency exchange, said it was not affected by the security incident. Coinbase said it was unaffected and was monitoring the situation, according to Reuters. Those statements cover those separate platforms only; they do not change the position for users of the main Binance exchange, where withdrawals are reopening in phases. If you use Binance.US, the incident as reported does not mean your platform was hit — but always verify through the official channel for the platform you actually use.
What the Binance hack did to Bitcoin, BNB and crypto prices
Cryptocurrency prices fell in early Asian trading on Friday 30 October 2026, after Binance reported the potential security issue. Reuters reported that Bitcoin dropped to a six-week low of $77,646, ether fell to a two-month low of $2,238.76, and BNB — the token originally launched as Binance Coin — was down more than 8% over the past 24 hours at $694, according to market aggregator CoinGecko. Bitcoin below $80,000 in 2026 had already been under pressure before this incident, so the hack landed in a market that was already nervous. The price falls followed the reports; they do not by themselves prove how large the theft was.
The disruption spread beyond Binance itself. Cointelegraph reported that Aave, a lending platform, froze new deposits and borrowing across its community-operated V3 and V4 markets as a precaution. That kind of precautionary freeze is common after a major exchange incident: other platforms tighten up while they check whether any of their own systems, shared infrastructure or connected wallets could be affected, even when there is no claim they were attacked. Prices and precautionary freezes can reverse quickly if Binance reopens withdrawals with a credible post-mortem, or worsen if the confirmed loss proves larger than the frozen total. Either way, short-term price moves are not a reliable guide to what individual users will ultimately recover.
Who is behind the Binance hack — and what is still unconfirmed?
Binance has not named an attacker or confirmed how the breach happened. Cybersecurity research firms TRM Labs and Pangolin Intelligence told The Wall Street Journal that the heist appears to have been conducted by North Korea’s TraitorTraitor hacking group, which they said has been behind many of the largest crypto hacks in recent memory. That attribution was initially an assessment by outside research firms, reported by the Journal. On 1 November the FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack. TRM Labs has put that attribution at high confidence, and Chainalysis reached the same conclusion; Binance itself has not named an attacker.
Two separate incidents should not be merged into one story. Hours earlier, prediction-market platform Polymarket disclosed its own hack, in which at least $2.6 million in user funds were drained, and temporarily halted trading after a security incident involving a third-party provider, according to Reuters and The Wall Street Journal. Nothing in the reporting cited here links the Polymarket incident to the Binance incident, and they involved different companies and different amounts. For scale, if the highest outside estimates for Binance prove correct, the incident would dwarf the previous record for a crypto exchange theft: $1.5 billion stolen from Bybit in 2025 in a North Korea-linked hack, according to The Wall Street Journal and TRM Labs. The Wall Street Journal described the Binance incident as what appears to be the biggest cyber heist in history — a characterisation that depends on the final confirmed total, which Binance has not yet published.
What happens next in the Binance hack investigation?
Binance has promised a full post-mortem once the investigation is complete, and said it is working with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets. Three things are worth watching in the coming days. First, Binance’s own confirmed loss figure, which would replace the conflicting outside estimates. Second, the post-mortem itself: how the attacker gained control, whether the EIP-7702 account reported by CoinDesk was the route in, and what has changed to prevent a repeat. Third, a timeline for reopening deposits and withdrawals, and the 1 November reserve snapshot, which will show whether Binance has replaced the assets CoinDesk estimated were missing from its backing.
Until then, the picture will keep moving. The frozen total rose fast overnight, and it may rise further as more issuers and chains act. Equally, new estimates of the amount stolen may appear. Treat any single social-media figure as provisional unless it comes from Binance itself, a named issuer such as Tether or Circle, or a named tracing firm, and check the time it was posted: figures from the first hours of the incident were repeatedly superseded within the same evening.
What Binance users should do now
Do not panic, and do not act on unofficial messages. Scammers routinely impersonate exchanges after a major incident, offering fake “recovery”, “refund” or “support” links. Binance support will never ask for your password, seed phrase or two-factor authentication codes, and no genuine recovery process will ask you to send crypto to a new address to “unlock” your funds. Use only Binance’s official app, website and verified social accounts for updates on withdrawals, and be especially cautious of direct messages, search ads and lookalike accounts.
Keep your own records: screenshots or notes of your balances, any Binance messages you received, and the times deposits or withdrawals were attempted, in case you need them later. Do not try to work around the suspension through unofficial routes, and do not make large trading decisions based on a single unconfirmed loss figure. This article is an explainer, not financial advice. If the sums involved are significant for you, consider independent professional advice once Binance has published its confirmed figures and reopening plan. The key facts to wait for are the confirmed loss total, the post-mortem, and a reopening time — everything else, for now, is either a pledge, a freeze, or an estimate.
The Binance hack, trending per news coverage on 30 October 2026, is a reminder of how much of the crypto market still runs through a small number of very large exchanges. Binance serves more than 300 million registered users globally and held about $160 billion in assets under custody, according to its 2024 annual report as cited by Reuters. When an exchange of that size suspends withdrawals, the effects reach far beyond its own users — into prices, into other platforms’ precautions, and into the wider question of how safely customer assets are backed. Whether this incident becomes the largest crypto theft on record will be decided by the confirmed figures Binance has yet to publish, not by the first night’s estimates.
Sources: Reuters reporting on Tether and Circle freezing more than $2.38 billion, on cryptocurrency prices falling after Binance reported a security issue, and on Binance’s user numbers and Secure Asset Fund; The Wall Street Journal reporting on Binance suspending transactions, the TraitorTraitor attribution assessment by TRM Labs and Pangolin Intelligence, and the Bybit comparison; CoinDesk reporting on Binance 14, EIP-7702, reserve data and the SAFU fund; Cointelegraph reporting on market reaction and Aave’s precautionary freeze; FinanceFeeds reporting on the $2.54 billion to $3 billion frozen updates, withdrawal and deposit suspension times, and the Arbitrum Security Council freeze; TradingView live updates on frozen asset types and First Digital’s FDUSD freeze; Binance statements on X by co-founder Yi He and chief executive Richard Teng, as reported by the outlets above.