Binance's $6.3 billion hack: am I affected, and what should I do?
Quick answer
Update (Oct 30, 6:45 PM CT): Binance’s investigation has found a wider breach than the single compromised laptop it first suspected. Co-CEO Richard Teng said the attackers erased evidence and took control of a hot wallet without going through Binance’s normal approvals. Withdrawals are still paused. Binance is targeting a restart on Sunday, Nov 1. That’s a target, not a guarantee (CoinDesk).
On October 29, 2026, attackers moved about $6.3 billion (Binance’s estimate) out of Binance wallets in unauthorized withdrawals. Chainalysis, which puts it at $6.4 billion, calls it the largest hack in crypto history (Chainalysis). Binance says user funds are safe and it will cover all losses. Withdrawals are still paused; deposits work normally (Binance). Binance is now targeting Sunday, Nov 1 to restart withdrawals (CoinDesk). If you have a Binance account, you don’t need to do anything except wait for official updates and ignore “recovery” offers.
Am I affected?
Who’s affected
- Binance customers: you can’t withdraw right now. Binance says it will cover losses from its SAFU fund and company funds (Binance).
- Everyone else: no direct impact. This was a breach of Binance’s own systems, not a bug in an app or device you run.
What to do (60 seconds)
- Get updates only from Binance’s official site, app or @binance on X (Binance).
- Ignore anyone offering to “recover” or “unlock” your funds for a fee, and never share passwords, recovery phrases or private keys (CyberInsider).
- Our advice: turn on phishing-resistant sign-in (a passkey or security key) for any exchange account, and watch for emails pretending to be Binance support.
What happened
- When: funds began leaving Binance hot wallets around 4:20 PM ET on Oct 29 (Chainalysis). TRM Labs says most of about $6.36 billion moved across 10 blockchains within roughly 20 minutes (CNBC).
- How (so far): Binance’s initial investigation suggests a compromised DevOps engineer’s laptop let an attacker reach a service container and submit unauthorized withdrawals. Binance says it has found no evidence of a wallet private key leak and will publish a technical post-mortem (Binance). On Oct 30 it added that its investigation had uncovered “additional points of breach” beyond the laptop, calling it “a complex attack” (Decrypt).
- Who: TRM Labs (high confidence) and Chainalysis attribute it to TraderTraitor, a North Korean state-backed group (CNBC; Chainalysis). Binance hasn’t named the attacker.
Where things stand (as of Oct 30, 2026, 9:50 AM CT)
- Frozen: about $3 billion on-chain, per Binance. Frozen isn’t the same as returned (Binance).
- Covering losses: Binance said on X Oct 30 it has reserved over $6.34 billion of company funds, $5 billion of it already in the exact tokens affected (Binance on X).
- Withdrawals (updated 6:45 PM CT): still paused while Binance rebuilds and tests its systems. Co-CEO Richard Teng said Friday the exchange hopes to resume withdrawals by Sunday, Nov 1. That’s a target, not a guarantee (CoinDesk). Deposits remain unaffected (Binance).
- Recovery: Binance said on Oct 30 it has “begun recovering affected assets for users” (BBC).
- Proof (updated 6:45 PM CT): Binance plans an initial proof-of-reserves update, then a full report Monday, Nov 2 (CoinDesk).
Why it matters
- Attacks on exchanges aren’t new, only this scale is. Chainalysis says every exchange should stay “vigilant and prepared to respond quickly” (Chainalysis).
- Stablecoins can be frozen by their issuers; bitcoin and ether can’t, so recovering those means tracing them to cooperating platforms (CNBC).
FAQ
- Is my Binance money gone? Binance says user funds are safe and it will cover all losses.
- When can I withdraw? Not yet. Binance is targeting Sunday, Nov 1 to restart withdrawals, but that’s a target, not a guarantee. Check official channels.
- Was my password leaked? Binance hasn’t reported any customer account data exposure. Binance first pointed to an employee laptop and has since found “additional points of breach.”
- Who did it? Blockchain firms point to North Korea’s TraderTraitor; Binance hasn’t confirmed.
This is not financial advice.