NewsNews

Binance $6.3B Hack: Cause, Freezes, Compensation and When Withdrawals Return

On the evening of October 29, 2026, attackers gained access to Binance hot wallets and took about $6.3 billion — the largest hack in crypto history. The exchange has named a preliminary cause, about $3 billion is frozen, $6.34 billion is reserved to cover losses, and withdrawals are to return in phases. Here are the confirmed facts, the timeline and what matters to users.

AuthorAntonio MerklePublishedOctober 29, 2026UpdatedOctober 31, 202611 min read

On the evening of October 29, 2026, attackers gained access to the hot wallets of Binance, the world’s largest crypto exchange. Outflows began around 20:05 UTC; at 21:05 Coinbase senior director Conor Grogan flagged suspicious transfers of up to $5.8B, and at 21:29 Binance said it was investigating. By the morning of October 30 the exchange put the impact at about $6.3B, named a preliminary cause and pledged to cover all losses.

What Binance has said officially

• 21:29 UTC, October 29 — the team is investigating a potential security issue; user funds are “completely safe”.
• 22:15 UTC — withdrawals paused during the checks; at 22:33 the post was repeated with an image. Binance spokesperson Ross O’Leary told TechCrunch the pause was “a precautionary measure”.
• 23:06 UTC — Binance Alpha trading halted.
• 23:22 UTC — $2.54B verified frozen; at 00:52 on October 30 the exchange raised the estimate to around $3B.
• 00:13 UTC, October 30 — “Binance will cover all losses”. The post said all deposits and withdrawals were suspended; at 04:36 the exchange clarified that deposits were unaffected and withdrawals would return “within 48 hours”.
• 02:23 UTC — the first announcement on the cause: about $6.3B impact, about $3B frozen, losses to be covered from the SAFU fund and company funds.
• 08:47 UTC — additional points of breach found; withdrawals “in 45 hours”.
• 10:55 UTC — over $6.34B reserved, $5B of it already held in the exact tokens that were taken.
• 19:58 UTC — the second update: the attack began around 20:05 UTC on October 29, about 80% of losses are already covered with assets in the same tokens, a phased withdrawal restart in about 34 hours, and a Proof of Reserves snapshot with results by November 2.

Binance founder Changpeng Zhao (CZ) wrote in the first minutes that it “does look like a hack”, and on October 30 — “It hurts, but we survive”.

How the hack happened

The investigation is not over, and Binance promises a full technical post-mortem afterwards. This is what the exchange has said officially:

• Preliminary findings point to a compromised DevOps engineer’s laptop. It gave the attacker access to a service container, from which unauthorized withdrawal transactions were submitted.
• According to Binance co-CEO Richard Teng, it was not one employee’s actions and not a “one-click” event but a complex multi-step attack; no individual has been blamed. The attacker used a self-destruct mechanism that wiped tools and traces.
• An EIP-7702 delegation over one of the hot wallets “did not pass through our normal approval controls”. According to TRM Labs and Elliptic, at 20:20 UTC a single transaction with 50 authorizations handed control of the “Binance 14” wallet to the attacker’s contract.
• At 08:47 UTC on October 30 Binance reported additional points of breach. The exchange says it has found no evidence of a wallet private key leak.

On-chain analysts reconstructed the preparation: a day before the attack the operator wallet was funded via Tornado Cash, around 16:00 UTC on October 29 a “sweeper” contract was deployed and rehearsed. First, around 20:05, 233M XRP left; at 20:20 18,270 BTC; at 20:24 167,464 ETH and 1.615B USDT; and between 23:05 and 23:56 the Avalanche and Polygon hot wallets were drained (TRM Labs, Elliptic).

Timeline, October 29–31 (UTC)

1. Oct 29, ~20:05

   The attack begins

   Hot wallets compromised; 233M XRP leaves first.
2. Oct 29, 20:20–20:24

   The largest withdrawals

   18,270 BTC, then 167,464 ETH and 1.615B USDT.
3. Oct 29, 21:01–21:25

   Tether and Circle freeze stablecoins

   On-chain freezes at 21:01 and 21:04; Paolo Ardoino and Jeremy Allaire announce them at 21:18–21:25.
4. Oct 29, 21:05

   First public signals

   Conor Grogan (Coinbase) flags outflows of up to $5.8B.
5. Oct 29, 21:15–21:29

   CZ: “looks like a hack”; Binance investigates

   Binance says user funds are safe.
6. Oct 29, 22:15

   Withdrawals paused

   Until the issue is resolved.
7. Oct 29, 23:05–23:56

   Avalanche and Polygon wallets drained

   According to TRM Labs and Elliptic.
8. Oct 30, 00:13

   Binance pledges to cover all losses

   A post-mortem is promised.
9. Oct 30, 00:52

   About $3B frozen

   Up from $2.54B the evening before.
10. Oct 30, 02:10–02:23

    TRM: TraderTraitor; Binance names the cause

    A DevOps engineer’s laptop, about $6.3B impact.
11. Oct 30, 08:47

    Additional points of breach

    Withdrawals “in 45 hours”.
12. Oct 30, 10:55

    $6.34B reserve

    $5B already in the exact tokens.
13. Oct 30, 13:57

    Aave unfreezes markets

    All V3 and V4 markets.
14. Oct 30, 19:58

    Binance’s second update

    Phased withdrawals in about 34 hours.
15. Nov 1, ~06:00

    Plan: phased withdrawal restart

    Binance’s estimate; the timeline has already shifted.
16. Nov 2

    Plan: Proof of Reserves results

    The first reserve snapshot after the incident.

How much was stolen

Binance’s official estimate is about $6.3B. Independent estimates are close: TRM Labs — $6.36B at the time of theft ($6.23B at current prices), Elliptic — $6.43B, Chainalysis — $6.4B. In the first hours the estimates were lower: Blockaid about $3.3B, Arkham over $5.7B, Lookonchain over $5.8B. Below is Lookonchain’s early breakdown by asset: it shows the composition, not the final total.

What is frozen and where the funds went

Binance puts the freezes at about $3B; Elliptic verified $2.84B as of 12:55 UTC on October 30, Chainalysis about $2.8B. The freezes came from stablecoin issuers: Tether — over 1.567B USDT, Circle — about $823M in USDC, plus Ripple (RLUSD), World Liberty Financial (about $27.8M in USD1) and First Digital (FDUSD). At 00:08 UTC on October 30 the Arbitrum Security Council moved 74.6M ARB and about 8,425 ETH — roughly $30.5M — into a frozen wallet.

The attacker rushed to swap unfrozen stablecoins for ether: by Elliptic’s count, 434M USDT became 160,451 ETH via Uniswap, 1inch and market makers at a 12–26% price loss. On Aave the attacker deposited 59.9M USDT as collateral and borrowed 19,762 ETH; overnight Aave froze its lending markets and at 13:57 UTC on October 30 unfroze all V3 and V4 markets.

Native BTC, ETH, XRP and TRX cannot be frozen by an issuer. Elliptic puts such assets in the attacker’s hands at about $3.23B, including 18,270 BTC; as of October 30, by its data, the bitcoin had not reached any service. Binance has not announced a bounty.

Who is behind the attack

No government has officially attributed the attack, and Binance has not named a perpetrator. The analysts’ conclusions:

• ZachXBT: “It’s likely Lazarus Group” (00:17 UTC, October 30).
• TRM Labs: with “high confidence”, North Korea’s TraderTraitor, the same group behind the Bybit hack.
• Chainalysis: “likely” TraderTraitor; Binance funds were commingled with funds from the Bitget exploit.
• Elliptic: DPRK involvement is likely, but attribution “is not yet certain”, and the Bitget overlap is a small share of the funds.

The FBI, according to Reuters as cited by Cointelegraph and Decrypt, is assessing the scope of the incident with partners.

Compensation and reserves

Binance says it will cover the losses from the SAFU fund and company funds. As of 10:55 UTC on October 30 the exchange had reserved over $6.34B: $5B is already held in the exact tokens that were taken, and the rest is being bought on the market and via OTC. Frozen assets are not included in these figures. Co-CEO Yi He wrote that the exchange is buying the stolen altcoins in matching amounts.

Proof of Reserves: Binance promised the first post-incident reserve snapshot on the morning of October 31 and results by November 2. CoinDesk noted that the drained “Binance 14” wallet was listed in the October 1 reserve report among the wallets backing customer balances. Richard Teng says only the exchange’s own hot wallet was hit. Until the new report, the question remains open.

What this means for Binance users

• Withdrawals. Suspended since the evening of October 29; by our check of Binance’s public API, withdrawals were disabled on all networks as of 04:20 UTC on October 31. The exchange plans a phased restart about 34 hours after 19:58 UTC on October 30 — around the morning of November 1 UTC. The timeline has already shifted: first “within 48 hours”, then “in 45 hours”.
• Deposits. Binance says they are unaffected and working. But while withdrawals are closed, deposited funds cannot be withdrawn — send only what you are ready to keep there until the pause is lifted.
• User funds. Binance pledges to cover all losses from SAFU and company funds and has reserved $6.34B. According to DefiLlama data cited by CoinDesk, the exchange held about $144B in assets before the incident.
• Trading. Only Binance Alpha was officially halted; there has been no announcement of its resumption.
• P2P. There is no official statement about the P2P section. By our check on October 31, Binance P2P ads are displayed, but crypto you buy cannot be withdrawn until the pause is lifted.

What to do now

1. 1

   Don’t send more to Binance than you need

   Deposits work, withdrawals do not. Deposit only what you need for trading inside the exchange.
2. 2

   Follow only official channels

   The @binance account on X, the announcements center on binance.com and the app. Screenshots from chats and “insider tips” are not a source.
3. 3

   Don’t enter data on third-party sites

   Binance does not send “compensation” links in direct messages. Any form asking for a seed phrase or login is phishing.
4. 4

   Postpone P2P trades that require a withdrawal

   Do not release crypto in trades that cannot be completed inside the exchange, and do not agree to “bypass the pause” through third parties.
5. 5

   When withdrawals return, check the network and address

   The restart will be phased, and some networks may lag. Ignore offers to “speed up” a withdrawal.
6. 6

   Rethink how you store crypto

   Keep only what you need for trading on the exchange and the rest in your own wallets.

The largest crypto exchange hack in history

About $6.3B is more than four times the previous record — the Bybit hack of February 2025, about $1.5B, which the FBI linked to North Korea. TRM Labs links the Binance attack to the same group.

Market and regulator reaction

In the first hours bitcoin dipped below $77,000 and BNB lost 6–8% (CoinDesk, Cointelegraph); in CoinDesk’s first estimate ether was down 4% and AAVE 8%. Wintermute CEO Evgeny Gaevoy estimated Binance could absorb a hit 3–4 times larger. CFTC Chair Michael Selig, according to The Block, pointed to the risks of “unregulated offshore exchanges”.

About the author

Antonio Merkle

Crypto expert, arbitrage trader and investor

Crypto expert and hands-on crypto arbitrage trader, investor and software developer with over 20 years of experience. On the P2P.Army blog he covers exchange news, P2P and cross-exchange arbitrage.

• Crypto arbitrage
• P2P arbitrage
• Cross-exchange arbitrage
• Crypto exchanges
• Investing
• Software development

All articles by the author →