# The Binance hack: what happened, what Binance has promised, and what users should do now

> On 29 October 2026 billions of dollars left Binance hot wallets in minutes. Early tallies said $5.8 billion; Binance's own later estimate is $6.3 billion. Binance says user funds are safe and that it will cover all losses from its SAFU fund and company money. It has not yet published a post-mortem, and the cause and attacker are still disputed. Here is what is reported, what is not settled, and what to do about your own money.

Updated 2026-10-30 · Payaries · https://www.payaries.com/blog/binance-hack-october-2026-what-happened-and-what-users-should-do

## What happened

> **Written 30 October 2026.** From reports published on 29 and 30 October, while the story was still moving. Figures, freezes and the withdrawal timeline are changing hourly; check Binance's official channels for the current position. Payaries is a technology platform, not an adviser. This article reports public information and is not legal, tax or investment advice. Rules and facts in these stories are changing — read the primary sources linked below and take advice from a qualified local professional before you act.

On the evening of Thursday 29 October, on-chain analysts began flagging large, unusual transfers out of Binance hot wallets. TRM Labs says an attacker moved about **$6.36 billion** out of Binance wallets on ten blockchains, most of it in roughly 20 minutes from about 20:05 UTC. TRM calls it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. The first public alerts came from on-chain analysts; Binance's initial line to reporters was that it was “actively investigating” a “potential security issue”.

The first tallies were lower, and they measured different things. Arkham tracked 55 addresses labelled as the attacker holding about $5.78 billion, which BleepingComputer cautioned was the value of what those wallets held, not a confirmed theft figure. Coinbase's Conor Grogan put the ceiling at “up to $5.8 billion”. Chainalysis later gave $5.912 billion at the time of theft, and its CEO Jonathan Levin put it at $6.4 billion. Binance's own figure is an “estimated total impact” of **$6.3 billion**. These are different scopes, so do not add them together.

| Measure | Figure | Source |
|---|---|---|
| Attacker wallets (holdings, early) | About $5.78 billion | Arkham, via BleepingComputer |
| Upper estimate, early | Up to $5.8 billion | Conor Grogan, via The Block |
| At the time of theft | $5.912 billion | Chainalysis, via Cointelegraph |
| Moved out, ten chains | About $6.36 billion | TRM Labs, via BleepingComputer |
| Binance's own estimate | $6.3 billion “estimated total impact” | Binance, via Cointelegraph and Invezz |

Per Arkham's early breakdown the holdings were roughly $1.77 billion of USDT, $1.44 billion of BTC, $876 million of ETH and $823 million of USDC. A hot wallet is the online wallet an exchange keeps funded to process withdrawals; the bulk of customer assets normally sit in offline cold storage, which is why a hot-wallet breach does not by itself mean all customer assets are gone.

## How it happened: what is known and what is not

Binance's preliminary account, as relayed by BleepingComputer and Cointelegraph from its posts on X, is that the incident may have started with a **compromised DevOps engineer's laptop**, which let an attacker reach an internal service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng is quoted as saying the attacker “did not simply use one engineer's permissions” and that this “was not a single ‘one-click’ action”, and that the investigation “has not attributed responsibility to any individual”. Binance says it has not found evidence that a wallet private key leaked, and that it has “uncovered additional points of breach”.

Outside analysts add detail that Binance has not confirmed. Blockaid's CEO Ido Ben-Natan told Cointelegraph it “seems to be… a compromise of signing infrastructure” rather than a leaked key. Blockaid's analysis, reported by Cryptonews, points to **EIP-7702**, an Ethereum feature from the May 2025 Pectra upgrade that lets an ordinary address delegate its behaviour to a smart contract: a delegation transaction on the hot wallet labelled “Binance 14” carried 50 authorizations covering different nonces, one matched, and funds were swept minutes later. Cryptonews notes that this does not by itself explain the reported Bitcoin and Tron movements. EIP-7702 appears in only one of the four main first-day reports, so treat it as an analyst theory.

On who did it: TRM Labs attributes the attack to the North Korean group **TraderTraitor** “with high confidence”, Chainalysis says the same, and ZachXBT says funds from this theft and the earlier Bitget exploit were commingled, suggesting one actor. Binance has not made an attribution, and these pages show no statement from law enforcement.

## What Binance has promised, and what it has not

Binance's position, in its own words as quoted by outlets, has hardened over a day. Its first statement to reporters said it was investigating and “had not confirmed any impact on user funds”. Later on 29 October co-founder Yi He wrote that “user funds are safe” and “Binance will cover all hacking losses”. On 30 October Binance's X account said it will cover all losses from the **SAFU fund** (its emergency reserve for users) **and company funds**, and that it will publish an updated Proof of Reserves once remediation is complete. Binance says it has revoked authorizations for the affected address and is working with [blockchain](https://www.payaries.com/blog/what-is-blockchain)-intelligence partners and law enforcement.

| Binance has said | Binance has not (yet) |
|---|---|
| It will cover all losses from SAFU and company funds | Said how or when affected parties are made whole |
| User funds are safe | Published an audited loss figure or post-mortem (it promises a full one) |
| Preliminary cause: a compromised DevOps laptop and an internal service | Named an attacker, or said the laptop was the only point of entry |
| Withdrawals will resume within about 48 hours of 04:17 UTC on 30 October | Given a confirmed resumption time |

Is that “taking responsibility”? It is a commitment to absorb the loss, which is what matters most to customers, and Binance has pointed at its own systems rather than at users. It is not yet a full account: the post-mortem is still to come, Binance has said it has found more points of breach, and a third party estimates the SAFU fund holds about $1 billion in bitcoin (Invezz, unsourced; not a Binance figure), well short of the loss. Whether the rest comes cleanly from company reserves is something only Binance's own accounts and the promised Proof of Reserves will show. Former CEO Changpeng Zhao, who no longer runs Binance.com, said as a shareholder that he expects “all user funds will be fully covered”; that is his expectation, not a Binance statement.

## Frozen is not recovered

Issuers moved fast. Tether's CEO said it froze more than 1.567 billion USDT and Circle's said it froze more than $800 million in USDC; Ripple, World Liberty Financial (about $27 million of USD1), First Digital and the Arbitrum Security Council froze more, and Aave froze lending markets. Binance's “verified total frozen” went from $2.54 billion to **$3 billion** on 30 October, and the figures quoted by outlets differ.

A freeze stops an asset moving; it does not return it to Binance. Bitcoin and Ether have no issuer who can freeze them, and TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, and was swapping and borrowing while the freezes landed. Recovery, if any, will take law enforcement and time.

## What users should do now

Binance itself has told users to rely only on official Binance channels and to be wary of scams, unofficial links, messages or requests for account information. None of the reports we could read gives users further instructions, so the rest of this list is general good practice, not advice from Binance, and not a reason to think your account is at risk.

1. **Expect a phishing wave, and treat every “compensation” message as a scam.** Big incidents produce fake refund sites, fake support accounts and fake “claim your coverage” links within hours. Binance says it will cover losses; it does not need you to connect a wallet, enter a seed phrase or pay a fee to receive that. Type the address yourself or use a saved bookmark.
2. **Never share a seed phrase, private key or 2FA code with anyone.** No genuine support agent needs them.
3. **Tighten the account.** Use an authenticator app or a hardware security key or passkey rather than SMS, set an anti-phishing code if your exchange offers one, and turn on a withdrawal address whitelist so a hijacked session cannot send to a new address.
4. **Do not panic-withdraw on rumour, and do not trust withdrawal timelines from anyone but Binance.** Withdrawals are paused anyway, and scammers will sell “priority withdrawal” services. Resumption is reported to be within about 48 hours of 30 October 04:17 UTC; confirm it on Binance's own channels.
5. **Be careful with signature requests.** If analysts are right that this attack abused EIP-7702 delegation, the lesson for ordinary users is the same as always: do not sign a message or “authorization” you do not understand, and use a wallet that shows what you are approving.
6. **Do not keep everything in one place.** Any exchange is a counterparty. Keep only what you trade or spend on an exchange, and hold long-term savings in a wallet whose keys you control, ideally a hardware wallet. That trades convenience for the risk of losing the keys yourself, so choose deliberately.
7. **Watch the prices only as a signal.** BNB fell roughly 5–8% on the news and Bitcoin slid with the market. A hack is a reason to check your own exposure, not to make a trade in a hurry; this is not investment advice.

## What it means if you run a business that handles crypto

The reported failure is not a broken blockchain. It is the control layer around the keys: the engineer's laptop, the internal service and the signing path. That is where any operator of hot wallets, including a payment gateway, has to be careful, and Payaries is no exception to the questions below. Nothing here is a claim that Payaries is immune or safer than any other provider.

- **Know who holds your funds.** Payaries holds the funds for you in a dedicated wallet per chain, never pooled with other merchants, and you can check its live balance on a block explorer. [What that means for control and risk](https://www.payaries.com/guides/custodial-vs-non-custodial-payment-gateway) is the trade-off to weigh for any provider.
- **Sweep and withdraw rather than park.** Funds sitting in any provider's wallet are exposure to that provider. Withdrawals from the dashboard on Payaries execute immediately and require two-factor authentication; see [the withdrawals API](https://www.payaries.com/guides/crypto-withdrawals-api).
- **Put a human gate on automated money movement.** Withdrawals created by an API key execute immediately only below your auto-approve threshold and wait for your own approval above it. Set the threshold low, use a dedicated key per service, and keep secrets out of laptops and chat logs.
- **Ask the provider the Binance questions.** How are hot-wallet limits set? Who can approve a withdrawal? What happens to an engineer's credentials when a laptop is lost? What is the freeze-and-hold policy, and is it published? A provider should answer in writing.
- **Plan for a pause.** If your processor or exchange halts withdrawals for 48 hours, can you still pay suppliers and refund customers? Spread operational funds across more than one venue.

## Sources and as-of date

> **What we could not verify.** No loss figure is audited. The cause, the attacker's identity and the EIP-7702 mechanism are unconfirmed beyond Binance's own preliminary statements. We could not read Richard Teng's full post, so his and Binance's words are quoted as relayed by the outlets below. Whether and when funds are made whole is a promise, not yet a fact.

- [Binance investigating hack as suspicious outflows reach up to $5.8 billion — The Block](https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171)
- [Binance probes potential $5.8 billion crypto-theft hack — BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-probes-potential-58-billion-crypto-theft-hack/)
- [Binance links $6.3 billion crypto theft to compromised DevOps laptop — BleepingComputer](https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/)
- [Live updates: Binance $6.3B hack linked to North Korea's TraderTraitor — Cointelegraph](https://cointelegraph.com/news/live-updates-binance-63b-hack-linked-to-north-koreas-tradertraitor)
- [Inside the $5.8B Binance hack: what's confirmed and what isn't — Cryptonews](https://cryptonews.net/news/security/33674377/)
- [Binance's $6.3B hack raises fresh crypto security fears — Invezz](https://invezz.com/news/2026/10/30/binances-6-3b-hack-raises-fresh-crypto-security-fears/)

## Questions

**How much was stolen in the Binance hack?**
There is no audited figure. Early tallies said up to $5.8 billion; Binance's own later “estimated total impact” is $6.3 billion, TRM Labs counts about $6.36 billion moved across ten chains and Chainalysis about $5.9 to $6.4 billion. The figures measure different things.

**Is my money on Binance safe?**
Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. That is the company's own statement, backed so far by no published post-mortem or audit. It has promised an updated Proof of Reserves. Deposits are reported to be working and withdrawals paused.

**Has Binance taken responsibility for the hack?**
It has committed to cover all losses and has pointed to its own systems, a compromised DevOps engineer's laptop and an internal service, as the preliminary cause. It has not published a full post-mortem, and says it has found more points of breach.

**When will Binance withdrawals resume?**
Binance said on 30 October that withdrawals are paused while it revamps the withdrawal service and addresses, and expected to resume within 48 hours. That is a target, not a guarantee; check Binance's official channels.

**Who was behind the Binance hack?**
Not officially established. TRM Labs and Chainalysis attribute it to North Korea's TraderTraitor group with high confidence. Binance has made no attribution, and the reports we read show no law-enforcement statement.

**What is EIP-7702 and was it used?**
EIP-7702 is an Ethereum feature, part of the May 2025 Pectra upgrade, that lets an ordinary address delegate its behaviour to a smart contract. Blockaid's analysis, reported by Cryptonews, points to it as the mechanism on one hot wallet. Binance has not confirmed this.

**What should I do to protect myself?**
Ignore unsolicited compensation messages, never share seed phrases or codes, use an authenticator app or security key, enable a withdrawal whitelist, do not sign requests you do not understand, and keep long-term savings in a wallet you control. This is general practice, not Binance's advice and not investment advice.

## Try it

Run a real invoice before you commit: [Payaries — www.payaries.com](https://www.payaries.com/signup). Payaries is a multi-chain crypto payment gateway — https://www.payaries.com

## Keep reading

- https://www.payaries.com/guides/custodial-vs-non-custodial-payment-gateway — Managed vs self-held crypto payment gateways
- https://www.payaries.com/guides/crypto-withdrawals-api — Withdrawing crypto through the API: quote, idempotency and approval
- https://www.payaries.com/blog/what-is-cryptocurrency — What is cryptocurrency? A plain-English guide
- https://www.payaries.com/blog/bitcoin-falls-below-80000-middle-east-october-2026 — Bitcoin slips below $80,000 as Middle East security warnings hit crypto: what happened and what merchants should do
- https://www.payaries.com/crypto-payment-api — A crypto payment API that behaves like the rest of your stack
- https://www.payaries.com/blog/bitcoin-crypto-after-us-midterms-chip-crash — Bitcoin and crypto after the midterms and the chip crash: what happened and what it means
- https://www.payaries.com/blog/ransomware-economy-crime-as-a-business — The ransomware economy: how crime became a business, and what crypto has to do with it