Binance hack of 29 October 2026: about $6.3 billion taken, according to Binance

On the evening of 29 October 2026, attackers took crypto worth about $6.3 billion from Binance, a global crypto exchange, according to Binance's own estimate. If the headlines worried you, here is what is confirmed, whose figures are whose, and what is still unknown.

Key points: what happened in the Binance hack?

• On the evening of 29 October, attackers drained Binance's hot wallets. Binance puts the loss at about $6.3 billion; analytics firms put it at $6.36 billion (TRM Labs) to $6.43 billion (Elliptic).
• The FBI said on 31 October that North Korea was responsible.
• Binance says the loss will not be passed on to users and it is covering it with its own money.
• Withdrawals were paused on 29 October and restarted in phases on 1 November.
• Between about $2.7 billion (TRM Labs) and about $3 billion (Binance) was frozen, almost all of it stablecoins.

What happened

A "hot wallet" is the part of an exchange's storage that is online, so it can pay out withdrawals quickly; a "cold wallet" is kept offline. The timeline, in UTC:

• 29 October, about 20:05: Binance's hot wallets were compromised, Binance says.
• Evening of 29 October: Binance said "User funds remain safe" and paused withdrawals.
• 30 October: Binance said the incident "may involve a compromised DevOps engineer's laptop". Later it said it had found "additional points of breach" and "no evidence that wallet private keys were leaked".
• 31 October: The FBI named North Korea.
• 1 November: Withdrawals began to reopen in phases.

A private key is the secret code that controls a wallet. The analytics firm Elliptic says the evidence suggests the attacker got Binance's own systems to sign transactions rather than stealing the keys. Binance has not confirmed this, and the root cause is not confirmed: its detailed technical report had not been published as of 2 November.

How much was taken, by whose count

Binance's own estimate is about $6.3 billion. Analytics firms, which trace money on blockchains, put it slightly higher: TRM Labs $6.36 billion, Chainalysis about $6.4 billion and Elliptic $6.43 billion. The FBI says "more than $6 billion". Part of the gap is timing: TRM, for one, prices each asset at the moment it was taken.

TRM called it "the largest crypto theft on record, about four times the USD 1.5 billion Bybit hack of February 2025."

Who did it: the FBI's view

On 31 October the FBI said that North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance, and that it calls this activity "TraderTraitor". Binance has not named an attacker.

What happened to customers' money

Binance says the loss will not be passed on to users: "Binance will absorb the financial impact of these stolen funds, not our users." It says it set aside more than $6.34 billion of company funds, drawing on part of its SAFU fund, part of its futures insurance fund and its corporate treasury.

Binance describes SAFU as "an emergency reserve fund established by Binance in July 2018 to protect user assets in extreme cases". It is Binance's own fund, not a legal deposit-guarantee or investor-compensation scheme in the EU or the US.

By Binance's count, about 80% of the stolen assets had been replaced on 30 October, 90% on 31 October and about 95% on 1 November. CoinDesk noted that the drained hot wallets were among those backing customer balances. So "user funds are safe" here means, by Binance's own account, that it is replacing the missing coins with company money.

Withdrawals reopened from 06:00 UTC on 1 November on 15 networks. In its 2 November update, Binance said the next phase was planned for 3 November; other networks were still waiting.

Why some of the coins could be frozen

A stablecoin is a crypto token designed to keep a steady value against a currency such as the US dollar. Its issuer, such as Tether (USDT) or Circle (USDC), can "freeze" tokens at specific addresses so they can no longer be moved. Our stablecoins course explains how this works.

The totals: about $3 billion according to Binance, about $2.8 billion according to Chainalysis, $2.85 billion frozen or seized according to Elliptic and about $2.7 billion according to TRM Labs.

Bitcoin and other coins native to their own blockchain have no issuer who can freeze them. Elliptic estimated on 1 November that the attacker still controls about $3.25 billion that cannot be frozen. And frozen is not returned: getting money back typically needs a court order or seizure warrant and can take months or years, analysts at TRM Labs and Chainalysis told CNBC.

How the market reacted

Measured from 20:00 UTC on 29 October, the last hourly price before the hack, CoinGecko's hourly prices show bitcoin (BTC) about 5.2% lower at its lowest, at $76,586 on 30 October. Ethereum (ETH) fell about 6.1% at its lowest, and BNB, Binance's own token, about 6.6%. Bitcoin had already slipped from $81,692 earlier on 29 October, so not all of the move can be put down to the hack.

What this means for you

When you keep crypto on an exchange, the exchange holds it for you. After a theft, your balance depends on what that exchange is able and willing to cover, and withdrawals can stop for days.

For readers in the EU: Binance does not hold a MiCA licence and is not on the register of ESMA, the EU's markets regulator, as of 30 October 2026. In June 2026 it told users in four EU countries that it would stop new sign-ups and restrict some services from 1 July 2026, CoinDesk reported. In a general June statement, ESMA said that clients of unauthorised crypto firms "do not benefit from MiCA safeguards, including protections for client assets".

Be careful with "refund" messages

Fake "compensation" offers aimed at Binance users have circulated since the hack, The Independent reported. But not every offer is fake: on 2 November Binance announced a real promotion, claimed inside users' Binance accounts. So check where you see an offer, not just what it says:

• Open the official app, or type the official website address yourself. Don't use links in emails, texts or social posts.
• Never share your password, recovery phrase, private keys or one-time codes.
• Be wary of anyone who asks for a fee to recover lost crypto. The FBI's IC3 says it "will never ask for payment to recover lost funds".

What you can do now

• Learn how hot and cold wallets work in storing cryptocurrencies.
• Practise spotting fake refund offers in spot the scam.
• Build everyday security habits in introduction to security.
• See what a MiCA licence means in crypto rules in the EU.

Questions readers ask

Was my money on Binance affected?

Binance says that it, not its users, will absorb the loss. For your own account, check Binance's official app or website, not links sent to you.

Who was behind the hack?

The FBI said on 31 October that North Korea was responsible, under the label "TraderTraitor".

Has any of the stolen crypto been recovered?

Some has been frozen, mostly stablecoins, but frozen is not returned: getting it back typically needs a court order or seizure warrant.

Crypto prices can rise and fall sharply, and you could lose some or all of the money you put in. Crypto is not covered by deposit protection. This article is for education, not financial advice.