Binance hit by record $6.3 billion hack, withdrawals suspended

On 29 October 2026 at 20:05 UTC (21:05 Paris time), hot wallets belonging to Binance began to be drained, according to the exchange's second incident update as reported by crypto.news and Crowdfund Insider. Binance puts the impact at about $6.3 billion, making it the largest theft in crypto history, well ahead of the $1.5 billion taken from Bybit in February 2025. Withdrawals have been suspended since late on 29 October, and the exchange says it has set aside more than $6.34 billion of its own funds to cover the losses.

More than $6 billion moved out across ten blockchains

Estimates differ depending on who is counting. Binance cites roughly $6.3 billion and has warned the figure could still rise. Blockchain analytics firm Chainalysis places the first outflows at around 16:20 Eastern Time (20:20 UTC) and puts the total at about $6.4 billion. TRM Labs counts around $6.36 billion across ten blockchains, most of it moved in about twenty minutes. Early estimates published in the hours after the attack ranged from $5.57 billion to $5.9 billion.

As for how the attack unfolded, Binance first pointed to the compromised laptop of a DevOps engineer, which reportedly gave access to a service container. Its internal investigation then uncovered further points of intrusion, CoinDesk reported. According to Richard Teng, Binance co-CEO, the attacker used Ethereum's EIP-7702 account delegation to bypass the usual approvals, along with a self-destruct mechanism to erase traces. Binance says it has so far found no evidence that private wallet keys were leaked.

Binance says it will bear the financial impact

According to Binance, as cited by The Block, Decrypt and FX News Group, more than $6.34 billion of company funds have been reserved. About $5 billion, or roughly 80%, is already held in the exact tokens that were stolen (USDC, USDT, BTC, ETH and BNB). The remainder is being bought on the market and over the counter (OTC), which may take time for less liquid tokens. Losses will be covered by the SAFU emergency fund (Secure Asset Fund for Users) and by the company's treasury. Update #2, signed by co-CEOs Yi He and Richard Teng, states that Binance, not its users, will bear the financial impact.

Deposits, initially halted along with withdrawals, are working normally again, and unaffected services remain open. Withdrawals, however, are still blocked. Binance is targeting a phased restart around Sunday 1 November, subject to the completion of security checks; co-founder Yi He wrote on X that withdrawals should resume by Sunday. The timetable has shifted several times, from “within 48 hours” early on 30 October to 45 hours, then around 40 hours and finally about 34 hours after update #2. No precise time has been guaranteed, and the restart is set to happen in stages rather than for every service at once. The exchange also plans to publish the results of its proof of reserves on Monday 2 November.

Analytics firms point to North Korea

Chainalysis and TRM Labs attribute the operation to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group, with TRM Labs saying it does so with “high confidence”. Elliptic also points to North Korea. For Chainalysis, the strongest link is that funds stolen from Binance were mixed on-chain with those from the hack suffered by Bitget the previous month, which had already been attributed to North Korea. The attribution comes from private companies, while Binance itself has refrained from naming a culprit.

Part of the loot has been blocked. Binance says around $3 billion of stolen assets has been frozen with the help of its partners, amounts counted separately from the $6.34 billion reserve. Tether froze more than 1.567 billion USDT, according to its chief executive Paolo Ardoino, and Circle more than $800 million in USDC (about $823 million), according to its chief executive Jeremy Allaire, in coordination with law enforcement. Together, the two issuers have frozen about $2.37 billion. Binance has not specified what happens to the roughly $3.3 billion that was not frozen, Al Jazeera noted.

In the United States, the Secret Service is working with Circle to identify, freeze and recover the funds, according to Crypto Briefing and Finance Magnates. Binance is cooperating with the FBI and the Secret Service, according to a source quoted by Reuters. The FBI said it was aware of the incident and in contact with public and private partners to assess its scope and coordinate the investigation. CFTC chairman Michael Selig used the case to argue for a voluntary registration scheme with his agency for offshore exchanges serving US retail customers. President Donald Trump said his administration was looking into the matter.

Liquidations and knock-on restrictions

The shock spread to derivatives markets. More than $1.5 billion of leveraged positions were liquidated on crypto futures, mostly long positions: CoinDesk counted $1.57 billion and Cointelegraph about $1.6 billion. Bitcoin fell to around $77,000.

Other platforms reacted. In India, CoinDCX, the country's largest crypto platform, switched its futures to “reduce-only” mode: customers can no longer open or increase a position, only reduce or close it. The platform cited problems at a global liquidity provider, identified as Binance by a spokesperson; deposits and withdrawals were not affected. In decentralised finance, lending protocol Aave paused new deposits and borrowing as a precaution, after the attacker borrowed ETH by posting stolen tokens as collateral. Aave reopened its markets on 30 October.

What it means for traders

All Binance.com customers holding spot assets, wallet balances or futures margin are affected by the withdrawal freeze. Until the phased restart takes place, their funds remain locked on the platform. The “Security Incident Update” notices on Binance's website and its official X account are the reference channels, and a gradual reopening by network and by asset could come with a queue.

The gap between open deposits and closed withdrawals has a direct consequence: any new deposit would stay locked on the exchange until the restart. Counterparty risk would therefore deserve to be assessed before adding further funds.

If Binance honours its pledge to cover all losses, customer balances should not be reduced. The proof of reserves expected on 2 November would be the first concrete test: customers would have an interest in comparing their balance at the time of publication and keeping screenshots of their balances before and after withdrawals resume.

For leveraged traders, the moves of 29 and 30 October are a reminder of how much position size and stop distance matter when an event of this kind hits. While the withdrawal restart and the proof of reserves remain uncertain, lower leverage and wider safety margins would limit exposure to further cascading liquidations, a core issue in understanding leverage in trading. Traders who keep a trading journal would have reason to log the liquidations and orders filled during those two days.

Customers of other platforms that rely on Binance liquidity would also have an interest in checking their notices on any restricted trading modes, such as the one imposed by CoinDCX. Finally, incidents of this type often serve as a pretext for phishing attempts, in the form of fake “refunds” or fake support: only Binance's official channels can be relied upon.