In a nutshell: The Binance hack on October 29, 2026 drained about $6.3 billion from Binance.com hot wallets across multiple blockchains. About $3 billion has been frozen with industry partners. Binance says user funds are safe, will cover all losses from its SAFU fund plus company money, has paused withdrawals while deposits stay open, and is targeting a Sunday restart. North Korea links from analytics firms are not confirmed by Binance.
Last updated: October 30, 2026, evening Asia/Karachi. Figures and withdrawal status can change; check Binance’s official announcement for live updates.
What Happened in the Binance Hack
According to Binance’s Security Incident Update (published October 29 and updated October 30), the estimated total impact is around $6.3 billion. Chainalysis, tracing flows starting around 4:20 p.m. ET on October 29, put unauthorized transfers at about $6.4 billion across multiple blockchains — the largest crypto theft on record by those measures (Chainalysis; CNBC; BBC).
Binance’s first read was that a compromised DevOps engineer’s laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng later said the attack was wider: investigators found additional breach points, a self-destruct mechanism that erased tooling and traces, and abuse of Ethereum’s EIP-7702 account-delegation feature to gain on-chain control of a hot wallet outside normal approval controls (Binance; CoinDesk; BBC live). Binance says it has found no evidence of a wallet private-key leak.
Most of the outflow reportedly left in roughly 20 minutes. Assets reported in coverage included bitcoin, ether, and stablecoins such as USDT and USDC among others (CoinDesk; Chainalysis).
How Much Was Frozen
Binance says it worked with blockchain partners to freeze affected assets, with about $3 billion frozen on-chain so far (official update). Chainalysis separately reported about $2.8 billion frozen in its write-up, with freezes beginning by about 5:14 p.m. ET on October 29. CNBC and BBC also reported that Circle and Tether helped freeze large pools of stablecoins after the breach.
Chainalysis described attackers racing freezes by swapping hundreds of millions of dollars of stablecoins into ETH, then moving remaining stables through stopover wallets — a race industry partners partly won. Exact remaining unfrozen balances and token-by-token freezes are still moving; treat any single figure as a snapshot, not a final tally.
SAFU, Company Cover and User Funds
Binance’s official line is clear: “User funds are safe” and the exchange “will cover all losses from the SAFU fund and the company’s funds” (Binance announcement). Teng has also said publicly that Binance is covering every loss.
CoinDesk reported that Binance set aside more than $6.34 billion in company resources to restore balances one-for-one, including about $5 billion already held in the exact tokens affected, with the rest being bought in public and OTC markets. Frozen assets are separate from that reserve pool. Binance also said it will publish an updated Proof of Reserves after remediation, with Teng pointing to a fuller PoR by Monday in later remarks (CoinDesk; BBC live).
Those are company disclosures and press reporting — not a finished independent audit of the shortfall. Users should verify balances only on official Binance channels, not via unsolicited DMs or screenshots.
Withdrawals Paused; Deposits Open
As an immediate precaution, Binance:
- temporarily suspended withdrawals while security checks finish;
- revoked affected address authorizations;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
An October 30 update clarified that deposits remain unaffected and continue normally (Binance). Teng has said Binance is rebuilding and testing the withdrawal stack and hopes to resume within roughly 40 hours, aiming for Sunday — a target, not a guarantee (CoinDesk).
The FBI said it is aware of the incident and coordinating with partners; the US Secret Service said it is working to identify, freeze, trace and recover stolen funds (CNBC; BBC).
Who Is Behind It? (Unconfirmed)
Unconfirmed: Binance has not publicly named a perpetrator. Blockchain analytics firms and on-chain investigators have attributed the theft to North Korea–linked actors:
- Chainalysis assesses TraderTraitor (DPRK), citing on-chain commingling with funds from last month’s Bitget theft;
- TRM Labs said with high confidence the patterns match earlier North Korea–linked heists (per CNBC and CoinDesk);
- On-chain sleuth ZachXBT said the attacker was “likely Lazarus,” and later noted Binance and Bitget stolen funds mixing via THORChain at the same address (reported via Lookonchain).
Those assessments are strong industry signals, but they are not the same as a Binance or government indictment. We mark them clearly as unconfirmed pending official attribution. For context on the earlier Bitget incident, see our note on Bitget withdrawals after the $388M hack.
What It Means for Users in the US, Canada and Australia
United States: The breach hit Binance’s global exchange, Binance.com. Binance.US said it was not affected, operates as a separate platform, and that customer funds and services were operating normally (BBC). US users on Binance.US should still ignore phishing that piggybacks on hack headlines.
Canada and Australia (and other Binance.com regions): If you hold funds on Binance.com, Binance’s stated position is that balances are covered by SAFU plus company funds, deposits work, and withdrawals stay paused until security testing finishes. There is no separate Canada- or Australia-specific official carve-out in the sources above — treat the global Binance.com status as what applies, and verify only on official Binance pages. This is also a reminder of centralized exchange custody risk versus self-custody.
None of this is advice to keep, move or withdraw funds. Phishing and fake “support” accounts spike after large hacks — use official URLs only.
FAQ
How much was stolen in the Binance hack?
Binance estimates about $6.3 billion impacted. Chainalysis puts unauthorized transfers near $6.4 billion. About $3 billion (Binance) / $2.8 billion (Chainalysis) has been frozen so far.
Are Binance user funds safe?
Binance says yes: user funds are safe, and all losses will be covered by the SAFU emergency fund plus company resources. It has also described a >$6.34 billion reserve plan to restore balances one-for-one (CoinDesk). Those are company statements pending updated Proof of Reserves.
Can I withdraw from Binance right now?
Withdrawals on Binance.com are temporarily suspended while security checks and rebuilds finish. Deposits remain open per Binance’s October 30 clarification. Teng has targeted a Sunday reopen (~40 hours) — confirm on official channels before assuming it is live.
Was Binance.US hacked?
No, according to Binance.US and BBC reporting. Binance.US says it is a separate platform and was unaffected.
Did North Korea do it?
Unconfirmed by Binance. Chainalysis, TRM Labs and ZachXBT have linked the theft to North Korean groups (TraderTraitor / Lazarus). Wait for official attribution before treating that as settled fact.
Sources
- Binance: Security Incident Update (2026-10-30)
- CoinDesk: Binance uncovers wider breach, eyes Sunday withdrawal restart
- CoinDesk: Binance arranges $6.34B to cover losses
- CoinDesk: North Korea’s Lazarus Group likely behind hack (sleuths)
- Chainalysis: Tracing the $6.4B theft to North Korea
- CNBC: $6.3B Binance hack is largest crypto theft on record
- BBC: Binance attempting to recover $6.3bn
- BBC: Binance hack — what we know so far (incl. Binance.US)
- BBC live: US Secret Service / Teng EIP-7702 updates
- Lookonchain: ZachXBT on Binance–Bitget fund mixing
Disclaimer: This article is for informational and educational purposes only. It is not financial, investment, legal or tax advice. Cryptocurrency and exchange custody involve risk. Always verify status on official Binance channels and do your own research.
