Newsroom / Binance

Binance suspends deposits and withdrawals after hack; says it will cover all losses

Binance puts the total impact at about $6.3B, with about $3B frozen, and says it has set aside more than $6.34B to cover losses from its SAFU fund and company funds. TRM Labs and Chainalysis attribute the attack to North Korea's TraderTraitor unit. Deposits operate as normal; withdrawals stay paused, and Binance's 30 October 19:33 UTC update targets a phased restart in about 34 hours, subject to security checks.

October 29, 2026 · Effective · Verified 2026-10-31 via official announcement

Binance suspended all deposits and withdrawals after billions of dollars in crypto moved out of wallets labelled as its hot wallets on 29 October 2026. It first said it was investigating a potential security issue and paused withdrawals on multiple networks; early on 30 October (UTC) it said it will cover all losses and that all deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement. Founder Changpeng Zhao, who no longer runs the exchange, said it does look like a hack on Binance.

At 02:25 UTC on 30 October Binance gave its first loss estimate and an initial cause. It said the incident may have started with a compromised DevOps engineer's laptop, which let an attacker reach a service container and submit unauthorized withdrawal transactions, and that it has found no evidence of a wallet private key leak. It estimates the total impact at about $6.3 billion, with about $3 billion frozen onchain so far, and says it will cover all losses from its SAFU fund and company funds. It has revoked the affected address authorization, and says it will publish a detailed post-mortem and an updated Proof of Reserves once remediation is complete. Its first statement on 29 October was edited twice within about 13 minutes: an earlier version said it had "not confirmed any impact to user funds", and later versions say user funds are safe. At 23:06 UTC on 29 October it also suspended Binance Alpha trading until the issue is resolved.

At 04:36 UTC on 30 October Binance said deposits remain unaffected and continue to operate as normal, while withdrawals stay paused as it completes a security revamp of the withdrawal service and its related addresses. It said it expects to resume withdrawals within 48 hours and that its security team is tracing the full attack path through the compromised computer, with a root-cause report to follow. Co-CEO Yi He gave the same 48-hour estimate at 04:17 UTC. Binance's earlier 00:13 UTC update had said all deposits and withdrawals were temporarily suspended; it has not said when deposits reopened. At 08:47 UTC Binance said its follow-up investigation had "uncovered additional points of breach" beyond the compromised laptop it first described, called it a complex attack and said it is coordinating with law enforcement. It did not say what the additional points of breach were. It said outflows stopped when it paused withdrawals, that it is still on track to resume withdrawals in 45 hours, which would be around 05:47 UTC on 1 November, and that deposits remain unaffected. Withdrawals were still paused as of that update, and the restart time is an estimate, not a confirmed reopening. At 07:37 UTC co-CEO Richard Teng repeated those points in a statement on X, adding that the attacker did not simply use one engineer's permissions, that the attack was not a single "one-click" action but a more complex process, and that the investigation has not attributed responsibility to any individual. In a video posted at 14:32 UTC, Teng said the attacker used an EIP-7702 delegation to get onchain execution approval over a hot wallet and that this delegation "did not pass through our normal approval controls". He said the attacker also used a self-destruct mechanism that destroyed tooling and traces as it went, which makes the investigation harder, and that Binance is rebuilding the withdrawal service and will not switch it back on until it passes rigorous testing.

At 19:33 UTC on 30 October Binance published a second incident update signed by co-CEOs Yi He and Richard Teng. It said it has set aside more than $6.34 billion in company funds, including $5 billion held in the same tokens that were stolen, such as USDC, USDT, BTC, ETH and BNB, which it says covers about 80% of the impacted amount; it is buying the rest through market and over-the-counter channels. It said its technical team targets starting to resume withdrawals within about 34 hours, which would be around 05:30 UTC on 1 November, in phases and subject to completing security checks, and that deposits and other unaffected services remain operational. It plans an initial Proof of Reserves snapshot within 12 hours of the update, with results ready by Monday 2 November, and expects to share further verified technical findings within about 48 hours, followed by a full post-mortem. It repeated that it has found no evidence that wallet private keys were leaked. Withdrawals were still paused as of that update, and the restart time is a target, not a confirmed reopening.

Outside estimates of the amount taken differ by method. TRM Labs puts the theft at about $6.36 billion across ten blockchains, most of it within about 20 minutes of 20:05 UTC on 29 October, and attributes it with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit. Chainalysis CEO Jonathan Levin said the firm assesses that the hack was likely done by TraderTraitor because of links to a previous hack. TRM counted about $2.7 billion frozen as of 00:30 UTC on 30 October and about $2.4 billion, including more than 420,000 ETH and 18,270 BTC, beyond any issuer's reach. Binance's statements cited here do not name an attacker. Blockchain analytics firm Chainalysis put it at about $5.912 billion at the time of theft, nearly four times the 2025 Bybit theft, the previous record. Blockaid earlier counted about $3.3 billion of suspicious outflows on Ethereum, Arbitrum and Avalanche, per The Block, and Decrypt's onchain tally put the total at at least $5.57 billion across Ethereum, Bitcoin and Tron. Security firm Blockaid's analysis says the attack centred on Binance 14, one of Binance's largest Ethereum hot wallets. At 20:20 UTC an operator address funded through Tornado Cash sent one transaction carrying 50 EIP-7702 authorizations signed with that wallet's key, one per nonce; one matched and handed control of the wallet to an attacker-deployed sweeper contract. At 20:24 UTC a single sweep moved about $2.5 billion, including 167,464 ETH and 1.615 billion USDT. Within 12 minutes ten more Binance hot wallets on Ethereum, Optimism, Arbitrum and Avalanche sent funds to the same address through ordinary signed transfers, and because the delegation stayed in place the attacker later moved 780 million USDC from a Binance smart account and swept another 200 million USDT of new deposits from Binance 14 at 21:44 UTC without a further signature. Blockaid says Binance's own signing infrastructure, under the attacker's control, produced the authorization; Binance has not described how the attacker got signing access beyond its update on additional points of breach.

Binance said the verified total frozen was $2.54 billion late on 29 October and about $3 billion by 00:52 UTC on 30 October, and that the figure may rise. Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT, Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC, and Yi He thanked Ripple for freezing about 200 million RLUSD. CoinDesk reports that the Arbitrum Security Council moved 74.56 million ARB tokens out of a hacker wallet into a frozen wallet. On DeFi lending venues, Decrypt reports that Aave froze its V3 markets on Ethereum mainnet and Kamino paused borrowing in its SOL/BTC market as a precaution. 1inch said its risk team blocked addresses linked to the exploit from the 1inch dApp, 1inch Wallet and 1inch API within the first hour and is sharing the list with resolvers and integrators; it said some 1INCH tokens were among the stolen assets and cannot be frozen, because the token has no freeze or blocklist function. The attacker has also been selling smaller stolen tokens into thin decentralized exchange pools. A wallet that received about 714.9 million FUN (FUNToken) from an address Etherscan labels as a Binance hot-wallet exploiter sold about 134.1 million FUN, mostly into a small Uniswap V2 FUN/WETH pool plus one PancakeSwap V3 swap, between about 23:30 UTC on 29 October and 04:17 UTC on 30 October. FUN's price in that pool fell 95.5% from peak to trough, per The Defiant's calculation from GeckoTerminal data. The Defiant reports the attacker also sold RAD and OGN on Uniswap. About 580.8 million unsold FUN, about 5.4% of FUN's maximum supply per CoinDesk, remains with wallets linked to the exploit. Bybit said it was not affected. Reuters reports that Coinbase said it made adjustments to its systems that store crypto keys offline "solely out of an abundance of caution", and that Kraken said it is monitoring industry incidents for lessons it could apply; neither reported any impact on its own customers.

If confirmed at the reported size, this would be the largest crypto theft on record. Binance's last disclosed hack was in May 2019, when it lost more than 7,000 BTC from a hot wallet and said it would cover the loss in full.

“Binance will absorb the financial impact of these stolen funds, not our users.”

— Binance, Security Incident Update #2

Who this affects

Binance users who want to withdraw, Binance Alpha traders, and anyone holding assets on Binance while the investigation runs. Binance.US is a separate company and was not named in the reports. 1inch users are not directly affected, but addresses tied to the exploit are blocked on its apps and API. Traders in thin Uniswap and PancakeSwap pools for smaller tokens the attacker holds, such as FUN, face sharp price swings when it sells.

Binance at a glance

More from the newsroom

• 2026-10-30 Kraken spot and derivatives trading disrupted for about an hour on 30 October
• 2026-10-29 Kalshi raises $1B at $40B valuation, plans single-stock perps and indices
• 2026-10-29 MetaMask adds Stellar as a default network on mobile and extension
• 2026-10-29 Polymarket halts trading for an hour after third-party provider compromise