On October 29, 2026, attackers moved cryptocurrency out of Binance wallets in a major security incident. Binance estimates that approximately $6.3 billion in assets was affected. The investigation is still developing: this article reflects public information available on October 31, and figures and findings may change.
What happened?
Blockchain analysis company Elliptic estimates that about $6.43 billion in cryptoassets left Binance wallets across multiple blockchains. Binance's estimate is approximately $6.3 billion. These are estimates of assets affected or stolen, not a count of customers whose individual accounts were accessed. Elliptic describes this as the largest crypto theft on record.
A crypto exchange holds and moves digital assets using wallets. A hot wallet is connected to systems used for transfers, unlike an offline cold wallet. In this incident, investigators reported outflows from Binance hot wallets; a wallet-level theft does not by itself establish that an individual customer's password or account was compromised.
How did attackers get in?
Binance said its initial investigation pointed to a compromised employee laptop, and that later work uncovered additional points of breach. It described a multi-stage attack that could not have been completed from one machine alone. The full sequence and how the attacker gained each form of access remain under investigation.
Binance also said it had found no evidence that wallet private keys were leaked. That statement is an investigation finding as of its update, not proof that the attackers did not move funds. A private key is the secret used to authorize crypto transactions; systems that can initiate or approve transfers are also sensitive.
Who was responsible?
Elliptic assessed that North Korea-linked actors were likely responsible based on blockchain evidence, including links to another suspected attack. It said no government had confirmed attribution. Binance has not attributed responsibility to an individual. An assessment of likely involvement should not be treated as a final finding.
What happened to the funds?
Binance said it paused withdrawals and that the outflows stopped. It also said roughly $3 billion had been frozen and that it was working with partners and law enforcement to trace the remaining assets. Freezing can prevent movement of certain assets; it does not mean they have been recovered or returned, and the amount may change as the investigation progresses.
Binance says user losses will be fully covered by its Secure Asset Fund for Users (SAFU) and company funds. In its second update, Binance said it had set aside more than $6.34 billion in company funds, including $5 billion in the affected tokens. This is the exchange's stated funding plan, not independent confirmation that every affected user has already been reimbursed. Withdrawals were still suspended at the time of that update; check official announcements for the current status and any account-specific instructions.
What should Binance users do?
- Visit Binance by typing its official address or opening its verified app. Check announcements and your account activity directly rather than following links in unsolicited messages.
- Watch for fake support accounts, recovery offers, urgent withdrawal requests and phishing messages. Never give anyone your password, authentication codes or wallet recovery phrase.
- Review account security, including your password, multi-factor authentication, active sessions and API keys. Remove credentials you do not recognize and contact official support about unexpected activity.
- If you use a self-custody wallet, keep its recovery phrase offline and private. A transfer or change of wallet is a financial and security decision; verify addresses carefully and understand the risks before acting.
Details are changing. Follow Binance's official incident updates and independent investigators, and be cautious of anyone promising guaranteed recovery or asking for a payment to unlock funds.