What We Know About the Incident
On October 29, 2026, Binance detected a series of unauthorized withdrawals from its hot wallets, amounting to what may be the largest crypto heist on record. Within about 20 minutes, attackers siphoned out approximately $6.3 billion in digital assets
across ten different blockchains. Binance acted quickly, temporarily suspending all withdrawals and initiating an investigation. The exchange immediately began working with law enforcement and blockchain intelligence partners to trace and freeze the stolen funds. Their collaborative efforts have successfully frozen about $3 billion of the affected assets on-chain.
How Did the Hack Happen?
Binance has described the breach as a 'sophisticated, multi-stage campaign' rather than a single event. The investigation suggests the attack began months earlier and involved social engineering. In one instance, an engineer was targeted through a fake job interview process. The attackers, believed to be the North Korean state-sponsored group known as TraderTraitor, tricked the employee into downloading malicious code disguised as a technical test. This malware allowed the hackers to gain access to internal systems. The initial entry point may date back to June 2026, when another engineer inadvertently downloaded a malicious tool. Ultimately, the attackers leveraged their access, including compromising an internal AI tool, to gain control of several employee laptops and authorize the massive withdrawals. Binance has stressed that there is no evidence that any private wallet keys were leaked.
Are User Funds Safe?
This is the most critical question for millions of users, and Binance's response has been emphatic. The company announced immediately that user funds are safe and that Binance will absorb the full financial impact of the incident. To cover the losses, the exchange is using its Secure Asset Fund for Users (SAFU) and its own corporate treasury. The SAFU is an emergency insurance fund established in 2018, specifically for scenarios like this. Binance quickly began replenishing the affected assets, reporting that by November 2, all impacted tokens were 100% restored and backed. While withdrawals were temporarily paused, they were resumed in phases.
Market Reaction and Wider Impact
News of the historic hack sent ripples through the crypto markets. Bitcoin (BTC) saw a drop of over 3%, and other major tokens like Ether (ETH) and Binance's own BNB coin also declined. The incident prompted a massive wave of withdrawals from the platform as spooked users moved their funds, with a net outflow of over $4.6 billion reported in the immediate aftermath. However, the market showed some resilience, with selling pressure easing after a few days as Binance's commitment to covering all losses appeared to restore some confidence. The breach serves as a stark reminder of the security risks inherent in centralised exchanges and has put the security protocols of all major platforms back under the microscope.
Binance's Next Steps
Binance continues its deep investigation, working with internal and external security experts to understand every facet of the attack. The company has already rebuilt the affected systems in a new, secure environment, replaced compromised devices, and decommissioned all related credentials. To enhance transparency, Binance has also committed to releasing an updated Proof of Reserves report, allowing users to verify their balances. The exchange is continuing its cooperation with law enforcement to pursue the perpetrators and recover as much of the stolen funds as possible. In a statement, the company acknowledged the concern the incident caused and thanked its users and partners for their patience and trust.
