The Unprecedented Heist
In late October 2026, Binance was the target of what is being called the largest single financial heist in history. Hackers managed to steal approximately $6.3 billion in various crypto assets. According to Binance, the attack was a sophisticated, multi-stage
campaign that began months earlier. It involved compromising multiple employee devices, starting with an engineer's laptop that was infected with malicious software. This initial breach allowed the attackers to gain deeper access to the exchange's systems and eventually authorise a flood of massive, fraudulent withdrawal transactions. The U.S. Federal Bureau of Investigation (FBI) has attributed the attack to TraderTraitor, a hacking group sponsored by North Korea. While North Korea has denied involvement, the country has been linked to billions in crypto thefts in recent years.
Binance's Official Response
Binance responded swiftly, issuing numerous statements to reassure its massive user base. The exchange's primary message has been consistent: 'user funds are safe'. Binance immediately pledged to cover all financial losses from the hack, stating that customers would not bear any of the financial impact. To do this, the company said it set aside about $6.34 billion of its own funds, drawing from its corporate treasury, a futures insurance fund, and its emergency reserve, the Secure Asset Fund for Users (SAFU). Within hours of detecting the breach, the company worked with industry partners, including stablecoin issuers like Tether and Circle, to trace and freeze about half of the stolen assets, preventing the thieves from moving that portion.
The Status of Customer Withdrawals
As a primary security measure, Binance temporarily suspended all withdrawals to contain the attack and assess the damage. This freeze lasted for roughly two days. On November 1, 2026, the exchange began a phased reopening of withdrawal services. The process was gradual, with withdrawals for major assets like Bitcoin and Ethereum on their native networks, along with various stablecoins on the Ethereum and BNB chains, being restored first. The company noted that while the initial return of services saw a spike in outflows—with a net of about $3.6 billion to $4.7 billion withdrawn in the first couple of days—the volume has since stabilised. Binance stated this outflow represented a relatively small percentage of its total assets under management, suggesting customer confidence largely held.
What is the 'SAFU' Fund?
A key part of Binance's damage control has been its Secure Asset Fund for Users, or 'SAFU'. Established in 2018, this is an emergency insurance fund created specifically to protect users in extreme cases like this hack. Binance finances the fund with a percentage of its trading fees. Before the incident, the fund held around $1 billion in Bitcoin. To cover the massive loss, Binance used a significant portion of its SAFU fund, along with other company resources. Reports indicated that about half of the SAFU fund's Bitcoin reserves were used, bringing its value down to approximately $580 million. Binance has committed to replenishing the fund back to its $1 billion target, though a specific timeline has not yet been announced.
What Happens Next?
Binance has continued to restore withdrawal services across more networks and assets while strengthening its security protocols. The company announced it had replenished the vast majority of the stolen assets by purchasing replacement tokens on the open market and has promised to cover the final, less liquid portion as well. While the immediate crisis for customers appears to have been averted by Binance's commitment to cover all losses, the incident serves as a stark reminder of the security risks inherent in the centralised crypto exchange model. It has also put a spotlight on the scale and sophistication of state-sponsored hacking groups targeting the digital asset industry.
