Binance Hack 2026: What We Know About the $6.3 Billion Breach

Binance halted withdrawals after an estimated $6.3 billion breach on 29 October 2026. Here is the timeline, the cause, how much was frozen, and what users and businesses should do now.

30 October 2026 · Deixtra

Last updated 30 October 2026. This is a developing story, and figures may change as Binance and investigators publish more.

Late on Thursday 29 October 2026, money started leaving Binance's hot wallets in amounts nobody had seen before. Within a few hours, the world's largest crypto exchange had stopped all deposits and withdrawals, stablecoin issuers were freezing billions of dollars in the attacker's wallets, and bitcoin had dropped below $77,000.

By early Friday, Binance said the estimated total impact was around $6.3 billion. If that figure holds, it's the largest crypto theft on record, roughly four times the Bybit hack of February 2025.

Plenty of our clients in Pakistan and the Gulf hold crypto or run businesses near it, and the questions we've had today are the same: what happened, is my money safe, and what should I do? This post pulls together what has been confirmed, what hasn't, and what the incident teaches any business that moves money through software. We've linked every source at the end and marked anything that's still an estimate or an allegation.

What happened in the Binance hack?

An attacker withdrew billions of dollars in crypto from Binance's hot wallets (the internet-connected wallets an exchange uses to process withdrawals) starting around 20:30 UTC on 29 October 2026. Binance suspended all deposits and withdrawals, said user funds are safe, and said it will cover all losses from its SAFU emergency fund and company funds. Its first findings point to a compromised laptop belonging to a DevOps engineer, which gave the attacker a way to submit withdrawals that Binance hadn't authorised.

Binance says it has found no evidence that any wallet private keys leaked. That detail matters. It suggests the attacker didn't steal the keys to Binance's wallets. Instead, they got into a system that was already allowed to request withdrawals and made it send money out.

How much was stolen?

Nobody has a final number yet, and the estimates differ widely because they measure different things. Some count what left the wallets, some count what was stolen at the time of theft, and some count wallet balances.

Source	Figure	What it measures
Binance	About $6.3 billion	Estimated total impact, in its first findings
Chainalysis	About $5.912 billion	Amount stolen at the time of theft
Coinbase's Conor Grogan, via The Block	Up to $5.8 billion	On-chain estimate
Blockaid, via The Block	About $3.3 billion	Suspicious outflows from hot wallets on Ethereum, Arbitrum and Avalanche
Changpeng Zhao (CZ), via AFP	"A bit higher" than $1 billion	Early comment from Binance's founder and largest shareholder

Chainalysis described its figure as "nearly 4x the amount stolen in the next largest crypto heist (Bybit, 2025)". Bybit lost about $1.4 to $1.5 billion in February 2025 in an attack attributed to North Korea-linked hackers.

What is the timeline of the Binance hack?

Pieced together from CoinDesk's live coverage, with times in UTC:

Time (UTC)	What happened
29 Oct, about 20:30	The breach began, according to Arkham CEO Miguel Morel, based on blockchain data
29 Oct, about 20:40	Bitcoin fell below $80,000
29 Oct, 21:52	Changpeng Zhao posted that user funds were safe and that he expected them to be fully covered
29 Oct, 21:53	Tether and Circle announced freezes of their stablecoins held by the attacker
29 Oct, 22:55	Binance suspended deposits and withdrawals. Co-CEO Yi He said Binance would cover all losses
29 Oct, 23:17	Aave froze its lending markets as a precaution, saying its own contracts were unaffected
30 Oct, 01:12	Arbitrum's Security Council froze 74.56 million ARB from the attacker's wallet. Bitcoin was just under $77,000
30 Oct, 02:36	Binance shared its first findings: a compromised DevOps engineer's laptop, no evidence of a private key leak

How did the hackers get in?

Binance's initial investigation says the incident may involve a compromised laptop belonging to a DevOps engineer. According to Binance's update, the attacker used it to reach a service container, a piece of Binance's internal infrastructure, and submit unauthorised withdrawal transactions.

Binance hasn't said how the laptop was compromised, how long the attacker had access, or why the withdrawals weren't stopped sooner. It has promised a detailed technical post-mortem once the investigation is complete.

The pattern will be familiar to anyone who followed the Bybit hack. There, too, the attackers didn't break the cryptography. They went after the people and the internal systems around it. In practice, an exchange's security depends on every laptop and every internal service that's allowed to move money, as well as on how it stores its keys.

Who is behind the Binance hack?

This hasn't been confirmed. The independent blockchain investigator ZachXBT has linked the attack to North Korea's Lazarus Group, according to TokenPost's report of his post, which describes the link as likely. Some reports say TRM Labs tied the attack to TraderTraitor, a North Korean group, but we couldn't confirm that in a TRM Labs statement. Binance hasn't named a suspect, and the US Department of Justice and FBI didn't respond to AFP's requests for comment.

North Korea-linked groups have been blamed for several of the largest crypto thefts, including Bybit. That makes them the first suspect, but it isn't evidence that they did this one. Treat any attribution as an allegation until law enforcement or Binance confirms it.

How much has been frozen?

A lot of the stolen money was in stablecoins and tokens whose issuers can freeze them, and several moved quickly. Binance's latest update put the verified frozen total at about $3 billion. That money is locked in place, not returned.

Tether froze more than 1.57 billion USDT, according to its CEO Paolo Ardoino.
Circle froze more than 800 million USDC, according to its CEO Jeremy Allaire.
Ripple reportedly froze about $200 million, and World Liberty Financial confirmed about $27 million in USD1 was frozen, per CoinDesk.
Arbitrum's Security Council froze 74.56 million ARB.
First Digital froze about 3.4 million FDUSD, according to TokenPost.

Freezing is why the "stolen" and "lost" numbers may end up far apart. Funds that are frozen can, in some cases, be recovered later through legal processes. Funds already swapped into bitcoin or ether and moved through mixers are much harder to get back.

Are Binance users' funds safe?

Binance says yes. It has said repeatedly that "user funds are safe" and that it will cover all losses using its SAFU fund and company funds. SAFU, the Secure Asset Fund for Users, is an emergency reserve Binance set up in 2018 for exactly this kind of event.

Two cautions. First, a promise to cover losses is only as good as the money behind it. One analysis estimates SAFU holds about $1 billion in bitcoin, which is well short of a $6 billion loss, so the rest would have to come from Binance's own funds. Binance says it will publish an updated proof of reserves after the remediation work, and that's the document to watch. Second, Binance's messages in the first hours were, as AFP put it, "sometimes contradictory". Wait for the post-mortem before drawing firm conclusions.

Binance.US says it is a separate platform, wasn't affected, and is operating normally.

When will Binance withdrawals resume?

Binance hasn't given a date. Its latest statements say withdrawals will resume as soon as the security issue is fully resolved, and co-CEO Yi He said, "We will enable withdrawals as soon as the security scan is complete." Until then, deposits and withdrawals remain suspended.

What should Binance users in Pakistan and the UAE do now?

This isn't financial advice, but these are the practical steps we'd take:

Don't panic-sell in a falling market based on rumours. Wait for Binance's official updates.
Follow only Binance's official website, app and verified social accounts. Binance itself has warned users not to trust unofficial links, messages or requests for account details.
Ignore anyone offering to "recover" your funds or "release" withdrawals for a fee. Scammers move fast after every big hack, often on WhatsApp and Telegram.
Never share your password, 2FA codes or seed phrase, whatever the message claims.
Turn on withdrawal address whitelisting and check your security settings once access returns.
Note your balances now with screenshots, in case you need to raise a support ticket later.

What did the hack do to crypto prices?

Prices fell across the market. By about 01:12 UTC on 30 October, CoinDesk reported bitcoin just under $77,000, down about 5 percent in 24 hours, with ether down 5.7 percent, BNB down 8.2 percent, XRP down 7.4 percent and SOL down 7 percent. Stablecoins held their value. Trading firms Wintermute and GSR said their exposure to Binance was limited, and Bybit denied rumours that it had also been hit.

What can businesses learn from the Binance hack?

You don't have to run an exchange for this to apply. Any business whose software can move money (a POS that issues refunds, an ERP that releases supplier payments, a store that pays out to sellers) has the same weak point: an internal system that's trusted to send money, reachable from someone's laptop.

These are the controls we build into payment flows for our clients, and the ones this incident is a reminder of:

Give each system and each person only the access they need. A deployment tool shouldn't be able to approve payments.
Put limits on automated payouts, per transaction and per hour, so a compromised service can't empty an account in one go.
Require a second approval for large or unusual payments, from a different person on a different device.
Alert on unusual patterns, such as a spike in withdrawals or payouts to new destinations, and be able to pause payouts with one switch.
Treat staff laptops as part of your security. Keep them updated, use device management, and use hardware security keys for admin accounts.
Keep logs that show who or what triggered each payment, so you can trace an incident quickly.

The same thinking applies to AI tools that can take actions on your behalf. We wrote about that in our post on Google's Gemini agent and AI coworkers.

Key takeaways

Binance was hacked on 29 October 2026 and suspended all deposits and withdrawals.
Binance estimates the total impact at about $6.3 billion. Chainalysis estimates $5.912 billion stolen, almost four times the 2025 Bybit hack.
Binance's first findings point to a compromised DevOps engineer's laptop, with no evidence of a private key leak.
About $3 billion has been frozen, mostly by Tether and Circle.
North Korea's Lazarus Group is suspected by on-chain investigators, but this isn't confirmed.
Binance says user funds are safe and it will cover all losses from its SAFU fund and company funds. Watch for its post-mortem and updated proof of reserves.

Frequently asked questions

Was Binance hacked?

Yes. Binance confirmed a security incident on 29 October 2026, suspended deposits and withdrawals, and said its initial investigation points to a compromised DevOps engineer's laptop.

How much money was stolen from Binance?

Binance estimates the total impact at around $6.3 billion. Chainalysis estimates about $5.912 billion stolen at the time of theft. A final figure will come with Binance's post-mortem.

Is my money safe on Binance?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Check its updated proof of reserves when it's published.

When can I withdraw from Binance again?

Binance hasn't given a date. It says withdrawals will resume once its security checks are complete.

Is this the biggest crypto hack ever?

If the estimates are confirmed, yes. The previous record was the Bybit hack in February 2025, at about $1.4 to $1.5 billion.

Did North Korea hack Binance?

It hasn't been confirmed. Investigator ZachXBT has linked the attack to the Lazarus Group, but neither Binance nor law enforcement has named who was responsible.

Is Binance.US affected?

Binance.US says it is a separate platform, was not affected, and is operating normally.

Need your payment systems checked?

We build POS, ERP, e-commerce and payment integrations for businesses in Pakistan, the UAE and the wider GCC, with approval limits, alerts and audit logs built into every flow that moves money. If you'd like your payout and refund flows reviewed, send us your setup on WhatsApp and we'll come back with a written scope and a fixed quote.

This post is for information only and isn't financial or investment advice. Figures come from Binance's statements and news coverage as of 30 October 2026, and may change.