Binance Security Incident: What Is Confirmed, What Is Estimated, and What Is Still Unknown

Binance, one of the world's largest crypto exchanges, has confirmed a security incident. Billions of dollars in crypto left wallets linked to the exchange without approval, according to Binance and blockchain analysts. This story is still moving, so numbers may change.

Updated Oct. 30, 2026. An earlier version of this article incorrectly said Binance had suspended both deposits and withdrawals. Binance says only withdrawals are paused. This update also adds Binance's second notice and Chainalysis's attribution to North Korea.

What Binance says

Binance has posted two notices: Security Incident Update and Security Incident Update #2. Together they say:

• Its hot wallets were compromised "around 2026-10-29 20:05 (UTC)." A hot wallet is an internet-connected wallet an exchange uses to process withdrawals.
• Binance will cover all losses from its SAFU emergency fund and company funds, and it says user funds are safe.
• It found "no evidence" that wallet private keys leaked. It has revoked the affected address authorization and is working with law enforcement and blockchain intelligence firms.

Binance has not published a final root cause. It promises a technical report once the facts are verified.

Withdrawals are paused; deposits are not

Binance says it has temporarily suspended withdrawals while it finishes security checks. Its first notice was updated on Oct. 30 to say deposits are unaffected, and the second says deposits and other unaffected services remain operational.

Binance also lists plans. These are conditional and current as of Oct. 30:

• Withdrawals: the tech team "targets to start resuming" the service "within approximately 34 hours," in phases, if security checks are completed.
• Proof of Reserves: Binance plans an initial snapshot "in 12 hours" and a result ready by Monday, Nov. 2. Proof of Reserves is a report meant to show that an exchange holds enough assets to back user balances.
• Technical findings: Binance expects to share more within about 48 hours, if the findings are verified and sharing them does not harm the investigation.

Binance did not give a start time for those windows. As of Oct. 30, we found no Proof of Reserves result and no confirmation that withdrawals had restarted. Check Binance's official notices for the latest status.

The BBC reported that Binance.US, which serves U.S. customers, said its platform was not affected, and that Coinbase said it was unaffected.

How did it happen?

Binance's first notice said the attack "may involve a compromised DevOps engineer's laptop," which could have given an attacker access to a service container where unauthorized withdrawals were submitted. The second notice says its later investigation "has uncovered additional points of breach." It does not say what they are, and the investigation is still running.

Reuters reported that Teng called it a "complex attack" by more than one person, involving a compromised laptop, software that deleted its own traces and a manipulated transaction-approval system that let money leave a hot wallet without normal approval checks.

TRM Labs, a blockchain analytics firm, examined blockchain activity. It says the most likely explanation is that the attacker could make Binance's hot-wallet signing system sign transactions of its choosing across several chains. The two accounts may not conflict, but the public record does not settle the question yet.

Moved, estimated, frozen, set aside, recovered and lost are different numbers

• Moved: about $6.36 billion by TRM's count, valued at the time of each transfer across ten blockchains (about $6.23 billion at later prices). Chainalysis counts about $6.4 billion. TRM says most of it moved in about 20 minutes starting at 20:05 UTC on Oct. 29.
• Estimated impact: about $6.3 billion, by Binance's estimate, with no breakdown.
• Frozen: about $2.7 billion by TRM, about $2.8 billion by Chainalysis and about $3 billion by Binance. The counts come from different times and methods, and Chainalysis leaves the time of its count blank.
• Set aside by Binance: more than $6.34 billion in company funds, by Binance's statement. It says $5 billion is held in the same kinds of tokens that were taken, such as USDC, USDT, BTC, ETH and BNB, covering about 80% of the impacted amount, and that it is buying the rest on the market and over the counter. We could not verify the figures: the notice lists no wallets and has no outside audit. This is not a measure of loss or recovery.
• Recovered: not confirmed. We found no report that any frozen money has been returned.
• Final net loss: not known yet. Binance says it will cover all losses.

TRM's frozen count includes about 1.77 billion USDT frozen by Tether, about 825 million USDC by Circle, 40.5 million RLUSD by Ripple and 27.8 million USD1 by World Liberty Financial. It also counts about $30 million in ETH and ARB that Arbitrum's Security Council moved out of the attacker's reach.

Frozen is not recovered

A freeze stops tokens from moving. It does not return them. CNBC quoted TRM's Ari Redbord saying recovery follows through a separate legal process, and Chainalysis researcher Eric Jardine saying there is no standard timeline and returning funds can take months or years. Reuters reported that the FBI and U.S. Secret Service are working on the case.

Stablecoin companies can freeze their own tokens. Bitcoin and ether have no issuer that can do that. TRM says the attacker holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer's reach. Chainalysis expects the stolen funds to keep moving in the coming days. Both firms told CNBC such coins can still be traced and may be stopped at a cooperating exchange or other centralized platform.

Who was behind it?

Binance has not said who attacked it. Teng said, as the BBC quoted him, that the investigation "has not attributed responsibility to any individual."

Two private firms point to North Korea. TRM Labs attributes the attack to the TraderTraitor group "with high confidence," citing on-chain and off-chain intelligence it has not published in full. Chainalysis also attributes the attack to TraderTraitor, based on on-chain activity. Its strongest evidence is that money stolen from Binance mixed with money stolen from last month's Bitget theft, which was attributed to North Korea.

These are the judgments of private analytics firms, not a government finding. We found no public statement from a government agency or court naming the attacker for this incident. Reuters notes that North Korea routinely denies such thefts.

What is still unknown

The full cause, withdrawal restart date, amount recovered and final net loss remain unknown. Binance has not shown how outsiders can verify the funds it says it set aside, and we found no published result from its updated Proof of Reserves. We found no government or court statement naming the attacker for this incident.

What readers can do

Rely only on Binance's official channels. Treat any message asking for your password, login codes or recovery phrase as a scam, no matter who it says it is from.

Disclosure: This story was changing quickly when we wrote it, and we updated it on Oct. 30, 2026. Figures from Binance, TRM Labs, Chainalysis, Reuters, BBC and CNBC differ because they were counted at different times and in different ways. Binance's plans and set-aside funds are company statements, not confirmed results, and the North Korea link is the view of two private firms. The illustration is a computer-generated concept image, not a photo of the incident. This article is not financial, legal, or investment advice. AI-assisted research and writing. Cited sources, not AI alone, support the claims.