On 30 October 2026 Binance published a security update after halting withdrawals late the night before. The firm’s own estimate of the impact is about $6.3 billion. It says about $3 billion of that has been frozen on-chain with help from other companies. The first version of the note said an early look “may involve” a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit withdrawal transactions the exchange did not mean to send. Binance says it has found no evidence that a wallet private key leaked. A full technical account is still to come. This page will not invent one.
Updated later the same day, from posts and a video by co-CEO Richard Teng on X. He said the laptop was not the whole breach. “This was not carried out by one person.” The later investigation, he said, found additional points of breach. It was “a more complex attack process”, not a single one-click action, and the investigation “has not attributed responsibility to any individual.” He also said the attackers used a self-destruct mechanism that destroyed tools and traces as they went, which is why the tracing is slower. In the video he said the attacker used an Ethereum feature, EIP-7702, to obtain execution approval over a hot wallet, and that this delegation did not pass through Binance’s normal approval controls. That is why withdrawals were switched off. The support note put the first unauthorised movements at about 20:05 UTC on 29 October, from hot wallets, and said the authorisations involved had been revoked. It also said the full sequence was still being established, and that a technical account would be published only after it had been checked and only if publishing it would not harm the investigation. As of Sunday 1 November that account was still not out. This page will not describe how that approval is granted, and it will not fill the gap with an outside reconstruction.
The sentence customers are being shown is “user funds are safe”, plus a promise to cover the loss from the Secure Asset Fund for Users and from the company’s own money. Later on 30 October Binance put a figure on the company side of that promise: more than $6.34 billion set aside, of which about $5 billion was already held in the same tokens that were taken. The shortfall, co-CEO Yi He said, is being bought through private deals and on exchanges. That $6.34 billion is not the $3 billion already frozen. The frozen pile is other people’s stop-buttons. The set-aside is Binance’s own money, and it does not include the frozen tokens. Read both as a balance-sheet plan. The number on a Binance screen was never the coin. An exchange balance is an IOU, not a wallet. When the hot wallets that make withdrawals fast are swept, the screen can still show yesterday’s balance. What changed is whether the coins behind that screen are still in the company’s spendable wallets.
Updated on 1 November, from Teng and from the company’s Saturday notice. Teng said Binance had replenished approximately 95% of the impacted assets. That is about $6 billion of the $6.3 billion estimate, up from about 90% on Saturday and about 80% in the notice before that. The set-aside figure did not move. It is still more than $6.34 billion of company funds. Replenished means the company says it has bought or allocated replacement assets. It does not mean the stolen coins were recovered. Saturday’s notice said the money was coming from three places: a partial draw on SAFU, a portion of the futures insurance fund, and the corporate treasury. Yi He said about half of SAFU would be used, and the company said it would put that fund back to about $1 billion. On the futures fund, Binance said it moved only the balance above the size its own risk rules require, and that what remains still meets those rules. That fund exists to absorb bankrupt futures positions. It is not the spot ledger, and it is not deposit insurance.
The ten assets Binance listed as fully backed were bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. The rest of the gap, it said, is less liquid tokens outside that list, which can take longer to buy. A line that says 100% on a reserve page is a claim that the company holds enough of that asset for the balances it shows. It is still a claim on Binance.
What happened
Hot wallets are the float an exchange keeps online so a withdrawal does not wait on a cold-storage ceremony. Teng said that is the piece that was hit. User assets, he said, sit under the company’s custody design, and the vast majority stay in cold wallets until someone actually withdraws. “We never use any customer funds so they are not impacted” is his answer to people asking how a personal balance can be untouched. He means the company does not spend the customer pile to run itself. It does not mean the hot-wallet coins are still there. He did not publish a list of affected accounts.
Binance says it revoked the address authorisation involved and called in law enforcement and tracing firms. The written update, edited later on 30 October, says deposits continue as normal. The first draft of that page had suspended deposits as well as withdrawals. The edit is the company’s correction. Withdrawals were the service that stayed off while the firm rebuilt and tested. Teng’s Friday video put that restart on track within about 40 hours, before Sunday, and said it would not be switched on until it passed testing. On Sunday 1 November the pause ended in phases. Bitcoin was the first network back, shortly after 06:00 UTC, inside a window the company had set from 06:00 to 09:00 UTC. Ether, BNB, and some USDT and USDC followed. The first phase was described as 15 assets, including XRP and dogecoin, with other networks waiting on further checks. A network that is not open on the withdrawal page is still paused. Binance also said it had added newly generated addresses to its proof-of-reserves list and that withdrawals would be sent from those addresses. That is the company paying out from a new wallet. It is not an instruction to send coins to an address a message just gave you. The status inside the app is the one that can move money.
The proof of reserves moved past the Monday promise. Teng had said a full report would come by Monday, 2 November, with an earlier snapshot if the firm could produce one. A snapshot taken at 00:00 UTC on 31 October is now on the proof-of-reserves page. The full zero-knowledge proof, the file a user can check an individual balance against, was then aimed at Tuesday, 3 November. Until that file exists, the snapshot is the company’s exhibit. It is not the check, and it is not insurance.
Freezes are a different pile from the $6.3 billion. Tether’s chief executive said the company had frozen more than 1.567 billion USDT tied to the incident. Circle’s chief executive said more than $800 million of USDC had been frozen. Ripple said it was freezing RLUSD connected to the event, and Yi He later put that help near $200 million. Those are issuer switches on tokens the issuers can stop. Bitcoin and ether do not have that switch. Binance’s “about $3 billion frozen” is the company’s aggregate at the time of the note. Adding the issuer posts on top of it will double-count. A freeze is also not a return. A frozen token is stuck. It is not back in the hot wallet.
Binance.US said it is a separate company, that it does not share custody with Binance.com, and that its own service was not part of this incident. A similar name is not the same ledger. What is BNB? is the exchange token and the chain fee. BNB moving, or not moving, is not the customer-balance question.
Three earlier exchange thefts on this site are the same kind of event, and they are not this one. In May 2019 Binance lost about 7,000 bitcoin from a single hot wallet and said SAFU, a fund it sets aside from trading fees, would cover customers. That piece is Binance’s 7,000 BTC theft is why SAFU existed. In February 2025 Bybit lost on the order of $1.5 billion from a company wallet. That piece is The Bybit theft was a company wallet. The chain did what signatures do. In September 2026 Bitget lost about $387.5 million from hot wallets. That piece is Bitget lost about $387.5 million from hot wallets. That is an exchange ledger. Each time, the coins that moved belonged to the exchange’s online wallets, and the company promised to honour the balances on its own screen. Bitcoin and Ethereum did not stop, and they did not mint the missing coins back.
Why it matters
If your coins are on Binance, you are a creditor of Binance for that number, for as long as they stay there. “We will cover it” now has a progress figure beside it: about 95% of the impacted assets replenished, from the set-aside of more than $6.34 billion, with SAFU and a slice of the futures insurance fund used along the way. SAFU is a pot the company funds. It is not a government deposit scheme, and it is not a smart contract that pays you when a wallet moves. A ticker marked 100% can still sit on a network whose withdrawals have not reopened. If your coins are in a wallet whose keys you hold, this incident did not spend them. Deposits stayed open. A deposit onto a network that cannot yet withdraw is a balance you cannot yet leave.
Some tracing firms had said the pattern resembles thefts previously linked to North Korea. On Saturday the FBI said North Korea was responsible, and named the group it calls TraderTraitor. That is the FBI speaking. Binance’s own notices had not named a person, and a named suspect is not a returned coin. North Korea has denied involvement in attacks of this kind. The US Secret Service said it is working to identify, freeze, trace, and recover funds, with the US Attorney’s Office for the District of Columbia. Those are the agencies speaking for themselves. They are not a finished recovery. The post-mortem, the document that would have to carry Binance’s own account of the sequence, is still not out.
Phishing is the part that will arrive in your inbox before the post-mortem does. Binance’s own note says to use official channels. Nobody who can restore a withdrawal needs your recovery phrase, a code from a text, or a file that “updates your Binance wallet”. See A practical checklist for keeping crypto safer. See How crypto wallets actually work if the difference between a login and a key is still soft. A candle in the bitcoin price that morning is weather. It does not put the coins back and it does not tell you whether the promise will be kept.
What happens next
The rest of the less liquid tokens. The networks that are still closed, each one only after the checks Binance described. The zero-knowledge reserve proof aimed at Tuesday, 3 November. The SAFU refill the company promised, back toward about $1 billion. A technical post-mortem, which the firm said it would publish only once the findings were checked and only if the disclosure would not harm the investigation. More arguments about tokens that issuers can freeze and tokens they cannot. Watch Binance’s own support page, Teng’s and Yi He’s posts, and the in-app withdrawal status. We will not treat 95% as 100%, and we will not treat “user funds are safe” as a statement that the hot wallets still hold the coins.
Not a recommendation to deposit, withdraw, or close a Binance account. Not a finding that any other exchange is safer. The FBI’s statement is the FBI’s. It is not this page identifying an attacker, and it is not a statement that the missing coins are back. The sequence Binance described was not published on 1 November.
