On 30 October 2026 Binance published a security update after halting withdrawals late the night before. The firm’s own estimate of the impact is about $6.3 billion. It says about $3 billion of that has been frozen on-chain with help from other companies. The same note says an early look “may involve” a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit withdrawal transactions the exchange did not mean to send. Binance says it has found no evidence that a wallet private key leaked. A full technical account is still to come. This page will not invent one.
The sentence customers are being shown is “user funds are safe”, plus a promise to cover the loss from the Secure Asset Fund for Users and from the company’s own money. Read that as a balance-sheet promise. The number on a Binance screen was never the coin. An exchange balance is an IOU, not a wallet. When the hot wallets that make withdrawals fast are swept, the screen can still show yesterday’s balance. What changed is whether the coins behind that screen are still in the company’s spendable wallets.
What happened
Hot wallets are the float an exchange keeps online so a withdrawal does not wait on a cold-storage ceremony. Binance says it revoked the address authorisation involved and called in law enforcement and tracing firms. The written update timestamped in the early hours of 30 October said deposits and withdrawals were both suspended while checks ran. Later that morning, posts from co-CEO Yi He and from the company’s main account said deposits were operating and that withdrawals were the service still being rebuilt, with a hope of starting them again within 48 hours. Two notices a few hours apart do not say the same thing. The status inside the app is the one that can move money. A headline is not.
Freezes are a different pile from the $6.3 billion. Tether’s chief executive said the company had frozen more than 1.567 billion USDT tied to the incident. Circle’s chief executive said more than $800 million of USDC had been frozen. Ripple said it was freezing RLUSD connected to the event, and Yi He later put that help near $200 million. Those are issuer switches on tokens the issuers can stop. Bitcoin and ether do not have that switch. Binance’s “about $3 billion frozen” is the company’s aggregate at the time of the note. Adding the issuer posts on top of it will double-count. A freeze is also not a return. A frozen token is stuck. It is not back in the hot wallet.
Binance.US said it is a separate company, that it does not share custody with Binance.com, and that its own service was not part of this incident. A similar name is not the same ledger. What is BNB? is the exchange token and the chain fee. BNB moving, or not moving, is not the customer-balance question.
Three earlier exchange thefts on this site are the same kind of event, and they are not this one. In May 2019 Binance lost about 7,000 bitcoin from a single hot wallet and said SAFU, a fund it sets aside from trading fees, would cover customers. That piece is Binance’s 7,000 BTC theft is why SAFU existed. In February 2025 Bybit lost on the order of $1.5 billion from a company wallet. That piece is The Bybit theft was a company wallet. The chain did what signatures do. In September 2026 Bitget lost about $387.5 million from hot wallets. That piece is Bitget lost about $387.5 million from hot wallets. That is an exchange ledger. Each time, the coins that moved belonged to the exchange’s online wallets, and the company promised to honour the balances on its own screen. Bitcoin and Ethereum did not stop, and they did not mint the missing coins back.
Why it matters
If your coins are on Binance, you are a creditor of Binance for that number, for as long as they stay there. “We will cover it” means the company intends to make the ledger good out of SAFU and its own resources. SAFU is a pot the company funds. It is not a government deposit scheme, and it is not a smart contract that pays you when a wallet moves. A promise can be honoured and still leave you waiting on a withdrawal queue. If your coins are in a wallet whose keys you hold, this incident did not spend them. If you were about to send a deposit to a Binance address while withdrawals are paused, you are adding to a balance you cannot yet leave. That is a choice about the company’s word, not a transfer into a vault you control.
A proof of reserves is a list of wallets the exchange says back customer balances, published on a delay. Binance says it will publish a new one after the remediation, which is an admission that the last list cannot describe this morning. Until that file exists, a screenshot of an older reserve page is a stale exhibit. It is not a live audit, and it is not insurance.
Some tracing firms have said the pattern resembles thefts previously linked to North Korea. Binance has not named an attacker. A resemblance is not an identification, and this page will not adopt one. The post-mortem is the document that would have to carry that claim. It is not out.
Phishing is the part that will arrive in your inbox before the post-mortem does. Binance’s own note says to use official channels. Nobody who can restore a withdrawal needs your recovery phrase, a code from a text, or a file that “updates your Binance wallet”. See a practical checklist for keeping crypto safer. See how crypto wallets actually work if the difference between a login and a key is still soft. A candle in the bitcoin price that morning is weather. It does not put the coins back and it does not tell you whether the promise will be kept.
What happens next
A withdrawal restart, if the 48-hour hope holds, probably in stages rather than as a single switch. A technical post-mortem. An updated proof of reserves. More issuer freezes, and arguments about tokens that cannot be frozen. Watch Binance’s own support page and the in-app status. We will not treat an early estimate as a final loss, and we will not treat “user funds are safe” as a statement that the hot wallets still hold the coins.
Not a recommendation to deposit, withdraw, or close a Binance account. Not a finding that any other exchange is safer. Not an identification of who took the funds. The investigation Binance described was not finished when this page was dated.
