The Short Version
On the afternoon of 29 October 2026, attackers moved roughly $6.3 billion in crypto out of Binance hot wallets across ten blockchains in under an hour. It is the largest crypto theft on record — more than four times the $1.5 billion taken from Bybit in February 2025.
What matters most for Binance customers:
- Binance says customer balances are covered. It set aside more than $6.34 billion of company funds and says around $5 billion of that was already held in the exact tokens that were stolen.
- About $3 billion was frozen within hours, mostly stablecoins blocked by their issuers, Tether and Circle, working with Binance and blockchain partners.
- Withdrawals reopened on 1 November, starting with ETH, USDT and USDC. On the first day, customers withdrew a net $3.64 billion, according to CoinDesk.
- The attack has been linked to North Korea. Blockchain intelligence firm TRM Labs attributed it to TraderTraitor, a unit associated with the Lazarus Group, and the FBI published wallet addresses tied to the theft.
If you use Binance, your balance should be intact. The bigger risk for you now is not the hack itself, but the wave of scams built on top of it. Read our guide to the fake “compensation” scams.
What Happened, Step by Step
The theft
Between roughly 16:05 and 16:20 Eastern Time on 29 October, assets were drained from Binance hot wallets on multiple chains. The largest single Ethereum transaction moved more than $2.5 billion. Further transactions followed on Avalanche and Polygon that evening.
Tallies compiled from on-chain data put the haul at roughly:
| Chain | Approximate amount stolen |
|---|---|
| Ethereum and tokens | $3.8 billion |
| Bitcoin | 18,270 BTC (about $1.5 billion) |
| TRON | $628 million |
| XRP | $296 million |
| Solana | $96 million |
Binance’s later disclosure put the total slightly higher, at around $6.43 billion. Figures will keep moving as investigators trace funds.
How the attackers got in
On 3 November, Binance published an account of how the breach started, as reported by The Hacker News. It reads like a case study in patient, targeted intrusion:
- June 2026 — an engineer on the wallet operations team searched for an AI tool and downloaded a trojanised installer from a fake source.
- September 2026 — a second engineer was approached on a job-hunting platform by someone posing as a “project director”. After video interviews, he was asked to download a coding “assignment” onto his work computer. It contained malicious code.
- 20 October — using that compromised machine, the attacker abused an internal AI tool to reach the computers of other engineers.
- 29 October — the attacker used a stolen deployment token to run a malicious script, gained access to the internal wallet-signing service and pushed out transactions outside the normal withdrawal process.
Binance CEO Richard Teng said investigators found no evidence that wallet private keys leaked. The attackers didn’t steal the keys — they got the system that uses the keys to sign what it shouldn’t have.
The role of EIP-7702
Reports say the attacker used EIP-7702 — an Ethereum feature introduced in 2025 that lets a normal wallet temporarily act like a smart contract — to sweep a large Ethereum wallet in one go. Security researchers quoted by Cointelegraph stressed that the theft was possible without it; the feature mainly made it faster. It’s still worth understanding, because the same feature is now used in phishing aimed at ordinary users. EIP-7702 explained.
What Was Frozen — and What Wasn’t
Stablecoins can be frozen by their issuers, and that’s exactly what happened. Tether began freezing addresses within about an hour; Circle followed minutes later. In total, around $3 billion was frozen with help from issuers and partners.
Native assets like BTC and ETH can’t be frozen that way. Roughly $1.5–1.8 billion is believed to remain under the attackers’ control, and laundering of that much crypto typically takes weeks to years.
Why this matters to you: freezing is powerful, but it works on centralised stablecoins, not on bitcoin or ether. It’s one more reason to understand exactly what you hold and where.
Is Binance Solvent?
Binance says yes, and that users won’t lose funds. Its co-founder said annual revenue alone would cover the loss. Two caveats are worth knowing:
- Independent verification is still limited. CertiK said it needed more information to verify the replacement tokens on-chain; Nansen said it couldn’t verify funds beyond Binance’s roughly $1.16 billion emergency fund.
- Proof of reserves shows assets at a moment in time. It doesn’t show all liabilities or what happens in a run. What proof of reserves can and can’t tell you.
None of this means Binance is in trouble. It means “trust us” and “verified” are different things — which is true of every exchange.
If You Use Binance: What to Do Now
1. Check your balance inside the app you already have. Not via a link in an email, text or social media post.
2. Expect phishing, and ignore it. Within days of the hack, security firm Bitdefender documented fake “SAFU Reconciliation Desk” emails demanding a “verification fee” and fake Trust Wallet emails with a 7 November deadline. No legitimate compensation process asks you to send crypto, share a recovery phrase or click a verification link.
3. Don’t panic-withdraw into a rushed setup. Moving funds in a hurry is how people send to the wrong address or into a fake wallet app. If you want to move to self-custody, do it calmly: test transaction first, address verified on the device screen.
4. Turn on the strongest login protection available. Passkeys or an authenticator app, plus withdrawal address whitelisting where offered.
5. Separate trading money from savings. Keep only what you actively trade on any exchange. Should you keep crypto on an exchange?
What This Hack Teaches Everyone Else
The weakest point is people, not cryptography. No key was cracked. An engineer installed fake software; another ran a “job test”. The same techniques are used against individuals every day. How North Korea steals crypto.
Never run code or installers from strangers on a machine that holds money. That applies to “airdrop checker” scripts, “trading bots” and job assignments alike.
Big platforms are targets precisely because they’re big. CertiK puts 2026 losses at a record $9.2 billion so far, with October alone above $6 billion before freezes. Our analysis of 2026’s losses.
Frequently Asked Questions
Did Binance customers lose money?
Binance says no customer funds were lost and that it covered the shortfall from its own reserves. Withdrawals reopened on 1 November.
Were my personal details leaked?
The reported breach targeted wallet infrastructure. Reports so far don’t describe a leak of customer data, but scammers act as if they have it — treat any message about the hack with suspicion.
Will the stolen crypto be recovered?
About $3 billion was frozen quickly. The rest is being traced by Binance, law enforcement and analytics firms; recovery of native BTC and ETH is historically slow and partial.
Is it safe to keep using Binance?
That’s a personal decision. If you keep funds there, keep only what you trade, use the strongest security settings and keep long-term holdings in self-custody. EU users should also note that Binance had not secured MiCA authorisation by the 1 July deadline. Is Binance licensed in the EU?
Transparency: TrueToCrypto may earn affiliate commissions from links in articles; this article contains none. This article is educational and is not financial advice.
Contact: info@truetocrypto.com
Sources: Wikipedia “2026 Binance hack”; Cointelegraph (30 October 2026) on reserves and EIP-7702; CoinDesk Week Ahead (2 November 2026); The Hacker News (3 November 2026) on Binance’s breach account; Bitdefender (3 November 2026); CertiK via PrimeXBT (31 October 2026). Figures as reported by 4 November 2026.
