Binance says a hack hit about $6.3 billion. Here's what is confirmed, what isn't, and why the numbers differ

Binance, the world's largest cryptocurrency exchange, says a security incident on Oct. 29, 2026, had an "estimated total impact" of about $6.3 billion, with about $3 billion frozen on-chain, according to its incident update. It says it will cover all losses from its SAFU emergency fund and company funds. Blockchain-tracing firms TRM Labs, Chainalysis and Elliptic all blame North Korea. That would make it the largest crypto theft on record.

Key facts - When: Oct. 29, starting about 3:05 p.m. CT, per TRM Labs and Elliptic - Binance's estimate: about $6.3 billion hit; about $3 billion frozen - Blamed by: the FBI (Oct. 31): North Korea, "TraderTraitor"; TRM Labs, Chainalysis and Elliptic said so first - Investigating: the FBI, with the US Secret Service and IRS Criminal Investigation - Withdrawals: restarting in phases since about 1 a.m. CT Nov. 1; 15 networks re-enabled by 6:36 a.m. CT - Phase two: more withdrawals reopening since 10 p.m. CT Nov. 2; 34 more Ethereum and 22 Solana tokens re-enabled by 1:08 a.m. CT Nov. 3 - Deposits: unaffected, Binance says - Losses: Binance says it will bear them and has covered about 95% so far - Proof of reserves: full proof for the Oct. 31 snapshot completed Nov. 2 (top ten tokens); next snapshot Nov. 4 - First-day withdrawals: $4.649 billion out, $1.01 billion in (midnight to 9:30 a.m. CT Nov. 1)

What has Binance said happened?

Its first explanation: the incident "may involve a compromised DevOps engineer's laptop," which let an attacker reach a "service container" and submit unauthorized withdrawals. It said it found "no evidence of any wallet private key leak," per its update. At 3:47 a.m. CT on Oct. 30, Binance said on X that later investigation "uncovered additional points of breach." It called it "a complex attack" and said outflows stopped when it paused withdrawals, in that post. It has promised a full post-mortem. Its Oct. 30 afternoon update repeats that it has found no evidence that wallet private keys were leaked (Recovery Update #2).

Later on Oct. 30, co-CEO Richard Teng said in a video statement on X that the attack "was not carried out by one person." He said the attacker abused a protocol called EIP-7702 to get on-chain execution approval over a hot wallet, and that this "did not pass through our normal approval controls." He also said the attacker used "a self-destruct mechanism that destroyed tooling and traces," BBC News reported.

Embedded post: Binance (@binance) on X, Oct. 30, 2026, 3:47 a.m. CT.

Who is being blamed?

Now the US government as well as three tracing firms. Update, Nov. 1: On Oct. 31 the FBI said that "North Korea was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," and that it calls this activity "TraderTraitor," in a notice on its website. The FBI posted it on X at 5:36 p.m. CT (FBI Cyber Branch on X). It said that, working with the US Secret Service and IRS Criminal Investigation, it has seen the hackers converting stolen assets mainly into ether, and it expects more laundering through decentralized finance and instant-swap services. It asked node operators, exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions linked to the addresses it listed, and asked anyone with information to contact a local FBI field office or ic3.gov. That came two days after the theft. For Bybit it took five.

Before that, the blame came from private firms. TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit, citing on- and off-chain intelligence. Chainalysis reached the same view after watching Binance funds mix with money from a September exploit of the exchange Bitget, it said. Elliptic also attributes it to North Korea but lists reasons for caution, including slower laundering than usual. It notes that "no government or law enforcement agency has confirmed attribution," as of 08:00 UTC Oct. 30. Binance has not named anyone itself, though it thanked the FBI on X after the notice. Before the notice, on Oct. 30, the FBI said it was "aware of the incident and is engaged with relevant public and private partners." The US Secret Service said it is working "around the clock" with private-sector partners "to identify, freeze, trace, and recover funds," in coordination with the US Attorney's Office for the District of Columbia. It said its investigation "remains in its early stages," according to BBC News on Oct. 30. For comparison, the FBI named North Korea for the Bybit theft on Feb. 26, 2025.

Embedded post: FBI Cyber Branch on X, Oct. 31, 2026, 5:36 p.m. CT.

Why do the totals differ?

Each count uses a different time, method and set of blockchains. These are the latest figures each source had published when we checked:

TRM and Elliptic value each transfer at the price when it was taken. Elliptic counts one more chain (NEAR). It also leaves out $169 million that appears to be Binance moving its own funds. Frozen totals rose through the night, from $2.54 billion in Binance's 6:22 p.m. CT post to about $3 billion by 7:52 p.m. CT. Almost all frozen money is stablecoins, which their issuers can lock. Bitcoin and ether have no issuer to freeze them. Elliptic says the attacker still controls about $3.33 billion of such assets. TRM put the figure at about $2.4 billion hours earlier.

Is customer money safe, and when do withdrawals come back?

They began coming back early on Nov. 1, one network at a time. Update, Nov. 1: In "Recovery Update #4," posted at 11:11 p.m. CT on Oct. 31, Binance said phase one would start between 06:00 and 09:00 UTC on Nov. 1, prioritizing tokens by the past week's user demand, and that deposits were never affected (Binance on X). It said the first network opened was bitcoin, at about 1 a.m. CT (Binance on X). By 6:36 a.m. CT it listed 15 networks as re-enabled, including bitcoin, Ethereum, BNB Smart Chain, XRP, Solana and Tron (Binance on X). It said more assets will follow "in phases as security checks are completed" and that users may see delays. Update, Nov. 1 afternoon: At 10:12 a.m. CT, Binance said all 15 phase-one networks had resumed by 6:36 a.m. CT. Between midnight and 9:30 a.m. CT it processed $4.649 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, which it put at 2.1% of its $171 billion in assets. It said withdrawals are "stabilising as expected" after an early spike (Binance on X; TechCrunch). It has not said which networks come next. Binance also said withdrawals now come from newly generated wallet addresses, which it added to its proof-of-reserves list (Binance on X). Update, Nov. 2: Binance said at 2:00 a.m. CT that fiat withdrawals had reopened for U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah, adding to more than 20 currencies already available (Binance on X). In "Recovery Update #5," posted at 6:49 a.m. CT, it said the next phase of crypto withdrawals for more networks and assets is planned for Tuesday, Nov. 3, as "a progressive rollout" (Binance on X). Update, Nov. 3: Phase two started overnight. In "Recovery Update #6," posted at 8:30 p.m. CT Monday, Binance said it would begin reopening withdrawals for a longer list of assets at 04:00 UTC Tuesday (10 p.m. CT Monday), again one network and token at a time as security checks finish (Binance on X). The list covers more than 100 network-token pairs on nine networks, including BNB Smart Chain, Ethereum and Solana, Exchange.news reports. By 1:08 a.m. CT, Binance listed 34 more Ethereum tokens and 22 Solana tokens as re-enabled, on top of five Ethereum stablecoins restored first (Binance on X). It said that by 03:00 UTC, hourly deposits were running ahead of withdrawals (Binance on X). Check your asset's withdrawal page or Binance's network status page before moving funds.

On losses, Binance said on Oct. 31 that it had covered about 90% of the impact using part of its SAFU fund, part of its futures insurance fund and its own treasury, and that it would refill SAFU to about $1 billion (Update #3). Late Oct. 31 it said it had "covered $6B of the impacted amount" (Binance on X), and Recovery Update #4 puts coverage at about 95%. Binance says the remaining 5% is less liquid tokens outside its top ten, and that it "will bear the financial impact of the stolen funds." It took a new proof-of-reserves snapshot at 00:00 UTC Oct. 31. It says the full zero-knowledge proof takes 40 to 50 hours to generate and is "estimated to be by Tuesday, 2026-11-03 (UTC)," later than the Nov. 2 date in its Oct. 30 update (Update #3). Its Nov. 1 morning post now says the updated report is expected on its proof-of-reserves site "tomorrow," meaning Nov. 2, Exchange.news reported. It has promised a post-incident report once its investigation is complete. Update, Nov. 2: Recovery Update #5 says the full zero-knowledge proof for the Oct. 31 snapshot is done, so users holding any of ten tokens (bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC) can check for themselves that their Binance balances are backed at least 1:1, using a verifier tool on its proof-of-reserves site. It plans another snapshot covering more tokens on Nov. 4, with that proof taking about 40 to 50 hours. It repeated that it has covered about 95% of the impacted amount, that the rest is less liquid tokens outside the top ten, and that "Binance will absorb the financial impact of the stolen funds, not our users." A proof of reserves covers balances at the snapshot time; it isn't an audit of the hack or its cause (Binance on X).

Beware fake "compensation" offers. Early on Nov. 1, Binance replied to several posts advertising a "$150 compensation" reward for the withdrawal pause: "This is false information. The screenshot is digitally altered" (Binance on X).

Earlier: Binance said users would not lose money. At 5:55 a.m. CT on Oct. 30, it said it had begun recovering affected assets for users. It said it had set aside more than $6.34 billion of company funds, $5 billion of it already in the same tokens that were taken, in its latest post. Deposits were unaffected. Withdrawals were paused. Binance said at 3:47 a.m. CT Oct. 30 it was on track to resume them "in 45 hours." In his later video, Teng said Binance is rebuilding the withdrawal service and won't switch it back on until it "passes rigorous testing," per BBC News. Update, Oct. 31: In "Recovery Update #2," an X article signed by co-CEOs Yi He and Richard Teng and posted at 2:58 p.m. CT on Oct. 30, Binance said its tech team "targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks," and that the restart "will proceed on a phased approach" (Binance on X). By our count that is about 1 a.m. CT on Sunday, Nov. 1, in line with its earlier estimates. The same update says the $5 billion it holds in the stolen tokens covers "approximately 80% of the impacted amount" and that it is buying the rest. It promised an initial proof-of-reserves snapshot within 12 hours and the result by Monday, Nov. 2, plus technical findings "within about 48 hours." Binance.US, a separate exchange, said it was not affected, the Guardian reported.

How does it compare with past hacks?

It is about four times the previous record. The FBI said North Korea stole about $1.5 billion from the Dubai-based exchange Bybit in February 2025, in its public notice. TRM calls the Binance theft about four times that size, and Elliptic more than four times.

How are outlets covering it?

All four outlets we read agree on Binance's $6.3 billion and $3 billion figures and the record size. The Guardian leads on the North Korea attribution and adds UK regulators' response. CNN focuses on North Korea's hacking units as a source of money for the regime and on the laundering chase ahead. Fox Business runs a straight account built on Binance's promise to cover losses and the market fall. The Daily Mail highlights what it calls Binance's "sometimes contradictory" messages and founder Changpeng Zhao's past conviction.

Sources

• Binance, "Security Incident Update (2026-10-30)"
• Binance on X: 6:22 p.m. CT Oct. 29, 7:52 p.m. CT Oct. 29, 11:36 p.m. CT Oct. 29, 3:47 a.m. CT Oct. 30, 5:55 a.m. CT Oct. 30, Recovery Update #2, 2:58 p.m. CT Oct. 30
• FBI, "North Korea Responsible for $6 Billion+ Binance Attack," Oct. 31, 2026; FBI Cyber Branch on X, Oct. 31
• Binance on X, Oct. 31-Nov. 1: Update #3, 9:30 a.m. CT Oct. 31, 10:04 p.m. CT Oct. 31, Recovery Update #4, 11:11 p.m. CT Oct. 31, first network, Nov. 1, new wallet addresses, Nov. 1, withdrawal update, 6:36 a.m. CT Nov. 1, fake compensation warning, Nov. 1, withdrawal and deposit update, 10:12 a.m. CT Nov. 1
• Binance on X, Nov. 2: Fiat Withdrawal Update, 2:00 a.m. CT, Recovery Update #5, 6:49 a.m. CT; Binance proof-of-reserves site
• TRM Labs, Oct. 29
• Chainalysis, Oct. 30
• Elliptic, Oct. 30
• FBI IC3, "North Korea Responsible for $1.5 Billion Bybit Hack," Feb. 26, 2025
• The Guardian, Oct. 29
• CNN, Oct. 30
• Fox Business, Oct. 30
• Daily Mail, Oct. 30
• BBC News live page, Oct. 30
• BBC News explainer

Drafted with AI assistance from primary sources. Written and edited by The Whole Read newsroom under Monsaur Othman's editorial standards. Read how we use AI, our editorial policy and our corrections policy.