For: people who hold or trade crypto assets on Binance, and teams whose developers' computers can reach production systems. This article is based on Binance's own announcements and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 31, 2026Not yet known
- Detailed technical findings and post-mortem
- Final amount and how much is recovered
- Date withdrawals fully resume
- Proof of Reserves results
- Whether any customer data was accessed
Binance's Update #2 (October 30, 19:33 as shown on the page) says further technical findings are expected within about 48 hours, a Proof of Reserves snapshot is planned with results by Monday, November 2, and a post-mortem will follow. We could not open Binance's posts on X (HTTP 402), so the figures here come from the two announcements on Binance's own site, with BleepingComputer's report used only for the points noted in the text.
What Binance account holders should do today
Check where you open Binance from
Use the official app or a bookmark you made yourself. After a large theft, fake pages, fake apps and messages imitating the exchange are common. Binance tells users to rely only on its official channels for updates, so start there rather than at links sent to you.
Treat refund, recovery and support messages as fake until you have checked
A message, call or stranger offering to "recover" your coins, "verify" your wallet, process a "refund" or "unlock" a withdrawal is a known scam pattern (see What is phishing?). Do not use its links or phone numbers. If you have a question about your account, use Binance's official Customer Support page that you open yourself. Never read out a verification code, password, private key or seed phrase.
Turn on two-factor authentication and set a unique password
Two-factor authentication means a login needs a second code in addition to the password. An authenticator app or a security key is preferable to SMS (see the multi-factor authentication guide). A password manager makes a unique password practical. If your exchange offers a withdrawal address allowlist, turn it on (this site's recommendation, not a step Binance has asked for).
Check your balance and recent activity
Binance says user funds are safe. You can confirm your balance in the app, and look at your recent sign-ins, device list and withdrawals for anything you do not recognise. If you see something, contact Binance through the official app or site.
Be ready to wait for withdrawals, and ignore anyone asking you to pay to speed them up
Withdrawals are temporarily suspended and Binance plans to resume them in phases. Any message asking for a fee, a "verification payment" or your login to "unfreeze" a withdrawal is not from the exchange. Decide how much you keep on any exchange: assets you do not plan to trade can be held in a wallet you control. That is a general choice, not a recommendation to move funds because of this incident.
What happened (from Binance's announcements)
The following is from Binance's "Security Incident Update" and "Security Incident Update #2", both dated October 30, 2026 (checked October 31). The co-CEO's statement and the totals from analytics firms are from BleepingComputer's report of October 30 and are marked as such.
Oct 29, 2026, about 20:05 (UTC)
Per Binance, its hot wallets were compromised and unauthorized withdrawals followedOct 30, first update
Binance posted a Security Incident Update: estimated impact about US$6.3 billion; about US$3 billion frozen on-chain so far; initial investigation suggests a compromised DevOps engineer's laptop; no evidence of a wallet private key leak; withdrawals temporarily suspended, deposits unaffected; it will cover all losses from the SAFU fund and company funds; it will publish an updated Proof of Reserves after remediationOct 30, 19:33 (as shown on the page)
Update #2: repeats the US$6.3 billion and US$3 billion figures; further investigation uncovered additional points of breach; plan to resume withdrawals in phases within about 34 hours subject to security checks; Proof of Reserves snapshot planned, results by Monday, Nov 2
- What was taken
- Unauthorized withdrawals after its hot wallets were compromised, estimated at about US$6.3 billion in token assets
- Cause so far
- First update: the initial investigation suggests that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals. Update #2: further investigation uncovered additional points of breach. No evidence of a wallet private key leak has been found
- Who bears the loss
- Binance says it will absorb the loss through its SAFU fund and company funds, not users. Update #2 says it has set aside more than US$6.34 billion in company funds, of which US$5 billion is held in the exact impacted token assets, which it says covers about 80% of the impacted amount, and that it is buying the remaining about 20% through market and OTC channels
- Response
- Contained the compromised infrastructure, revoked the affected address authorizations, strengthened security checks, and is working with law enforcement, blockchain analytics firms, asset issuers and other exchanges to trace and freeze assets
- Withdrawals and deposits
- Withdrawals temporarily suspended; deposits and unaffected services operating
- Next
- Technical findings within about 48 hours; Proof of Reserves snapshot, results by Monday, Nov 2; a post-mortem report
First update (initial investigation): a possible compromised DevOps engineer's laptop
↓
A service container reached; unauthorized withdrawals submitted
↓
Hot wallets: about US$6.3 billion estimated impact
Update #2 adds that further investigation uncovered additional points of breach. No wallet private key leak has been found.
From BleepingComputer's report (not Binance's own statements)
BleepingComputer reports that Binance's co-CEO said in a post on X that the attacker did not simply use one engineer's permissions and that the investigation has not attributed responsibility to any individual. It also reports that blockchain-analytics firms put the total at about US$6.36 to 6.4 billion and that stablecoin issuers and others froze about US$2.7 billion; analytics firms have linked the activity to a state-linked group. Binance has not named any group, and neither do we. We could not open the X posts themselves (HTTP 402).
What is known and what is not
Status as of October 31, 2026. We will update this table as Binance publishes more.
| Item | What was announced | Status |
|---|---|---|
| Unauthorized withdrawals after hot wallet compromise | Around 20:05 UTC on Oct 29 | Announced (Binance) |
| Estimated impact | About US$6.3 billion in token assets | Announced (Binance), may change |
| Frozen funds | About US$3 billion frozen on-chain so far | Announced (Binance) |
| Covering of losses | Binance says it will absorb the loss (SAFU and company funds) | Company statement, not audited |
| How the attacker got in | A compromised DevOps engineer's laptop, then additional points of breach | Under investigation (Binance) |
| Wallet private key leak | No evidence found so far | Not confirmed (Binance) |
| Withdrawals | Temporarily suspended; phased resumption planned within about 34 hours of Update #2 | Announced (Binance), subject to checks |
| Deposits and other services | Operating | Announced (Binance) |
| Customer personal data | Not listed among the items | Not stated |
| Who is responsible | Binance has not named anyone | Not stated |
| Proof of Reserves | Snapshot planned, results by Nov 2 | Planned (Binance) |
| Recovery of frozen funds | Ongoing | Under investigation |
What this could mean for account holders
The following is what can generally happen after a large theft from an exchange. Binance has not announced that any of it has happened.
- Fake support and "refund" messages: big incidents bring messages posing as the exchange, asking for a verification code, a seed phrase or a "fee" to release funds
- Fake "Proof of Reserves" or "compensation" pages: look-alike sites and apps that ask you to connect a wallet or sign in
- Withdrawal delays: while withdrawals are suspended, a message saying you must pay or "verify" to withdraw is not from the exchange
- Most of this can be prevented by opening only the official app or your own bookmark, never sharing codes or keys, and turning on two-factor authentication
What organisations should review
Binance says the first lead was a developer's laptop and that further investigation found more points of breach, so we limit this to what the announcements say.
- Developer machines as a way into production: a single engineer's laptop should not be able to reach a service that can move money. Check what a developer's device and account can reach, and separate it from production
- Approval for money movement: high-value withdrawals or payouts need a check that does not depend on one system or one person's access
- Containers and service identities: review which credentials and permissions a service container holds, and how they are limited and rotated
- Detection and speed: rehearse how fast you can revoke access, freeze movement and talk to partners such as issuers and law enforcement
Sources (public records)
The facts in this article are based on the public information below. We have not guessed at the cause or at who is responsible.
- Binance, "Security Incident Update (2026-10-30)" (October 30, 2026, English, checked October 31) — binance.com
- Binance, "Security Incident Update #2 (2026-10-30)" (October 30, 2026, 19:33 as shown, English, checked October 31) — binance.com
- BleepingComputer, "Binance links $6.3 billion crypto theft to compromised DevOps laptop" (October 30, 2026, English; reports the co-CEO's post, which we could not open) — bleepingcomputer.com
Update history
2026-10-31: First version, based on Binance's two announcements of October 30 (checked October 31). We will update when the technical findings, Proof of Reserves results, withdrawal resumption or a post-mortem are published.
Read next
- Other exchange thefts: Bitget crypto theft (about US$387.5 million) / Unauthorized access to Bithumb's internal groupware
- Scam messages: What is phishing?
- Protecting your accounts: Choosing multi-factor authentication / Choosing a password manager
- Other 2026 incidents: Data breaches and cyberattacks in 2026 (Japan and worldwide)