Short answer
Binance confirmed a security incident on 29 October 2026 and paused deposits and withdrawals. Binance put the theft at about $6.3 billion and said it would cover all losses. Blockchain analysts attribute the attack to North Korea, but Binance has not.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Binance |
|---|---|
| Incident type | Crypto theft |
| Status | Under investigation |
| Sector | Cryptocurrency exchange |
| Country | Global |
| Detected | 2026-10-29 |
| Disclosed | 2026-10-29 |
| People or records affected | About $6.3 billion in crypto taken from Binance wallets (TRM Labs: roughly $6.36 billion across 10 blockchains). Customer account data has not been reported as exposed. |
What data was exposed
- Exchange-held crypto assets (not reported as personal data)
- No customer personal data reported as exposed so far
What happened
Binance suspended deposits and withdrawals on Thursday 29 October 2026 after what it called a security incident. According to Al Jazeera, the company put the theft at about $6.3 billion, which would make it the largest crypto theft on record. The previous record was the $1.5 billion Bybit hack in February 2025.
TRM Labs tracked about $6.36 billion leaving Binance wallets on ten blockchains. It says most transfers took about 20 minutes, starting at 20:05 UTC on 29 October, with a second wave a few hours later.
What is confirmed and what is not
Binance has confirmed a security incident. It has not published a root cause. It first suspected a compromised engineer laptop, then reported additional points of breach, and it said it found no evidence that any wallet private key leaked.
TRM Labs assesses “with high confidence” that TraderTraitor did it. Chainalysis reached the same view. That is analyst judgment, not a finding by Binance or law enforcement. North Korea routinely denies hacking.
Figures differ by source. Binance says $6.3 billion, TRM says roughly $6.36 billion at transfer-time prices, and Binance warned the total may rise. About $3 billion has been frozen, including more than $2.3 billion by Tether and Circle, according to Reuters as cited by Al Jazeera. TRM’s own freeze figure is about $2.7 billion.
How Binance responded
Binance said it is working with law enforcement and blockchain analysts to trace the funds. It said it would cover all losses and that user funds are safe. On Friday it said it expected to resume withdrawals within 45 hours.
What this means for you
No source we reviewed says customer names, emails or identity documents were taken. The theft appears to target exchange-held assets. The risk to ordinary users is now mostly scams. Panic around a pause on withdrawals is exactly what scammers use. Expect fake “compensation” pages and fake support staff. Our guides on phishing messages and recovery scams explain the patterns, and investment scams covers fake crypto platforms that pose as exchanges. If you suspect your own account was touched, follow our data breach checklist.
What is still unknown
The method of entry, the final loss total, who gets paid back and how, and the identity of the attackers are not settled. We will update this page as Binance and investigators publish more. See all breach reports and our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake 'compensation' or 'refund' sites and emails that ask you to connect a wallet or enter a seed phrase.
- Impersonator accounts on X, Telegram and Discord posing as Binance support and offering to 'speed up' your withdrawal.
- Recovery scams that promise to trace and return stolen crypto for an upfront fee.
- Phishing messages claiming your account is locked and asking you to 'verify' your login through a link.
What to do if you are affected
- 01Go to Binance only by typing the address yourself or using your saved bookmark. Do not click links in emails, texts or social posts about the hack.
- 02Never share your seed phrase, private keys, 2FA codes or passwords with anyone claiming to be Binance staff. Binance will not ask for them.
- 03Turn on an authenticator app or hardware security key for your Binance account and set an anti-phishing code in your security settings.
- 04Check your account history for logins or withdrawals you do not recognise, and report anything odd through the official app.
- 05Ignore anyone offering to recover lost crypto for a fee. Read our guide to recovery scams before paying anyone.
Frequently asked questions
Was my Binance account hacked?
Reports so far describe theft from Binance's own wallets, not individual customer accounts. Binance says user funds are safe. Check your account history and security settings anyway, and treat any message about the hack with suspicion.
Is Binance safe to use now?
Binance says it will cover all losses and that user funds are safe, but its investigation is ongoing and it has not published a root cause. If you use it, enable strong 2FA and keep only what you need on any exchange.
Will Binance users get compensated?
Binance said it would cover all losses, and co-CEO Richard Teng said company funds would be used. It has not published details of how that would work. Do not use any compensation link sent to you.
Who is behind the Binance hack?
TRM Labs and Chainalysis say with high confidence that TraderTraitor, a North Korean unit linked to the Lazarus Group, did it. Binance co-CEO Richard Teng said its investigation has not attributed responsibility to anyone.
When will Binance withdrawals resume?
On Friday 30 October Binance said it expected to resume withdrawals within 45 hours. We found no newer official update as of 30 October. Check the official Binance announcements page for the current status.
Sources
- Binance says $6.3bn stolen in biggest crypto heist in history: What we know, Al Jazeera, 2026-10-30
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, TRM Labs, 2026-10-30
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.