If you keep crypto on Binance, the exchange says user funds are safe and that it will cover all losses from the roughly $6.3 billion hack. The attack started on the evening of October 29, 2026, UTC. As of the afternoon of October 30 (UTC), you cannot take your coins out: Binance has paused withdrawals, while deposits still work. Binance now says it has set aside more than $6.34 billion of its own money to restore customer balances, with $5 billion already held in the exact tokens that were stolen, according to an update it shared with CoinDesk. Its dedicated safety fund covers less than a fifth of the hack, so the company money is doing most of the work. That is a promise you cannot yet check: the proof will be Binance’s next Proof of Reserves report, its public tally of customer assets.
What happened at Binance
Starting at 20:05 Coordinated Universal Time (UTC) on October 29, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, according to blockchain analytics firm TRM Labs. TRM calls it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. The FBI attributed that Bybit theft to North Korea.
Binance’s own estimate is “around $6.3B.” Its initial finding is that the attack “may involve a compromised DevOps engineer’s laptop,” which let the attacker reach a service container and submit withdrawals the exchange never approved. Binance has since said its investigation “uncovered additional points of breach” beyond the laptop, as The Hacker News reported. It says it found “no evidence of any wallet private key leak,” and has promised a full technical post-mortem.
Much of the money came out of hot wallets, the internet-connected wallets an exchange uses to pay out customer withdrawals. In TRM’s assessment, the most likely explanation is that the attacker got Binance’s hot wallet signing system to sign transactions of the attacker’s choosing across chains.
Is your money on Binance safe?
Binance’s written answer, in its October 30 update: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” SAFU stands for Secure Asset Fund for Users, a $1 billion reserve that Binance finished converting into 15,000 bitcoin in February 2026. At Bitcoin’s October 29 closing price of $77,775, 15,000 bitcoin is worth about $1.17 billion, so the fund alone covers less than a fifth of the hack. That is why the bigger number matters:
| Item | Amount | Who says so |
|---|---|---|
| Estimated total impact | about $6.3 billion | Binance |
| Frozen on-chain so far | about $3 billion | Binance |
| Company money set aside to restore balances | more than $6.34 billion | Binance, via CoinDesk |
| Of that, already held in the stolen tokens | $5 billion | Binance, via CoinDesk |
| SAFU fund (15,000 BTC as of February 2026) | about $1.17 billion at the October 29 close | The Block; Yahoo Finance price |
Binance says the $6.34 billion does not count frozen assets, and that it is buying the rest of the tokens on public markets and over the counter. Its spokesperson told CoinDesk: “Ultimately, all user funds will be verified publicly through our Proof of Reserves.”
Frozen is not the same as returned. Stablecoin issuers can lock their own tokens in an attacker’s wallet: Tether and Circle, the companies behind the dollar-pegged USDT and USDC tokens, froze about $1.77 billion and $825 million respectively, according to TRM’s count. TRM says the attacker still holds more than 420,000 ether (ETH) and 18,270 bitcoin (BTC), about $2.4 billion that no issuer can freeze. Elliptic puts the unfreezable amount higher, at about $3.33 billion.
Bitcoin fell 4.3% on October 29 (UTC), closing at $77,775, down from $81,268 the day before. The hack started late in that UTC day, at 20:05, so the daily figure also includes moves from before it.
When will Binance withdrawals resume?
Binance co-CEO Yi He posted a service update on X at 04:17 UTC on October 30 that said: “We expect to begin resume withdrawal services in the next 48 hours,” according to FinanceFeeds. That window runs to about 04:17 UTC on November 1, and it is a start, not a full reopening. Binance tied the restart to a “security revamp of the withdrawal service and its related addresses,” as The Hacker News reported. Binance’s written October 30 update gives no date, saying only that withdrawals are suspended “while security checks are completed.” Early reports, including The Hacker News, said deposits were suspended too; Binance’s update now says deposits are unaffected and working normally. Binance asks users to “rely only on official Binance channels for updates.” Check any withdrawal news, and any message offering a faster way out, against Binance’s own announcements page.
Who did it
TRM attributes the attack to TraderTraitor, which it calls “North Korea’s elite hacking unit,” with high confidence. Chainalysis, another analytics firm, also linked it to North Korea and said it saw funds from the Bitget theft mixing with funds from Binance, as reported by The Hacker News. Elliptic, a third firm, told The Hacker News it assessed North Korea-linked actors as responsible, but urged caution, citing laundering that differs from past patterns and the lack of a root cause. Binance has not named anyone and says it is working with law enforcement to confirm the attackers’ identity.
The firms’ totals differ: Chainalysis estimated about $5.912 billion at the time of theft, and Elliptic $6.43 billion.
Bitget was hit in a similar way five weeks earlier
On September 24, 2026, attackers moved money out of Bitget, and Bitget says they did it by feeding false data to its own approval process, without stealing its private keys. Binance, for its part, says it found no evidence of a key leak, and Chainalysis says funds from the two thefts have mixed.
| Binance | Bitget | |
|---|---|---|
| Date | October 29, 2026 | September 24, 2026 |
| Amount taken | about $6.3 billion | $387.5 million |
| How | Initial finding: a compromised engineer’s laptop may have opened a service container that sent unapproved withdrawals; more breach points found since; no evidence of a key leak | Bitget says a backend system was compromised and fed false data to its approval process; keys not stolen |
| What it told customers | “User funds are safe”; losses covered from SAFU and company funds | Balances unaffected; Protection Fund covers the loss |
Bitget says its User Protection Fund holds $464 million, as TRM reports, more than the $387.5 million Bitget later said was taken (its first estimate was $351.6 million). Bitget resumed Bitcoin withdrawals within four days and scheduled other assets over the following week, starting with Ether on September 29. The amount taken from Binance is more than five times its SAFU fund, so its promise rests on the company money it says it has set aside.
Should you move your crypto off an exchange?
Coins on an exchange are a promise from that exchange. Bitget said its customers’ balances were unaffected, and Binance has made the same promise. Moving coins to your own wallet takes the exchange out of the picture, and puts all of the risk on you.
A hardware wallet, which Ledger now calls a signer, keeps your private keys offline, and you approve each transaction on the device itself. The catch is the recovery phrase, the list of words you write down at setup. Ledger’s own guide is blunt: if you lose the device and do not have that phrase, “your crypto really is gone.”
A rough rule: if you trade often or hold an amount you could shrug off losing, an exchange’s convenience may be worth it. If you hold coins for years and the amount matters to you, a hardware wallet takes the exchange-hack risk you just watched at Binance and Bitget out of the picture.
If you do move coins, wait until Binance reopens withdrawals, then send a small test amount and confirm it arrives before you send the rest.
Two hardware wallets to start with
Buy a hardware wallet from its maker or an authorized seller. Trezor calls its own shop and trusted resellers “your top choice to guarantee that your device is genuine, unaltered, and absolutely legit.” The two Amazon links below go to listings sold by Ledger Official and Trezor Company, the brands’ own Amazon storefronts, as of October 30, 2026. The prices below are the makers’ US store prices; Amazon’s may differ.
Ledger Nano S Plus
The Ledger Nano S Plus connects by USB-C to a computer or an Android phone (Android 10 or later) and has a 1.1-inch monochrome screen where you approve each transaction. Ledger files it under its “classic” signers for backup use, and says its Bluetooth Nano X works with its iPhone app. Ledger’s store listed the Nano S Plus at $69 on October 30, 2026.
Trezor Safe 3
The Trezor Safe 3 also connects by USB-C, has a two-button pad and a 0.96-inch OLED screen, and uses a certified secure element chip to protect your keys. Trezor’s page says there is no swap, send, setup or device management on iOS, so plan on a computer or an Android phone. Trezor’s store listed it at $59, on sale for $50, on October 30, 2026.
Binance hack questions
Did Binance customers lose money in the hack?
Binance says user funds are safe and has promised to cover all losses from its SAFU fund and company funds. It says it has set aside more than $6.34 billion for that, and that its Proof of Reserves will verify user funds.
When will Binance withdrawals be back?
Co-CEO Yi He posted at 04:17 UTC on October 30 that Binance expects to begin resuming withdrawals in the next 48 hours, according to FinanceFeeds. Binance’s written update gives no date. Deposits are working normally.
How much was stolen from Binance?
Binance estimates about $6.3 billion, with about $3 billion frozen on-chain. TRM Labs counts about $6.36 billion, and about $2.7 billion frozen as of 00:30 UTC on October 30.
Who hacked Binance?
TRM Labs attributes it with high confidence to North Korea’s TraderTraitor group, the same group the FBI blamed for the Bybit hack. Elliptic also points to North Korea-linked actors but urges caution. Binance has not named anyone.
Is a hardware wallet safer than keeping crypto on an exchange?
It takes an exchange hack out of the picture, but the backup is on you. In Ledger’s words, if you lose the device and do not have the recovery phrase, “your crypto really is gone.”
Sources (14)
- binance.com Security Incident Update (2026-10-30)
- trmlabs.com North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
- thehackernews.com Binance Suffers Security Breach Affecting $6.3 Billion in Assets
- trmlabs.com Bitget Loses USD 351.6 Million in Hot Wallet Breach
- bleepingcomputer.com Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
- ic3.gov FBI: North Korea Responsible for $1.5 Billion Bybit Hack
- theblock.co Binance finalizes $1 billion SAFU reserve conversion into bitcoin
- finance.yahoo.com Yahoo Finance: Bitcoin USD (BTC-USD) price history
- shop.ledger.com Ledger: Nano S Plus (shop, October 30, 2026)
- trezor.io Safe 3 (store, October 30, 2026)
- ledger.com Ledger Academy: What happens if I lose my Ledger?
- coindesk.com Binance arranges $6.34 billion to cover losses from record crypto hack
- financefeeds.com Binance Withdrawals Expected Back Within 48 Hours
- amazon.com Ledger Nano S Plus and Trezor Safe 3 listings (seller check, October 30, 2026)
🦋 Discussion on Bluesky
Discuss on Bluesky