Binance Hack of US$6.3 Billion: What Happened, When Withdrawals Resume and What Happens to User Assets (Live Updates)

On 29 October 2026 (US time), about US$6.3 billion was moved out of Binance’s hot wallets in roughly 20 minutes, across 10 blockchains. It is the largest theft in crypto history by amount. Binance suspended withdrawals for a little over two days (deposits stayed open), began reopening them in phases on 1 November, and said it would cover the full loss with company funds.

The short version:

• User balances: Binance says the stolen funds came from the company’s hot wallets and that it has set aside more than US$6.34 billion; by 4 November about 98% had been replaced, and user balances will not be reduced. The 4 November proof of reserves snapshot covers 44 coins, all at 100% or above (BTC 100.03%, ETH 100.02%, USDT 101.55%); its full zero-knowledge proof is still being generated, and the last 2% in smaller tokens is still being bought.
• Withdrawals: they began reopening in phases on 1 November, with BTC first at 14:20 Taipei time. That is about 56 hours after Binance’s first post about the pause, much faster than the 8-day median across the past 20 exchange hacks. Phase two began at noon on 3 November, with more batches at noon on 5 and 6 November; when I checked Binance’s network status at 22:00 on 6 November, withdrawals were open for 361 pairs on 15 networks, about 25% of the total. Other coins could not yet be withdrawn.
• Recovery: of the roughly US$3.4 billion in stolen stablecoins, about 78% has been frozen by the issuers; most of the assets with no issuer, such as BTC and ETH, are still in the attacker’s hands.
• The biggest risk right now is scams: fake “compensation”, “refund” and “verify your account” links are bound to appear during an event like this. Binance’s compensation requires no action from you.

Binance hack timeline (Taipei time)

The times below come from the on-chain analysis by TRM Labs, converted to Taipei time (UTC+8); Binance’s own actions follow Binance and media reports.

The timeline shows three things. First, this was not spur of the moment: the attacker prepared funds a day early and tested before striking, and the transfers on every chain were packed into half an hour. TRM Labs takes this to mean that Binance’s hot wallet signing system was compromised, not just a single wallet. Second, the issuers reacted fast: Tether froze nearly 1 billion USDT less than an hour after the first transfer. Third, withdrawals reopened “highest demand first”: Binance says phase one was ranked by users’ withdrawal demand over the past week, so BTC, ETH, USDT and USDC came first. If you hold smaller coins, you may wait longer than the headlines suggest.

What was stolen: about US$6.3 billion across 10 chains

Totals by source: Binance estimates about US$6.3 billion; TRM Labs puts it at about US$6.36 billion at prices at the time of the transfers; Chainalysis estimates about US$6.4 billion. TRM Labs’ breakdown:

Adding up the stablecoins: USDT (1.875 billion on Ethereum + 612.7 million on Tron), 823 million USDC and 88.5 million RLUSD come to about US$3.4 billion, more than half of the total stolen. That share determines how much could be frozen, as the next section shows.

How it happened: what we know and what we don’t

Binance has not yet published a full root cause. What has been said publicly so far:

• Starting point: Richard Teng initially said the investigation pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to the service container used to submit withdrawal requests, and the attacker then submitted unauthorized withdrawals (The Block).
• More than one point of intrusion: Teng later said more points of intrusion had been found and the whole operation was more complex than one employee’s access being misused; the attacker used a self-destruct mechanism to wipe traces (CoinDesk).
• Ethereum hot wallet: the attacker used EIP-7702 account delegation to take control of the hot wallet without going through Binance’s normal approval process (same source).
• Private keys: Binance says it has found no evidence that wallet private keys were leaked.

EIP-7702 is a feature added in Ethereum’s Pectra upgrade in May 2025 (Ethereum Foundation). It lets an ordinary wallet address sign an authorization and then run a contract’s code. It was meant to let wallets batch transactions and have someone else pay the fees, but an attacker who obtains one authorization signature can make the wallet run the attacker’s own code. This time the attacker had 50 authorizations ready in advance, which means the signatures were obtained before the theft. The problem lies in who can get the hot wallet to sign, not in the cryptography itself being broken.

Still unknown: how the attacker obtained those authorization signatures, where the other points of intrusion are, and how the bitcoin and Tron wallets were drained. Binance says it is examining its cloud systems, employee devices, private key management and transaction signing process.

Who did it: Chainalysis and TRM Labs both point to the North Korean hacking group TraderTraitor, the same group the FBI identified as behind the 2025 Bybit theft. Chainalysis’ strongest evidence is that the stolen funds were mixed on-chain with funds from the Bitget theft in September 2026. Binance itself has not named the attacker.

How much was frozen: about 80% of the stablecoins, almost no BTC or ETH

The frozen totals reported by different parties differ because they were taken at different times: Binance reported US$2.54 billion verified at 07:35 Taipei time on 10/30, TRM Labs counts about US$2.7 billion, Chainalysis about US$2.8 billion, and Binance later put it at about US$3 billion (CoinDesk). TRM Labs’ breakdown:

I ran the numbers using TRM Labs’ figures: of about US$3.4 billion in stolen stablecoins, the issuers froze about US$2.66 billion, about 78%. Most of the stablecoins that escaped the freeze had been swapped before it: TRM Labs recorded the attacker using UniswapX to swap about 325 million USDT into ETH at a price more than 10% above market, and depositing USDT into Aave and JustLend to borrow ETH.

On the other side, BTC, ETH, XRP and SOL have no issuer that can press a freeze button. Apart from the small portion on Arbitrum, most of the stolen 18,270 BTC and 200,000-plus ETH is still in the attacker’s hands (about US$2.4 billion by TRM Labs’ estimate). This is also a fundamental difference between USDT or USDC and bitcoin: a centrally issued stablecoin can be frozen by its issuer. This time that helped the victim, but the same mechanism can also be used against ordinary users.

How Binance will cover it: US$6.34 billion, no reduction in user balances

What Binance says (Binance X post, CoinDesk, The Block):

• It has set aside more than US$6.34 billion in company funds and reserves to cover the loss, of which about US$5 billion is the same assets that were stolen, which it already held. The remaining roughly US$1.3 billion is being bought back on the open market and over the counter; Binance cautions that less liquid coins may take longer.
• The roughly US$3 billion that has been frozen is not part of the US$6.34 billion and will be handled separately once recovered.
• The money comes from three places: part of SAFU, the user protection fund; part of the futures insurance fund; and Binance’s own corporate treasury. Binance has committed to topping SAFU back up to about US$1 billion (Binance announcement #3).
• Progress: about 80% replaced on 30 October, about 90% on 31 October, about 95% on 1 November and about 98% on 4 November. The remaining 2% is less liquid coins, which Binance is still buying on the market and over the counter and says will take longer (Binance announcement #4, #7).
• Proof of reserves: Binance took a new snapshot at 00:00 (UTC) on 31 October, covering BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The full zero-knowledge proof was completed on 2 November, so users holding these 10 coins can check that their own balances are included (Binance announcement #5). Another snapshot was taken at 00:00 (UTC) on 4 November, covering 44 coins; Binance says its full zero-knowledge proof takes about 50 to 60 hours, after which users holding any of the 44 coins can verify their balances (Binance announcement #7).

What to watch: Richard Teng says the attack hit Binance’s own hot wallets, not customer funds. But CoinDesk checked Binance’s reserve data and found that the compromised wallets had previously been listed among the assets backing user balances. Both can be true at once: an exchange’s hot wallets hold coins that users deposited. The real question is whether the money has been put back.

The new proofs of reserves answer most of the question. On Binance’s proof of reserves page, the ratios in the two snapshots since the hack are:

The 4 November snapshot covers 44 coins, and every one is at 100% or above; the lowest is DOGE at exactly 100.00%. That means the coins on hand at the snapshot were enough to cover every user’s balance in all 44, and the stolen BTC, ETH and USDT have been put back into the wallets. USDT is back up from exactly 100% on 31 October to 101.55%, but BTC and ETH are still only 0.02% to 0.03% over, a thinner buffer than before the hack (OKX’s BTC ratio at the same time was about 109%). Binance says the 2% not yet replaced is less liquid coins, and smaller tokens outside the 44 are not covered by this snapshot; the full zero-knowledge proof had not been announced as complete when I checked on 6 November. The ratios are also in our proof of reserves tracker.

Compared with the past 20 exchange hacks

In the centralized exchange incident timeline I compiled 20 exchange hacks since 2014: in 17, users were eventually made whole, and the median time for the main assets to resume withdrawals was 8 days. Here is how this one compares with the closest cases:

Three things stand out in this table:

1. The scale is unprecedented, but the response is not new: the amount stolen is about 4 times Bybit’s, and the response is the same as Bybit’s and Bitget’s: “the company covers it first, user balances stay untouched”. The past hacks with full compensation had one thing in common: the exchange had the money to cover the loss (see the analysis in the incident timeline). Binance says it already held US$5 billion of the same assets, so the key this time is whether, and how quickly, it can buy back the remaining US$1.3 billion. By 4 November, Binance said about 98% had been replaced, with the rest in less liquid smaller coins.
2. How long withdrawals stay paused: Bybit did not pause withdrawals, so users were free to move funds out, which amounted to an immediate market test. Binance chose to pause first, rebuild its systems and then reopen. Each approach has its reasons: Binance is still looking for points of intrusion, and opening withdrawals before it is sure the system is secure could lead to another theft.
3. The same group: the Bybit, Bitget and Binance hacks have all been attributed to North Korea, using similar methods (funds prepared in advance, signatures obtained beforehand, everything moved out in one go). This suggests it is not that any one exchange is especially weak; the hot wallet signing processes of large exchanges are being attacked again and again by the same group.

What this means for Jason Finance’s Binance rating

Under our rating methodology, an incident of the type “hacked, fully compensated but with withdrawals paused” costs points: more than “hacked without a pause”, fewer than “hacked without compensation”. I have already added this incident to Binance’s incident record as “fully compensated, withdrawals paused”, and the score in the Binance review will be updated to match. The 4 November proof of reserves covers 44 coins, all at 100% or above, and about 98% has been replaced, so the incident stays recorded as “fully compensated” for now. Binance is still buying the last 2% in smaller tokens; if a later snapshot shows any coin below 100%, or the compensation is not delivered, I will recalculate using the “no compensation” deduction.

What users can do now

This section is a summary of information, not a call to take any particular action:

• Do not click any “compensation”, “refund” or “account verification” link: after a major event there are always text messages, emails, Telegram accounts and websites impersonating Binance. According to Binance, the compensation is made at the company level, and users do not need to fill in a form or connect a wallet. Binance itself will not ask you for your seed phrase or 2FA codes, or to control your computer remotely. For common tactics, see crypto scam playbooks.
• Check your security settings: user accounts were not hacked this time, but now is a good moment to confirm that passkeys or 2FA, the withdrawal whitelist and the anti-phishing code are all turned on; see exchange account security settings compared.
• Export your transaction history: keep your own copy of your records during the event; you will need it later for reconciliation or taxes. See how to export your crypto transaction history.
• Withdrawals: they have been reopening in phases since 1 November, and Binance warns of possible delays at first; if a withdrawal fails, try again a little later. Before moving funds out, check Binance’s network status page or the withdrawal page to confirm that your coin and network have reopened, and send a small test amount first. If your coins are stuck in processing, see what to do when a withdrawal is stuck.
• Check the next proof of reserves: after logging in to Binance, you can use the Merkle tree to check whether your account is included in the new report; for the steps, see how to check proof of reserves.

Before you open an exchange account

If you decide to open an exchange account, these are the two exchanges currently ranked highest by CoinGecko Trust Score, with their official fee rebate and a sign-up screenshot.

Any crypto you keep on an exchange carries that exchange's own risk, so weigh it yourself; only coins in a cold wallet you control leave the risk in your own hands.

Update log

• 6 November 2026: the 4 November proof of reserves snapshot covers 44 coins, all at 100% or above (BTC 100.03%, ETH 100.02%, USDT 101.55%), with its full zero-knowledge proof still being generated; about 98% replaced; two more withdrawal batches on 5 and 6 November, with about 25% of coin and network pairs open on 6 November.
• 4 November 2026: the zero-knowledge proof for the 31 October snapshot was completed on 2 November: BTC 100.04%, ETH 100%, USDT 100%; phase two of withdrawals on 3 November, with about 16% of coin and network pairs open on 4 November; the remaining 5% in smaller tokens is still being replaced.
• 1 November 2026: withdrawals reopening in phases since 1 November (15 networks including BTC; other coins still pending); about 95% replaced; added the 31 October proof of reserves snapshot, with the full proof expected on 3 November (UTC); the FBI attributed the hack to North Korea.
• 31 October 2026: first version. Withdrawals have not yet resumed; the proof of reserves has not yet been published.

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance (on-chain figures as of 2026-10-30 00:30 UTC)
• Chainalysis: Binance exploit latest findings (2026-10-30)
• CoinDesk: Binance arranges $6.34 billion to cover losses, Binance uncovers wider breach (2026-10-30)
• The Block: Binance says it has $6.34 billion ready (2026-10-30)
• Binance’s official X post
• Binance announcements: Recovery Update #3 (2026-10-31), Recovery Update #4 (2026-11-01), Recovery Update #5 (2026-11-02), Recovery Update #6 (2026-11-03), Recovery Update #7 (2026-11-04), Recovery Update #8 (2026-11-05), Recovery Update #9 (2026-11-06)
• Binance proof of reserves page (2026-10-31 snapshot, viewed 2026-11-04)
• FBI: North Korea Responsible for $6 Billion+ Binance Attack (2026-10-31)
• CoinDesk: Binance opens crypto withdrawals in phases (2026-11-01)
• Bloomberg (republished by Insurance Journal): Binance Restarts Withdrawals as Questions Linger on Record Hack (2026-11-01)
• Binance network status (checked at 22:00 Taipei time on 2026-11-01 and 10:00 on 2026-11-04)