Binance Hack, October 2026: What Happened, What's Frozen and Is Your Money Safe?

Key takeaways

• Binance estimates the hack's total impact at about $6.3 billion; Chainalysis put the theft at about $5.9 billion. That would make it the largest crypto theft on record (CoinDesk).
• Binance's first findings point to a compromised DevOps engineer's laptop, and it says it found no evidence of a private key leak (Bitcoin.com News).
• About $3 billion has been frozen on-chain, including more than 1.57 billion USDT by Tether and more than 800 million USDC by Circle.
• Deposits and withdrawals are paused. Binance says user funds are safe and it will cover all losses, but it has given no restart time (as of 09:30 PKT, 30 Oct).
• Expect a wave of "fund recovery" scams. Nobody can recover crypto for you through a DM.

Binance, the world's biggest crypto exchange, said on Thursday that it had "fallen victim to a major hack" (AFP via Yahoo Finance). Here is what is confirmed so far, what isn't, and what it means if you trade.

What happened, in Pakistan time

Times are converted from the ET and GMT times in Bitcoin.com News, AFP via Yahoo Finance and Bitcoin.com News (the first-findings time is that article's publish time). The on-chain times are what trackers reported; Binance has not confirmed them.

How did the attacker get in?

Binance says the incident "may involve a compromised DevOps engineer's laptop". The attacker reportedly used it to reach a service container and send withdrawal transactions that were never authorised. Binance said: "We have found no evidence of any wallet private key leak." It has revoked the affected address authorisation, and it promises a full post-mortem once the facts are verified (Bitcoin.com News).

Blockaid reported that one of 50 authorisations on the wallet matched, and the assets were swept about three minutes later (Bitcoin.com News). Investigators have not yet said exactly how the signing system was abused.

How much was taken?

The numbers differ because they were measured at different times and some on-chain tallies may include unrelated transfers.

CZ's lower figure likely nets out what has been frozen, but he hasn't said so; Binance's own estimate is the $6.3 billion total.

What has been frozen?

Binance puts the total frozen at about $3 billion, including $2.3 billion in USDT and USDC (CoinDesk). Frozen means the tokens can't be moved; it is not yet money returned to Binance. Aave also froze its Ethereum V3 markets for a while as a precaution, after the attacker borrowed at least 20,000 WETH there against stolen USDT (Bitcoin.com News, CoinDesk).

Is my money on Binance safe?

What Binance has said:

• "User funds are safe" and Binance "will cover all hacking losses" (Yi He, co-CEO).
• Losses will be covered from the SAFU fund (about $1 billion in bitcoin) and company funds (CoinDesk).
• Withdrawals will restart "as soon as the security scan is complete". No time has been given.
• An updated proof-of-reserves report will follow once the fix is done (Bitcoin.com News).

Those are Binance's promises, not an independent audit. Until withdrawals reopen, nobody can move coins off the exchange, so there is nothing to rush. Watch Binance's official announcements page and its verified X accounts for the restart, and wait for the proof-of-reserves update.

Who is behind it?

There is no official attribution. TRM Labs linked the attack with "high confidence" to TraderTraitor, a North Korean group. Blockaid's CEO said the tactics match North Korean operations, and investigator ZachXBT named the Lazarus Group (CoinDesk). Binance has not confirmed any of this.

How markets reacted

• Bitcoin fell 4.8% to below $77,000; ether fell 5.7%, BNB 8% and AAVE 11% (CoinDesk).
• About $1.4 billion of leveraged positions were liquidated in 24 hours, mostly longs, per Coinglass; not all of that was caused by the hack (Bitcoin.com News).
• Bitcoin was back at $78,103 at 09:20 PKT on Friday (Coinbase spot).

Gold has not acted as a crypto safe haven so far. It is at 3,991 this morning, below Thursday's 4,021 close, and Thursday's strong US GDP is the bigger driver there. Levels and news times are in today's gold brief.

Stay safe from the scams that follow

Big hacks are always followed by scammers. Use these rules:

1. No one can "recover" your crypto. Anyone who DMs you offering to get your Binance funds back for a fee is a scammer.
2. Binance support never asks for your password, 2FA code or seed phrase. Never share them.
3. Use the official app or type binance.com yourself. Don't click links in SMS, WhatsApp, Telegram or email about the hack.
4. Don't send coins to a "verification" or "safe" address. That is the most common trick after an exchange hack.
5. Turn on an authenticator app and an anti-phishing code in your account settings if you haven't already.

The bottom line

This is a large and still-developing story. The confirmed facts are a theft Binance puts at about $6.3 billion, about $3 billion frozen, paused withdrawals and Binance's promise to cover every loss. The cause and the attacker are not yet confirmed. We will update this page when Binance reopens withdrawals or publishes its post-mortem.

Disclaimer

This post is for education and news only and is not financial advice. Crypto, gold and forex trading carry high risk, and exchange hacks can freeze your funds without warning. Figures are as reported by the sources linked above at 09:30 PKT on 30 Oct 2026 and may change.