On Thursday 29 October 2026, hackers broke into Binance wallets in what multiple reports call the largest cryptocurrency heist in history. This article explains what happened, how much was reported stolen and frozen, and what it means for ordinary users.
What happened on 29 October
Hackers transferred funds from Binance wallets over about 20 minutes on Thursday evening, targeting Bitcoin, Ethereum, Solana and other cryptocurrencies. Binance’s initial investigation suggested the incident may have involved a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance said it found no evidence of any wallet private key leak.
How much was stolen and frozen
Binance estimated the total impact at around $6.3 billion in stolen assets, according to CoinDesk. About $3 billion was frozen, including $2.3 billion in USDT and USDC stablecoins, after Tether and Circle blocked transfers from affected addresses. Tether’s CEO said more than $1.567 billion in USDT was frozen, and Circle said it froze more than $800 million. CoinDesk’s review of Binance’s 1 October proof of reserves found that about 204,500 ETH was taken, which would leave Binance’s ETH backing near 94 percent, down from 100 percent. Treat these amounts as reported estimates, not final audited totals, because the investigation was still ongoing.
Are user funds safe?
Binance co-CEO Yi He said user funds are safe and that Binance would cover all hacking losses. Founder Changpeng Zhao, who no longer manages Binance but remains its largest shareholder, said on X that he expects all user funds to be fully covered. Binance also said it would cover losses from company funds and its SAFU emergency fund, which holds around $1 billion in bitcoin. Binance temporarily suspended deposits and withdrawals for security checks and said it expected withdrawal services to resume by Sunday morning. Users should check only official Binance channels for the latest status, because that timing may have changed.
Who was behind it?
Blockchain tracing firms, including TRM Labs, attributed the heist to an elite North Korean hacking unit based on on-chain and off-chain intelligence, and other tracing firms said North Korea was likely behind it. Binance said the investigation had not attributed responsibility to any individual. The FBI said it was aware of the incident and engaged with partners, and the Secret Service said investigators were working with private-sector partners to identify, freeze, trace and recover funds. Attribution at this stage is based on tracing firms’ analysis, not a court finding.
What users should do now
Do not panic-sell based on social media rumours, do not click links from fake Binance support messages, enable two-factor authentication, never share seed phrases or passwords, verify you are on the official Binance domain, and keep records of deposits, withdrawals and balances. If you cannot withdraw, wait for Binance’s official update rather than using unofficial recovery services.
This was a hack of Binance’s wallets, not a proven case of Binance itself stealing user money. The full post-mortem was still pending at the time of reporting. This article is for general information only and is not financial or legal advice.
More detail: reading the figures and statements carefully
The headline total alone does not answer most readers questions. A stolen total, a frozen total and a promise to cover losses are three different things, and this section keeps them separate. Where a figure is an estimate, or an explanation is only an initial finding, this article says so, because early reports can be revised as investigators check more evidence.
The attack, in more detail
Two features help explain the attention. First, transfers are reported to have taken place over about 20 minutes, a short window for moving assets across Bitcoin, Ethereum, Solana and other cryptocurrencies. Second, the reports describe an attack on Binance’s operational, internet-connected wallets, used to process withdrawals, rather than a single user’s personal wallet. Binance’s initial account points to a compromised DevOps engineer’s laptop giving an attacker access to a service container, from which unauthorised withdrawals were submitted. That is an early working account, not a completed post-mortem, and it sits alongside Binance’s statement that it found no evidence of a wallet private key leak.
Frozen money is not the same as recovered money
The gap between about $6.3 billion in reported impact and about $3 billion frozen also needs plain explanation. A frozen asset has been blocked from moving onward, usually by a stablecoin issuer or another intermediary, but frozen does not automatically mean returned or available for withdrawal. It means that portion could not simply be moved on, giving investigators more time. About $3 billion frozen is roughly half the reported total. The $2.3 billion in USDT and USDC sits inside that wider total, and the separate issuer figures, more than $1.567 billion in USDT and more than $800 million in USDC, add to a similar total once rounding and announcement timing are taken into account.
The Ethereum calculation needs similar care. CoinDesk’s review compared about 204,500 ETH taken with Binance’s 1 October proof of reserves, a snapshot taken before the hack. On that basis it estimated ETH backing would fall from 100 percent to near 94 percent. That shows the scale of the reported ETH loss, but it is not a final audited statement of every asset Binance holds, and cryptocurrency prices can move a dollar value even when coin numbers do not change. Readers should therefore treat $6.3 billion and $3 billion as reported estimates in an ongoing investigation, not settled final totals.
What Binance’s promise does and does not prove
Binance’s reassurances should also be read carefully. Yi He said user funds are safe and Binance would cover all hacking losses, and Changpeng Zhao said he expects user funds to be fully covered. Binance also said losses would be covered from company funds and its SAFU emergency fund, which holds around $1 billion in bitcoin. Those statements put the loss on Binance rather than users, but they are statements of intent at the time, not a completed repayment. Around $1 billion is also much smaller than about $6.3 billion, so the promise, as reported, depends on company funds as well as SAFU, not SAFU alone.
Deposits and withdrawals were temporarily suspended for security checks. A suspension is a protective step that stops further unauthorised movement while systems are examined, even though it is frustrating for users who need access. As reported on 30 October 2026, Binance expected withdrawal services to resume by Sunday morning. That timing is reported here only as the expectation stated on 30 October 2026, not as a current status, so readers should check official Binance channels for the latest position.
Why attribution language differs
Tracing is a separate exercise from running an exchange, which helps explain the different language used. Tracing firms follow movements on public blockchains, combine them with other intelligence, and look for patterns they have seen before. TRM Labs and other firms used that analysis to attribute the heist to an elite North Korean hacking unit, or to say North Korea was likely behind it. Binance, by contrast, said its investigation had not attributed responsibility to any individual. The FBI said it was aware and engaged with partners, and the Secret Service said investigators were working with private-sector partners to identify, freeze, trace and recover funds. None of that is a court finding.
What remains unclear
Several questions were still open at the time of reporting: the full post-mortem, final audited totals, how frozen funds will be handled, and whether attribution will be confirmed by investigators or in court. Until those answers arrive, readers should distinguish between what Binance has said, what tracing firms have said, and what has been independently proved. That distinction is the safest way to follow a fast-moving story without repeating rumour as fact.
A longer checklist for users
A practical checklist can help readers avoid scams that often follow a major hack. First, use only the official Binance app or website and check the domain carefully, because lookalike domains are a common trick. Second, make sure two-factor authentication is enabled and review security settings and recent activity where available. Third, never share a seed phrase, password or one-time code, including with someone claiming to be Binance support. Fourth, treat unsolicited messages with extra care: urgency, a promised refund, a fee to release funds, or directions to an unfamiliar wallet address should be treated as suspect. Fifth, keep your own records, with dates, of balances, deposits, withdrawals and official notices. This is general security information, not personal financial advice.
In short, the reported facts are stark: a hack on 29 October 2026, about $6.3 billion in reported impact, about $3 billion frozen, and a promise from Binance that user funds will be covered. What is not yet settled is the full post-mortem, the final totals, and any court-tested attribution. Readers should follow official Binance updates, keep their own records, and be especially careful about phishing messages while the investigation continues. This article is for general information only and is not financial or legal advice.