Binance $6.3B Hack: What Happened and How to Protect Your Funds

What is known about the Binance hack

Checked on October 30, 2026, at 22:12 (UTC+8). The situation is developing; amounts and restrictions may change.

• Scale. TRM Labs estimates that $6.36 billion was stolen across ten blockchains and describes it as the largest cryptocurrency theft on record at the time of publication. TRM Labs investigation.
• Withdrawals. In the Binance update reviewed for this article, withdrawals remained paused while deposits were operating. The exchange gave an estimated restoration window of 48 hours from its announcement. This is a target, not confirmation that withdrawals have reopened. Binance updates.
• Compensation. Binance said it would cover losses using SAFU and company funds. It later stated that it had reserved more than $6.34 billion for that purpose. Initial statement, clarification from a Binance spokesperson to Cointelegraph.
• Cause. The investigation continues. The initial explanation involving a compromised employee laptop has been supplemented by findings of other entry points. Investigation updates.

Binance initially said a DevOps engineer's laptop may have been compromised, allowing an attacker to access a service container and submit unauthorized withdrawal transactions. The exchange also said it had found no evidence of wallet private keys being leaked. It has promised a full technical post-mortem. Security Incident Update.

TRM Labs describes an attack on the transaction-signing infrastructure of hot wallets: wallets connected to the internet to handle day-to-day transactions. Researchers identified EIP-7702 delegation on Ethereum and ordinary signed transfers on other networks. This is the researchers' assessment of the attack mechanism, not Binance's final conclusion. TRM Labs technical analysis.

TRM attributes the theft to North Korea's TraderTraitor group with high confidence. That attribution should remain explicit: it is the researchers' conclusion. An incident affecting exchange wallets does not, by itself, establish that every customer's personal account was compromised. TRM Labs assessment.

Frozen assets and compensation are different

Freezing assets restricts their movement; it does not, by itself, credit money back to users. Binance reports around $3 billion frozen, while TRM's analysis gives a figure of about $2.7 billion. These figures reflect different snapshots of the investigation and must not be added together. Binance figures, TRM Labs figures.

The type of asset also matters. Centralized issuers can freeze certain stablecoins, whereas native BTC and ETH have no issuer with that capability. This makes it harder to stop transfers, but it does not make tracing or subsequent seizure inherently impossible. Analysis of the fund movements.

A separate episode involved Aave. According to LlamaRisk's post on the protocol's forum, the attacker supplied 60 million USDT and borrowed 19,762 WETH. At the time of the analysis, the collateral exceeded the debt and the authors did not see a risk to liquidity suppliers. It would therefore be inaccurate to claim that the attacker automatically transferred the loss to Aave depositors. LlamaRisk assessment dated October 30.

In a later update, Binance said it had reserved more than $6.34 billion of company funds. Around $5 billion was already held in the required tokens, according to the company, and it was purchasing the remainder. The roughly $3 billion frozen was not included in that reserve. A Binance spokesperson confirmed these details to Cointelegraph but did not disclose the wallet addresses for verification. Details of Binance's statement.

That is more specific than the initial pledge, but a statement that funds have been reserved does not establish that compensation is complete. Practical signs of recovery include available withdrawals, accurate balances and published information on the assets backing liabilities.

Binance promised an updated Proof of Reserves after remediation. Such a report can be useful, but it is not equivalent to a full financial-statement audit and does not, by itself, guarantee solvency. The PCAOB's Office of the Investor Advocate explains the limitations of these reports.

First steps if you hold funds on Binance

1. Check restrictions inside the app. Open it yourself or type the website address manually. Check the relevant asset and network. If only your account is restricted, ask support for the reason and check the guide to Binance account restrictions: news of the hack does not establish the cause of an individual restriction. FBI guidance on fake exchange support.
2. Review account and email security. Use unique passwords and two-factor protection, preferably a passkey or authenticator app. Check devices and API keys; revoke access you no longer need. Binance account security advice, session and API access checks.
3. Understand what a password change does. Binance warns that withdrawals, P2P selling and payment services are disabled for 24 hours after a password change. If your password has been exposed or you see unauthorized logins, do not delay securing access. If there are no signs of compromise, news of an exchange hack alone does not mean your password has leaked. Password change rules.
4. Preserve records. Save balances, withdrawal requests, amounts, networks, addresses, transaction hashes and support reference numbers. Specific transactions and timestamps are more useful for a report than an error screenshot alone. Information needed for an investigation.
5. Take care when withdrawals reopen. If you decide to move assets to your own wallet, check the address, network and any required memo/tag, then send a small test amount. Self-custody requires a secure seed-phrase backup: losing access or exposing that phrase creates a separate risk.

Unauthorized access, missing funds and follow-up scams

If you see unknown transactions, a changed email address or disabled 2FA, Binance recommends immediately disabling your account through its official website or app and contacting support. From a trusted device, secure the linked email account and revoke unauthorized access. Binance's recommended response.

If money has already been sent to scammers, preserve messages and transfer details, notify the exchange and report the incident to law enforcement. Accurate addresses, the network and the transaction hash make a report more useful to investigators. Recovery cannot be guaranteed. Guidance on preserving evidence.

Warning signs include an unsolicited message from someone claiming to be support, an urgent verification link, a request for a password, 2FA code or seed phrase, or instructions to move assets to a 'safe wallet'. Verify such requests through the app you opened yourself. Never enter a seed phrase in a support chat or compensation form. FBI warning about exchange impersonation.

Do not pay to 'activate a refund', cover a supposed 'unlock tax' or secure a guaranteed return of stolen funds. An advance fee alone does not prove fraud, but a promise of a certain outcome combined with pressure to send cryptocurrency immediately is a serious warning sign. FBI warning about fraudulent recovery services.

Frequently asked questions

When will Binance reopen withdrawals? In the updates reviewed, the exchange gave a window of up to 48 hours from the announcement. Do not start that countdown from when you read this article: check the latest status of the relevant network in the app.

Will changing my password protect me from an exchange infrastructure hack? It helps when your own access is compromised. The platform itself must fix vulnerabilities in its infrastructure. These are different layers of security.

Do I need to pay to receive compensation after the Binance hack? The Binance statement reviewed for this article does not require a transfer to obtain compensation. Verify any such request through official support.

Need help with an account restriction or a suspicious transaction? Prepare the exchange notice, transaction history and support reference numbers before asking DefCrypt to review your exchange account restriction. Passwords, 2FA codes and seed phrases are not needed.

Prepared by DefCrypt using partner KarCrypto's article, with additional checks against primary sources.