Binance Hack 2026: What Happened, $6.3B Impact & Withdrawal Status

The October 2026 Binance hack involved an estimated $6.3 billion in cryptocurrency transfers. Here is the latest Binance withdrawal status, whether deposits are working, how much was frozen, what investigators say about the attack and what customers should know.

By R.K., Creator and Business Economics Analyst · Updated October 30, 2026 · Status checked at 16:50 UTC.

Quick answer: Binance says deposits are operating normally, but crypto withdrawals remain paused while the exchange strengthens its withdrawal system. Binance says it will cover losses using its SAFU fund and company funds, and that it has found no evidence of a wallet private-key leak. Those are the exchange’s statements; its full technical post-mortem and updated proof-of-reserves information are still pending.

These figures describe different things: estimated assets moved, assets frozen by partners and company reserves. They must not be added together or treated as the same pool of recovered money.

Binance withdrawal status: are withdrawals working now?

As of the October 30, 2026 service updates reviewed for this article, Binance crypto withdrawals remain paused. The exchange says it is completing a security revamp of the withdrawal service and the addresses connected to it. The aim is to complete the checks before restoring withdrawals, rather than reopen the service before the security work is finished.

Binance deposits are operating normally, according to the exchange. This is a change from its first precautionary notice, which said deposits and withdrawals had both been suspended. Binance later clarified that deposits were unaffected and continued to operate normally. This distinction matters when searching for “Binance deposits working” or “Binance withdrawals paused”.

When will Binance withdrawals resume?

Binance first said it expected to resume withdrawals within 48 hours. A later October 30 update was reported as putting the exchange on track for roughly 45 hours. If measured from the later update, that points to early November 1 UTC. Binance has not supplied a guaranteed reopening time in the service notice, and the estimate could change if security checks take longer.

Binance has not confirmed in the notices reviewed here whether all assets and blockchain networks will reopen at the same time or in stages. A service returning for one coin or network would not necessarily prove that every withdrawal route is available.

Using Binance.US in the United States?

This article follows the service notices for Binance’s global platform. Binance.US is a separate U.S. exchange with its own service-status page. Do not assume that the global Binance withdrawal pause or its estimated restart window automatically describes Binance.US. U.S. customers using Binance.US should check its official Binance.US status page for current service and individual-asset notices.

What happened in the Binance hack of October 2026?

On October 29, attackers caused cryptocurrency worth an estimated $6.3 billion to move out of Binance wallets. Blockchain intelligence firm TRM Labs told the Associated Press that approximately $6.36 billion moved across ten blockchains, with most of the transfers happening in roughly 20 minutes. The scale would make it potentially the largest cryptocurrency theft on record.

Binance’s initial investigation suggested that a DevOps engineer’s compromised laptop may have provided a way into a service container. The attacker was then able to submit unauthorised withdrawal transactions. Binance later said investigators had found additional points of breach, so the compromised laptop is not yet a complete or final explanation of how the attack happened.

Binance has said it found no evidence that wallet private keys were leaked. That is an important detail, but it does not mean the incident was harmless: attackers may be able to misuse the systems that authorise transactions even without obtaining the underlying wallet keys. The full technical explanation is still pending.

Why the DevOps detail matters

DevOps systems help teams build, deploy and operate software. A service container is an isolated environment in which an application or part of a service runs. In this incident, Binance’s preliminary explanation points to access through an internal service environment and the ability to submit unauthorised withdrawal requests. It is different from a simple claim that every customer password or wallet private key was stolen.

Reuters and independent blockchain analysis describe the affected funds as leaving Binance hot wallets. A hot wallet is a cryptocurrency wallet connected to online systems so an exchange can process transactions. Hot wallets are operationally useful, but their access controls and transaction-authorisation systems must be protected carefully.

Binance hack timeline: October 29–30, 2026

How much was stolen in the Binance $6.3 billion hack?

Binance’s public estimate puts the incident’s total impact at approximately $6.3 billion. TRM Labs’ estimate, cited by AP, was approximately $6.36 billion moved from Binance wallets. These are dollar valuations of cryptocurrency assets, not a claim that $6.3 billion in banknotes or customer cash disappeared.

There are three separate numbers readers should keep apart:

Independent on-chain reports can show a somewhat different frozen total because they may count only transfers they can verify on-chain and use a different snapshot time. Bitquery’s October 30 analysis, for example, reported a $2.7 billion frozen figure in its own reconstruction, while Binance reported around $3 billion. That difference should be presented as a measurement and timing difference, not proof that one side has recovered the missing amount.

There is another distinction: frozen does not necessarily mean recovered. A token issuer may be able to block movement of certain stablecoins, or a network authority may restrict certain assets. Returning those assets to the exchange or restoring customer balances is a separate process. Binance says it is working with partners to trace and recover the funds and has said it will cover all losses.

Was the Binance hack carried out by North Korea’s TraderTraitor group?

Blockchain intelligence firms have linked the attack to North Korea’s TraderTraitor hacking unit. AP reported that TRM Labs attributed the attack to the group with high confidence, while Chainalysis also said it was likely a DPRK-linked operation. The firms point to similarities with earlier North Korea-linked cryptocurrency thefts.

This attribution is not the same as a public law-enforcement confirmation. Binance has said it is working with law-enforcement partners to identify those responsible. Its public statements reviewed for this article have not named a confirmed attacker. The most accurate wording is that blockchain-intelligence firms assess a North Korean-linked group was likely responsible.

Are Binance funds safe after the hack?

Binance has stated that user funds are safe and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds. Reuters also reported that the exchange had set aside more than $6.34 billion in company funds to address the incident. Binance has promised updated Proof of Reserves information after remediation is complete.

Those statements are relevant, but readers should understand what has and has not been independently demonstrated. The exchange’s public assurance is not the same as a completed independent audit of every customer balance after the incident. The updated Proof of Reserves and the technical post-mortem are important follow-up evidence to watch for.

The incident also does not establish that every Binance customer account was individually accessed. The reported attack involved systems used to authorise withdrawals from exchange wallets. Binance says it found no evidence that wallet private keys were leaked, and its investigation remains ongoing.

What are Binance SAFU funds, and what does the $6.34 billion reserve mean?

SAFU stands for Secure Asset Fund for Users. It is Binance’s user-protection reserve. Binance said it would use SAFU together with company funds to cover losses arising from the incident. The commitment is therefore not described as coming from SAFU alone.

On October 30, Reuters reported that Binance had set aside more than $6.34 billion in company funds. The report said $5 billion was already held in the exact token assets affected by the attack. CoinDesk reported that Binance intended to complete the remaining token coverage through market and over-the-counter purchases and that the reserve figures excluded assets frozen or protected by partners.

This is why the $6.34 billion reserve must not be added to the $6.3 billion incident estimate. One is a reported estimate of the affected crypto; the other is the company’s stated provision to address the fallout. Binance has said it will publish updated Proof of Reserves after remediation. Readers should look for that publication rather than assume a reserve announcement is itself the final verification.

What should Binance users do while withdrawals are paused?

1. Check the official service notice. Use the Binance Security Incident Update and official support channels. Do not rely on screenshots or copied messages alone.
2. Check the exact asset and network. Withdrawal availability can differ by coin, network, region and product. Do not assume that one restored route means every asset is available.
3. Keep your login and recovery details private. Binance support should not need your password, authenticator code, private key or seed phrase in a direct message.
4. Ignore anyone promising to speed up a withdrawal. A third party cannot legitimately unlock a paused exchange-wide withdrawal system by asking you to transfer crypto or pay a release fee.
5. Wait for a confirmed reopening notice. Binance’s 45–48-hour estimate is not proof that withdrawals have resumed. Check the platform again for the specific asset and network you use.

This is general security information, not investment, trading or personal financial advice. The status described here relates to the Binance service notices cited below. Users of Binance.US or other separately operated regional products should check the official notice for their own service instead of assuming the global Binance status applies identically.

Binance hack 2026: frequently asked questions

Editorial note: Ultimate Info Guide will update this page when Binance publishes a material service-status change, technical post-mortem or updated Proof of Reserves. A previous status snapshot should not be treated as current after a newer official notice appears.