Binance disclosed a security incident beginning October 29, 2026, in which reports put losses at about $6.3 billion, with TRM Labs attributing the theft to North Korea's TraderTraitor group. Binance paused withdrawals and deposits, then began restoring withdrawals in phases on November 1, when customers reportedly pulled out a net $3.64 billion over about nine and a half hours. Binance says user funds are safe and has pledged to cover losses, though figures and details still vary across reports.
Blockchain analysts first flagged unusually large transfers out of Binance hot wallets on October 29, 2026. Binance said it was investigating a potential security issue and had not confirmed any impact on user funds at that point. Reuters later described the episode as a $6.3 billion heist.
According to TRM Labs, the attacker moved funds out of Binance wallets on 10 blockchains, with most of the activity taking place within about 20 minutes. Binance's preliminary findings reportedly point to a compromised DevOps engineer's laptop that was used to authorize withdrawals, and reports say there is no evidence of a private-key leak. TRM Labs attributes the theft to North Korea's TraderTraitor group with high confidence.
Regulatory pressure adds to the story. A Binance post citing Reuters said US prosecutors were examining possible sanctions violations in September 2026, and that the US Justice Department is testing whether Binance complied with its November 2023 settlement. Binance has not tied these reports to the hack.
The dates below are drawn from reports and Binance statements. Times are UTC.
Reports describe the stolen assets as moved into new wallets, but the destinations and totals differ by source. CoinDesk reported that the attacker drained 18,270 BTC, worth about $1.4 billion at early-Friday prices, and split it across 19 wallets. Seventeen reportedly hold exactly 1,000 BTC each, one holds 832.5 BTC and one holds 437.7 BTC. As of early Friday, those coins reportedly had not moved again.
Stablecoin issuers froze some funds. Reports put the combined freeze at about $1.79 billion across Tether and Circle, while another report cites $823 million in USDC frozen by Circle and roughly $1.18 billion in USDT frozen by Tether. Those two figures add up to more than $1.79 billion, so the numbers should be treated as unreconciled.
Total loss estimates depend on methodology. TRM Labs reportedly estimated about $6.36 billion, Chainalysis was cited at about $5.9 billion at the time of the theft, and on-chain tallies from various analytics firms range from about $3.3 billion to $5.8 billion depending on which chains and tokens were counted. Binance has not confirmed a single total in the material available.
Customer withdrawals were the most immediate effect. Once service resumed, many users moved funds off the platform quickly. The $3.64 billion net outflow equals about 2.1% of Binance's reported assets, according to Reuters, and reports said outflows were slowing by November 2.
One report links the episode to a $1.57 billion wave of crypto-futures liquidations. Reports also describe broader volatility across the market, though the research does not give a complete breakdown of how much of that move was caused by the incident.
Binance has said it set aside more than $6.34 billion in company funds to cover stolen assets and is buying tokens to restore reserves, according to BBC coverage. Those reserve figures come from reporting rather than a full independent audit.
Binance has said user funds are safe and that it will reimburse customers in full, according to Reuters and Bloomberg Law. Users should rely on Binance's official notices for service status, since withdrawal rules changed several times during the incident.
If you have funds on Binance, it makes sense to review how much you hold there compared with self-custody or other venues. Verify every withdrawal address and token network before sending, because congestion and bulk transfers can cause delays. Be cautious with stablecoins and bridged assets, since issuer freezes have already happened on some addresses. If you see unauthorized activity on your account, change passwords, rotate API keys, check two-factor authentication, contact support, and record transaction hashes and timestamps.
This article is news coverage, not investment advice.
Several key questions remain open based on the available reporting.
Everything in this article is tracked live and free on VaultX.
Open the live viewGet alerts on TelegramBinance has said user funds are safe and that it will cover losses in full, according to Reuters and Bloomberg Law. Those statements have not been independently verified in the material available, so check Binance's official notices for the latest status.
Binance restored service in stages starting November 1, 2026, beginning at 06:00 UTC, and said withdrawals were back across all 15 networks and assets in the initial phase by 12:36 UTC. Reports do not give a full explanation of how each phase was chosen.
TRM Labs attributes the theft to North Korea's TraderTraitor group with high confidence. One report also says the FBI has tied the theft to North Korea. Neither attribution has been confirmed by Binance in the material available.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Written by an AI agent from public data and reviewed by automated checks. Breaking story: figures can change as it develops. Educational only, not investment advice.
VaultX