Binance Hack Update: Exchange Confirms $6.3 Billion Theft and Promises Full Compensation
Binance has confirmed a massive security breach resulting in approximately $6.3 billion worth of cryptocurrency being stolen from its hot wallets. The incident, which occurred on October 29, 2026, has triggered an international investigation and raised fresh concerns about the security of centralized cryptocurrency exchanges. Binance says it will absorb the entire financial impact of the attack rather than pass the losses to customers.
The exchange disclosed the incident in an October 30 security announcement, explaining that unauthorized withdrawals affected its internet-connected wallet infrastructure. Blockchain intelligence firm TRM Labs estimated that approximately $6.36 billion was moved across 10 blockchains, with most of the transactions completed within roughly 20 minutes. The scale of the theft makes it one of the largest cryptocurrency security incidents ever reported.
Binance Sets Aside $6.34 Billion to Cover Hack Losses
Binance has committed more than $6.34 billion in company funds to cover the stolen assets. According to its latest update on October 31, approximately $5 billion in the corresponding cryptocurrencies, including Bitcoin, Ethereum, BNB, USDT and USDC, is already available. This represents roughly 80% of the affected amount, while the exchange is purchasing the remaining assets through market and over-the-counter transactions.
The company also confirmed that approximately $3 billion worth of affected assets had been frozen on-chain through cooperation with law enforcement agencies, blockchain intelligence firms, cryptocurrency exchanges and token issuers. However, frozen funds should not be confused with fully recovered assets, as the process of securing and returning them remains ongoing.
Binance says its Secure Asset Fund for Users (SAFU) and corporate treasury will cover the financial impact. Co-CEOs Yi He and Richard Teng reiterated that customers will not be required to absorb losses resulting from the incident. The commitment is intended to protect customer balances while the exchange works through its recovery efforts.
The investigation has uncovered a more complicated security failure than initially suspected. Binance’s first assessment pointed to a potentially compromised laptop belonging to a DevOps engineer, which may have provided attackers with access to infrastructure used to submit unauthorized withdrawal transactions. Subsequent investigations identified additional points of intrusion, although the exchange has not yet published a complete technical explanation.
Binance has also stated that investigators have found no evidence that wallet private keys were leaked. The company is examining the affected infrastructure, employee devices, authorization systems and transaction controls to establish how the attackers bypassed existing safeguards.
North Korean Hacking Group Suspected as Binance Reviews Security
Blockchain intelligence firms TRM Labs and Chainalysis have linked the attack with high confidence to TraderTraitor, a hacking group associated with North Korea. Investigators have pointed to similarities with previous cryptocurrency thefts attributed to the group, including the $1.5 billion Bybit attack in February 2025. Binance, however, has not officially confirmed the identity of those responsible and says it is cooperating with law enforcement.
The incident has also drawn attention to the security risks associated with hot wallets. Unlike cold wallets, which remain offline for much of their operation, hot wallets are connected to the internet to facilitate deposits and withdrawals. Their accessibility makes them essential for exchange operations but also creates additional security risks when authorization systems are compromised.
Binance temporarily suspended withdrawals while reviewing affected systems, revoking compromised authorizations and introducing additional security controls. Deposits and unaffected platform services remained operational, according to the exchange. Its October 31 update targeted a phased restoration of withdrawals within approximately 34 hours, subject to successful security checks.
The exchange is also preparing an updated Proof of Reserves snapshot, with publication planned for November 2, 2026. The report is expected to provide users with updated information about Binance’s asset holdings and the reserves backing customer balances. A full technical post-mortem is also expected once investigators verify the findings.
The Binance hack has placed centralized exchange security under renewed scrutiny. Even platforms with substantial reserves and established security procedures remain exposed to operational vulnerabilities, particularly when attackers gain access to internal systems responsible for approving transactions.
For cryptocurrency users, the immediate concern is whether Binance can restore withdrawals safely, recover more stolen assets and demonstrate that the weaknesses behind the incident have been addressed. The exchange’s financial commitment offers reassurance about customer compensation, but its investigation and security reforms will ultimately determine how quickly confidence returns.
As of October 31, Binance says it has secured the funds needed to cover the losses, frozen approximately $3 billion in affected assets and continues working with investigators. Further technical findings and the planned Proof of Reserves publication will be important developments to watch as the Binance hack investigation progresses.
About The Author
