# The 2026 Binance hack\: what was lost, frozen, recovered and replaced

Canonical HTML: [Read this article on Rising](https://rising.dev/cybersecurity/binance-2026/)

Binance says about $6\.3 billion left its hot wallets from about 20\:05 UTC on 29 October 2026\. By its count, about $3 billion was frozen by 30 October and about 95% replaced from company funds by 1 November\. The FBI attributes the theft to North Korea\.

Reviewed 1 Nov 2026 · Written by Rising from the linked sources. This is a dated snapshot, so check the official records before acting.

## What happened

Binance says its hot wallets, the online wallets an exchange uses to pay out withdrawals, were compromised at about 20\:05 UTC on 29 October 2026\. TRM Labs and Elliptic, which sell blockchain tracing products, place the first transfers on the XRP Ledger at about that time\. Elliptic says wallets on most of the affected chains were drained within about 30 minutes\. It and TRM Labs report a second wave on Avalanche and Polygon after 23\:00 UTC and a last Ethereum sweep at 23\:56 UTC\.

A Binance spokesperson told TechCrunch, in an article stamped 22\:27 UTC on 29 October, that withdrawals were suspended on multiple networks\. Binance says outflows stopped when it paused withdrawals\. Bitquery, a blockchain data vendor, says the last Ethereum drain came after that pause and dates Binance's revocation of the attacker's Ethereum approval to 00\:10 UTC on 30 October\. Binance has not published the time of a full pause\.

The Financial Services Regulatory Authority of Abu Dhabi Global Market says it is engaging with Binance and monitoring the incident, and gives no figures\. CNBC reported on 31 October that the incident affected Binance's offshore platform and not its regulated US exchange\.

## What was lost

Binance estimates the loss at about $6\.3 billion in token assets, a total it gave on 30 October and has not changed\. The FBI said on 31 October that the amount was more than $6 billion\. Tracing firms give different totals, and their valuation bases and chain counts differ\. Binance has not published its own list of chains\.

TRM Labs says about $6\.36 billion at the moment each asset left and about $6\.23 billion at prices at its cut\-off of 00\:30 UTC on 30 October, across ten chains\. Chainalysis, also a tracing vendor, said about $6\.4 billion on 30 October\. Elliptic says $6\.43 billion at theft\-time prices across 11 chains, adding NEAR, in a page last updated at 08\:00 UTC on 1 November\. It excludes a further $169 million that it believes was Binance moving its own funds\. Bitquery says about $6\.3 billion from 17 hot wallets on nine chains, with figures checked on 31 October\.

At its cut\-off, TRM Labs lists about $3\.79 billion taken on Ethereum, including 1\.875 billion USDT and 823 million USDC\. It also lists 18,270 BTC \(about $1\.47 billion\), about $628 million on Tron, 233\.46 million XRP \(about $296 million\) and 970,500 SOL \(about $96 million\)\. TRM Labs, Chainalysis and Elliptic each call the theft the largest in crypto on record\.

## What is frozen

Binance said its verified frozen total was $2\.54 billion at 23\:22 UTC on 29 October and about $3 billion at 00\:52 UTC on 30 October\. It repeated the $3 billion figure that day and has given none since\. Elliptic says it has verified $2\.85 billion frozen or seized on\-chain, at prices of about 05\:50 UTC on 1 November\. Of that, 94% is stablecoins, and the figure excludes an Aave lending position holding $59\.9 million of collateral\. TRM Labs counted about $2\.7 billion at 00\:30 UTC on 30 October, and Chainalysis about $2\.8 billion in a 30 October post that leaves the time blank\.

Several freezes make up those totals and should not be added to them\. Tether chief executive Paolo Ardoino said at 21\:25 UTC on 29 October that Tether had frozen more than 1\.567 billion USDT, and TRM Labs counts about 1\.77 billion by 00\:30 UTC on 30 October\. Circle chief executive Jeremy Allaire said at 21\:18 UTC that Circle had frozen more than 800 million USDC in coordination with law enforcement, and TRM Labs counts about 825 million\. TRM Labs also lists 40\.5 million RLUSD frozen by Ripple and 27\.8 million USD1 frozen by World Liberty Financial\. It says the Arbitrum Security Council forced about $30 million in ETH and ARB out of an attacker wallet\.

Elliptic says nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, because those native assets have no issuer\.

## What has been recovered

Binance had reported no recovered amount by 11\:38 UTC on 1 November\. It said at 10\:55 UTC on 30 October that it had begun recovering affected assets for users, gave no figure, and said frozen assets remained subject to recovery and verification\. Its update of 1 November says it is still working with law enforcement and partners to trace and recover stolen funds\.

Returning frozen tokens takes a separate legal step\. Ari Redbord of TRM Labs told CNBC on 30 October that issuers usually act on a court order or seizure warrant obtained by law enforcement when they release or reissue frozen tokens\. Eric Jardine of Chainalysis told CNBC that returns have no set timetable and can run to months or years\.

## What Binance has replaced

Replacement comes from Binance's own money, and Binance said on 30 October that these figures do not include frozen or protected assets\. It said that day it had set aside more than $6\.34 billion of company funds, with $5 billion already held in the stolen tokens, and put coverage at about 80% of the impacted amount\. It reported about 90% on 31 October, $6 billion in a post at 03\:04 UTC on 1 November and about 95% at 04\:11 UTC that day\. The outstanding 5% are less liquid tokens outside its top ten, which it says it is still buying through market and over\-the\-counter channels\.

The money comes from part of the Secure Asset Fund for Users \(SAFU\), Binance's emergency reserve, part of its Futures insurance fund, which it describes as surplus above the required level, and its corporate treasury\. It gives no total for each\. Binance said at 16\:15 UTC on 31 October that the SAFU transfer was complete and was 7,499 BTC\. Co\-chief executive Yi He said at 18\:34 UTC that half of the funds at the SAFU address were being allocated\. Binance commits to returning SAFU to about $1 billion\.

Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed, and it points to a Proof of Reserves snapshot taken at 00\:00 UTC on 31 October\. Holders of those ten tokens can verify backing of at least 1\:1 once a full zero\-knowledge proof is generated, it says\. It estimates that by 3 November \(UTC\), a day after its earlier target\. Its updates cite no independent audit\.

## Withdrawals and deposits

At 11\:31 UTC on 1 November, Binance listed twelve networks as re\-enabled for withdrawals\. They are Bitcoin for BTC, Ethereum for ETH, USDT and USDC, BNB Smart Chain for BNB, USDT and USDC, the XRP Ledger for XRP, Base for ETH and USDC, Dogecoin for DOGE, Optimism for ETH, USDT and USDC, Arbitrum for ARB, ETH, USDT and USDC, Tron for TRX and USDT, Solana for SOL, USDT and USDC, Polygon for POL, USDT and USDC, and Avalanche C\-Chain for AVAX, USDT and USDC\. Its phase one, which it said would begin between 06\:00 and 09\:00 UTC that day, lists 15 networks\. The other three are Zcash, TON and Sui\. Binance has given no timetable for them or for later phases\.

Binance said at 06\:53 UTC on 1 November that all withdrawals would come from newly generated wallet addresses, which it has added to its Proof of Reserves list\.

Deposits are open, according to the 1 November update\. Binance said at 00\:13 and 02\:25 UTC on 30 October that deposits and withdrawals were suspended, then said at 04\:36 UTC that deposits were unaffected\. A note on the support\-page copy of the 02\:25 text says the announcement was updated on 30 October to clarify that deposits remained unaffected and operated as normal\. Its updates describe no general halt to trading, although Reuters reported on 30 October a Binance promise that trading would return within days\.

## What customers should do

Binance tells customers to rely only on its official channels and to distrust unofficial links, messages and requests for account information\. Before withdrawing, it says to check the withdrawal page for the asset and network, or its network status page\. It warns of delays during the rollout and says a failed withdrawal for a listed asset can be tried again after a short while\.

Yi He advised at 08\:10 UTC on 1 November that customers check all withdrawal details, confirm the address and make sure their device is secure\. Co\-chief executive Richard Teng suggested on 30 October that concerned customers check the funds in their accounts and contact customer service\. Binance's four updates and the Abu Dhabi regulator's statement do not tell customers to move funds or change credentials\. The FBI asks anyone with information on the theft to contact a local field office or ic3\.gov\.

## How the attack worked

Binance's first finding, posted at 02\:25 UTC on 30 October, was that a DevOps engineer's compromised laptop may have given an attacker access to a service container, from which unauthorized withdrawal transactions were submitted\. Teng said at 07\:37 UTC that the attack went beyond the misuse of one engineer's permissions and that the investigation had attributed responsibility to no individual\. At 08\:47 UTC, Binance said later investigation had found additional points of breach\.

Teng said in a transcript posted at 14\:33 UTC on 30 October that a self\-destruct mechanism destroyed tools and traces\. He said the attacker used EIP\-7702 to gain on\-chain execution rights over a hot wallet, through a delegation that bypassed Binance's normal approval controls\. He called EIP\-7702 a multi\-signature protocol\. TRM Labs and Elliptic describe it as an Ethereum feature, added in the 2025 Pectra upgrade, under which an ordinary wallet can hand its behavior to a smart contract\.

Binance said in its updates through 30 October that it had found no evidence that wallet private keys leaked, and its updates of 31 October and 1 November do not repeat the statement\. TRM Labs assesses that the attacker most likely gained the ability to make Binance's hot wallet signing system sign transactions\. It reasons that wallets differing in chain, key type and signing scheme all signed transfers to the attacker within about half an hour\. Elliptic reads the chain the same way\. Bitquery says the chain shows valid signatures and cannot show who asked for them, and Binance has not confirmed the vendors' reading\.

TRM Labs says preparation began at least 36 hours before the theft, with an operator wallet funded through small Tornado Cash withdrawals\. Elliptic says the attacker rehearsed on another wallet about four hours before using the code against Binance\.

## Who is said to be responsible

The FBI said in an alert dated 31 October that North Korea was responsible, and it calls this activity TraderTraitor\. The alert names the US Secret Service and IRS Criminal Investigation as partners\. It gives no evidence for the finding beyond a list of 628 addresses that it says are operated by or closely connected to the actors\.

TRM Labs attributes the attack to TraderTraitor with high confidence, citing on\-chain and off\-chain intelligence it does not detail and similarities to the Bybit and KelpDAO thefts\. Chainalysis chief executive Jonathan Levin wrote likely at 04\:14 UTC on 30 October, and the company wrote of a high degree of confidence at 04\:31 UTC\. It cites stolen funds mixing with funds from the September 2026 Bitget exploit, which it says was attributed to North Korea\. Elliptic assessed TraderTraitor as the likely perpetrator before the FBI alert, citing the same Bitget link, shared services with three earlier TraderTraitor thefts, methods and scale\.

Binance has not named a perpetrator\. Its first update said it was working with law enforcement to confirm the identity of the criminals, and it thanked the FBI's cyber branch at 05\:05 UTC on 1 November without mentioning North Korea\.

## Where the stolen funds are

Elliptic says, in its page last updated at 08\:00 UTC on 1 November, that the attacker controls about $3\.25 billion that no issuer can freeze, across more than 800 addresses\. That includes about 584,000 ETH, 18,327 BTC and 233 million XRP\.

The FBI says it and its partners have observed stolen assets being converted primarily into ether, and it expects further laundering through decentralized finance and instant swap services\. Elliptic says about $786 million of stablecoins were converted before the freezes landed and that almost all the stolen TRX has been laundered, most of it arriving as ETH through cross\-chain bridges\. It says the original 18,270 BTC sits in 19 addresses with none sent to a service, and that XRP, SOL and NEAR worth about $439 million have not moved\.

Chainalysis and Elliptic both say the transaction patterns suggest automation, and Elliptic says on\-chain data cannot show whether AI agents are involved\. Elliptic expects the laundering to take months, as it did after Bybit\.

## What exchanges and wallet teams can do

The FBI urges node operators, instant exchanges, decentralized finance services, analytics firms and other virtual asset providers to block transactions with or derived from the addresses on its list\. Elliptic, which sells screening products, publishes a free blocklist it says holds more than 8,000 addresses\.

TRM Labs, which sells compliance products, advises treasury teams to alert on any EIP\-7702 delegation on a treasury wallet and to keep a tested, pre\-approved way to sign a revocation\. It also advises signing policies that reject unexpected authorizations, and separating signing systems by chain and wallet tier\.

## What is not known

Accounts differ on whose funds were taken\. Teng said on 30 October that only Binance's own hot wallet was affected, that customer funds were not, and that the vast majority of user assets sit in cold wallets\. CNBC describes the loss as client assets, and Binance has published no independent check of Teng's statement\.

Binance's updates do not say whether customer personal data was accessed, or what happens to frozen stablecoins once it has replaced them\.

Binance has not published a root cause or named the additional points of breach\. In its update posted at 19\:58 UTC on 30 October, it expected to share further technical findings within about 48 hours, once they were verified and if disclosure would not compromise the investigation\. It had published none by 11\:38 UTC on 1 November\. Its 1 November update promises a post\-incident report when the investigation is complete, with no date\.

## Official records

- [Binance, Security Incident Update, 30 October 2026](https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7)
- [Binance, Security Incident Update \#2, 30 October 2026](https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751)
- [Binance, Recovery Update \#3, 31 October 2026](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62)
- [Binance, Recovery Update \#4, 1 November 2026](https://www.binance.com/en/support/announcement/detail/73911fb819b240f88b88256bdd318eda)
- [Binance post, latest withdrawal update, 1 November 2026, 11\:31 UTC](https://x.com/binance/status/2116855614634852611)
- [Richard Teng, video transcript, 30 October 2026](https://x.com/_RichardTeng/status/2116176703823528024)
- [Binance Proof of Reserves](https://www.binance.com/en/proof-of-reserves)
- [FBI alert, North Korea Responsible for $6 Billion\+ Binance Attack, 31 October 2026](https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack)
- [ADGM Financial Services Regulatory Authority statement](https://www.adgm.com/media/announcements/fsra-statement-regarding-security-incident-involving-binance)

## Further reading

- [Elliptic\: The largest theft in history](https://www.elliptic.co/insights/binance-largest-hack-in-history/): The latest on\-chain account, last updated at 08\:00 UTC on 1 November, with freeze totals, attacker holdings and laundering detail\. Elliptic sells blockchain analysis products\.
- [TRM Labs\: North Korea steals USD 6\.36 billion from Binance](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history): A per\-chain loss list and timed freezes with a stated cut\-off of 00\:30 UTC on 30 October\. TRM Labs sells blockchain intelligence products\.
- [Chainalysis\: Tracing the theft to North Korea](https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/): Explains the Bitget link behind its attribution and describes the laundering pattern\. Chainalysis sells blockchain analysis products\.
- [Bitquery\: Binance hack investigation](https://www.bitquery.io/investigations/binance-hack): States what its on\-chain method can and cannot show\. Bitquery sells blockchain data and says the piece was reported with AI tools\.
- [CNBC\: What we know and what comes next](https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html): Named analysts explain the difference between a freeze and a recovery\.
- [Reuters via Euronext\: Binance seeks to shore up confidence](https://live.euronext.com/en/financial-news/binance-seeks-shore-confidence-after-record-63-billion-heist): Reports Binance's response, law enforcement statements and market lows on 30 October\.