Binance Hack: $6.3bn Taken From Hot Wallets, $3bn Frozen

On the evening of 29 October 2026 an attacker emptied hot wallets at Binance, the largest crypto exchange in the world. Binance puts the loss at about $6.3 billion. That makes it the largest crypto theft on record, about four times the Bybit hack of February 2025. Most of the money left in about 20 minutes. Binance paused withdrawals, says about $3 billion is frozen, and promises to cover every loss from its own funds. We read the statements, checked the Ethereum chain ourselves and tracked the market for 21 hours. Here is what happened, where the money is, and what it means for anyone who funds a crypto casino through Binance.

Alex Jovanovic: “Binance is the exchange most of our readers use to fund a casino. When its withdrawals stop, you cannot move coins from Binance to your casino balance. The amount is new for this industry. The questions to ask are the same ones we ask every time: whose money, how much is back, and when can you move yours.”

Hour by hour

All times are UTC. Rows marked “chain” we checked on Ethereum ourselves.

When	What happened
28 Oct, 07:39	The wallet that later starts the attack gets its first ETH through Tornado Cash, a coin mixer. Chain.
29 Oct, 13:51 to 16:47	Rehearsal. The same trick is tested on three unrelated wallets. Chain.
29 Oct, 20:05	The theft starts, by TRM Labs’ count. Most of the money leaves within about 20 minutes, on ten blockchains.
20:20:59	One transaction carries 50 pre-signed authorisations for a Binance hot wallet on Ethereum. One of them works. The attacker pays 0.0065 ETH in fees, about $15. Chain.
20:24:23	The first sweep empties that wallet: 167,464 ETH, 1.615 billion USDT and 62 other tokens. Chain.
20:24	About $4.9 billion has left in 14 minutes, $2.53 billion of it in a single transaction, analysts count.
20:32	The first public warning appears on X.
20:41	780 million USDC leaves a second Binance wallet. Another 43 million follows at 20:59. Chain.
21:08 and 21:13	Reports that Tether froze about $971 million and Circle about $823 million.
21:15	Founder Changpeng Zhao (CZ): “It does look like a hack on Binance.”
21:16	Binance: “actively investigating”, no confirmed impact on user funds.
21:44	A third sweep sends 200.4 million USDT to an address Tether has already blocked. It is frozen on arrival. Chain.
23:05	The last outflow in the theft window, analysts count.
30 Oct, 02:23	Binance confirms: about $6.3 billion lost, about $3 billion frozen, a DevOps laptop as the likely way in. Withdrawals suspended. All losses to be covered.
about 04:12	Investigator ZachXBT: Binance funds and funds from a separate Bitget theft were mixed on one address after a swap through THORChain.
08:47	Binance: “additional points of breach”. Withdrawals to return in 45 hours. Deposits work.
10:55	Binance: $6.34 billion set aside, $5 billion of it already in the stolen tokens.
14:33	Co-CEO Richard Teng in a video: several attackers, withdrawals “within 40 hours”, Proof of Reserves by Monday.

Binance’s first words came about an hour after the theft started. Co-founder and co-CEO Yi He posted the same message a minute later and ended it with “User Funds SAFU.” CZ, who no longer runs the exchange, was a minute ahead of both.

How the money left

Binance’s first account was short. A DevOps engineer’s laptop was compromised. Through it the attacker reached a service container and sent withdrawal transactions that Binance did not authorise. The exchange says it found no sign that wallet private keys leaked.

Six hours later that account grew. Binance wrote that it had found “additional points of breach”. In his video Richard Teng said the attack “was not carried out by one person” and that the attacker used a self-destruct mechanism that wiped tools and traces along the way.

On Ethereum the method is visible on the chain. At 20:20:59 UTC one transaction delivered 50 authorisations, each signed in advance in the name of the Binance hot wallet. They use EIP-7702, a feature Ethereum added in May 2025. It lets an ordinary wallet hand control to a piece of code. One of the 50 matched the wallet’s next transaction number and went through. From that moment the attacker’s code could move everything in the wallet. Teng called EIP-7702 a “multi-signature protocol”. It is a delegation feature for a single wallet. He also said the delegation “did not pass through our normal approval controls”.

Three minutes and 24 seconds later came the sweep. One transaction took 167,464 ETH, worth about $375 million, plus 1.615 billion USDT and 62 other tokens. Among them were 62.6 million RLUSD, 29,934 wBETH, gold-backed XAUt worth about $44 million and 7.2 trillion PEPE.

Not every wallet was hit this way. A second Binance wallet on Ethereum sent 28,006 ETH and 55.7 million USDT with ordinary signed transfers. On the other nine chains, TRM Labs says, Binance wallets also paid out through normal signed transactions. That points to the system that signs Binance withdrawals. Security researchers quoted in the press add that EIP-7702 changed little. Whoever can get the signing system to sign has the money either way.

Alex Jovanovic: “Fifty signatures were ready before the first coin moved, and the trick was rehearsed on other wallets that afternoon. This was planned for days. The laptop was one way in. The weak point was the system that signs withdrawals.”

Who is behind it

Binance and Teng name nobody. Two blockchain analytics firms do. TRM Labs links the theft to TraderTraitor, a North Korean hacking group, with “high confidence”. Chainalysis CEO Jonathan Levin said the theft was “likely done by DPRK group TraderTraitor”. The main clue is the mixing that ZachXBT spotted: money from Binance and from the Bitget theft met on the same address in real time. North Korea usually denies such claims.

The FBI has tied TraderTraitor to the $1.5 billion Bybit theft and, with Japanese police, to the loss of more than $300 million at DMM Bitcoin in May 2024. The group often gets in through staff, with fake recruiters and coding tests. One security analyst told the BBC the Binance engineer may have been talked into such a test. Binance has not said so.

Where the $6.3 billion is now

The stablecoins were the easy part to stop. USDT, USDC and RLUSD can be blocked by the companies that issue them, and the issuers acted within the hour. On Ethereum we found one address holding 1.175 billion USDT and 823 million USDC, about $2 billion, all of it blocked. Part of that USDT arrived after the block was in place. TRM Labs counts about $2.67 billion frozen by Tether, Circle, Ripple and World Liberty Financial. The Arbitrum Security Council froze another 8,426 ETH and 74.6 million ARB.

ETH and BTC are a different story. Nobody can freeze them. The attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion by TRM Labs’ count. One wallet alone holds 197,460 ETH and has not sent a single transaction. TRM Labs also says the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to beat the freezes.

A freeze does not return the money. Analysts from TRM Labs and Chainalysis told CNBC that recovery needs a court order or seizure warrant, after which the issuer burns the frozen tokens and issues new ones. That can take “months or years”.

What Binance promises

The promise has been the same in every statement: Binance will cover all losses from its SAFU emergency fund and company money. By 10:55 UTC on 30 October it had reserved $6.34 billion. Binance says $5 billion of that is already in the same tokens that were stolen. It is buying the rest on the market and over the counter, which may take time for thinly traded tokens. Frozen funds are not counted in the $6.34 billion.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted.

Binance (@binance) 30 October 2026

CZ did the sums in public. He no longer manages Binance but remains a shareholder. His numbers: a hack of “$6.x b”, $3 billion frozen and a SAFU fund of “$1.x b” leave a gap of about $2 billion. He added that Binance’s SpaceX shares alone are worth more than $1 billion. He later said he did not mean Binance would sell them. Thai partner Gulf, which runs Binance TH, offered help with cash. Binance TH says its own cold wallets are separate and safe.

Elon Musk answered a post that compared Binance to FTX with a “yikes” emoji. CZ replied that it was a “bad time to troll” and asked him to stop. Sean Farrell of Fundstrat told CNBC he sees no real risk to Binance’s solvency.

Richard Teng gave the fullest version of the promise in a video at 14:33 UTC. The key lines:

I want to be clear: WE ARE COMMITTED TO COVERING ALL HACKED LOSSES THROUGH OUR COMPANY FUNDS. Your assets are safe.

What was affected in this incident was Binance’s own hot wallet. User assets are held under Binance’s established security architecture. The vast majority sit in cold wallets, and are only moved into a hot wallet when a user makes a withdrawal.

Richard Teng (@_RichardTeng) 30 October 2026

• Withdrawals: the service is being rebuilt and tested. Teng hopes to reopen it “within 40 hours”, before the Sunday deadline.
• Proof of Reserves: a full report by Monday 2 November, with a first view earlier if possible.
• Security review: across the whole company, including devices, cloud, key management and signing.
• Recovery: work with law enforcement, analytics firms, token issuers and other exchanges.

Alex Jovanovic: “The numbers behind the promise hold up. $6.34 billion reserved against a $6.3 billion loss, with $3 billion more frozen that may come back one day. I have not seen an exchange put that much on the table within 15 hours. A promise becomes a fact when withdrawals reopen and the reserve report adds up. Both are due within four days.”

What the market did

We took hourly prices from Binance spot and compared each coin with its 20:00 UTC price on 29 October, five minutes before the theft began. The last reading is 17:00 UTC on 30 October.

Coin	Change by 17:00 UTC	Lowest point	Why it moved
BNB	-6.0%	-8.7%, $680	The exchange’s own token. The deepest drop came in the first hour.
SOL	-5.0%	-7.5%	Sold with the wider market.
ETH	-4.6%	-7.0%, $2,174	The attacker holds more than 420,000 ETH that nobody can freeze.
BTC	-4.4%	-5.4%, $76,500	The low came around the time Binance confirmed the hack.
ARB	-3.7%	-12.1%	Part of the stolen funds sat on Arbitrum. Its Security Council froze 74.6 million ARB.
XRP	-2.9%	-6.4%	The first $300 million left on the XRP Ledger.
RUNE	+5.2%	peak +17.8% around 05:00 UTC	THORChain earns fees on swaps, and the stolen funds used it.
USDC	flat	up to 0.4% above USDT	A small premium in the hour Circle froze $823 million.

Forced selling made it worse. Long positions worth $1.31 billion were liquidated in 24 hours, out of $1.56 billion in total. Tech stocks fell on the same day, and CZ pointed out that traditional markets fell harder than crypto.

What could fall and what could rise

These are the risks we are watching. None of this is trading advice.

• BNB has the most to lose and to win. If withdrawals reopen on time and the reserve report adds up, the first-hour drop has room to close. A delay would hit BNB first.
• ETH carries an overhang. More than 420,000 ETH sits with the attacker, worth about $940 million at $2,229. One wallet holds 197,460 ETH and has not moved it yet. Every large transfer from it could weigh on the price.
• Binance is a buyer. About $1.3 billion of the reserve still has to be bought in the stolen tokens. In thinly traded tokens that can lift prices for a while.
• RUNE rose with the laundering. Swap fees rise while stolen money moves through THORChain. The coin has already given back most of its early jump.
• Stablecoins can be switched off. Tether and Circle froze about $2 billion within hours. That limits the damage. It also shows that a USDT or USDC balance can be frozen at the issuer’s word.

Alex Jovanovic: “The market treated this as a Binance problem. BTC lost less than 5%, and BNB took the heaviest hit among the large coins. My two dates are Sunday for withdrawals and Monday for the reserve report. If Binance makes both, I expect BNB to recover first. If it misses, I expect the 420,000 ETH to come back into the story.”

What it means for casino players

Many players buy crypto on Binance and send it to a casino. Large casinos such as Stake, BC.Game and Shuffle accept the coins that move this way. For now that road is closed in one direction.

1. You cannot fund a casino from Binance right now. Withdrawals are paused until about Sunday 1 November. Plan your deposits around that.
2. Think before you cash out to Binance. Deposits work, so a casino withdrawal to Binance will arrive. It will then stay there until withdrawals reopen. A wallet you control keeps your options open.
3. Take a fresh deposit address. Copy it from the app each time. After an incident platforms rotate addresses.
4. Expect phishing. Fake Binance support messages and fake refund pages follow every big hack. Yi He asked users not to trust unofficial links or requests for account details. Anyone who offers to recover funds for a fee is a scammer.
5. Read the second statement. Binance’s first account named one laptop. Six hours later there were more points of breach. When Gamdom went offline and when CoinDCX called its loss a false alarm, the full picture also came later.

The case also shows what a hot wallet is. It is the float a platform keeps online to pay withdrawals fast. Binance lost the float and says the cold storage is untouched. Casinos work the same way. We read the hot wallets of the casinos we review every day, for example on our Duel and Thrill pages. Our review method explains what a hot wallet can and cannot tell you. For Thai players, our report on Shuffle, Bitkub and Binance TH covers the local side of Binance.

What is still open

• The other points of breach. Binance found more than the laptop and has not said what. A technical report is promised after the investigation.
• How the signatures were made. Nobody has explained how the attacker got 50 valid authorisations for a Binance wallet.
• The exact date for withdrawals. Binance said 45 hours at 08:47 UTC. Teng said “within 40 hours” at 14:33 UTC.
• The reserve report. Due by Monday 2 November.
• The frozen $3 billion. Whether and when Binance gets it back depends on courts.
• Official attribution. Only analytics firms have named a group. Binance says it works with law enforcement and names no agency.

Alex’s verdict

Binance lost more in one evening than any crypto company before it. The response so far is the strongest I have seen after a hack. It confirmed the loss about six hours after the theft began, put a number on it and paused withdrawals. By the next morning it had set aside more than the stolen amount. The first story about a single laptop did not last, and Binance said so itself.

Binance promises to return everything. The money to do it appears to be there: $6.34 billion reserved and $5 billion of it already in the right tokens. The SAFU fund alone would not cover this. The promise rests on Binance’s own balance sheet. I will treat it as kept when two things happen. Withdrawals must reopen around Sunday, and the reserve report on Monday must show every user balance backed one to one.

For players my advice has not changed. Keep only what you need on any exchange or casino, move winnings to a wallet you control, and wait for the second statement. I will update this post when withdrawals reopen and the reserve report is out. If your casino deposit or withdrawal got stuck this week, tell us in the comments.

How we checked: we read the Binance announcement of 30 October 2026, posts on X by Binance, Richard Teng, Yi He and Changpeng Zhao up to 14:34 UTC on 30 October, and reports by CNBC, NBC, the BBC, Decrypt, Cointelegraph and BleepingComputer, which quote TRM Labs, Chainalysis and ZachXBT. The delegation, the three sweeps from the first Binance wallet, the transfers from the second wallet and the frozen balances were checked on the Ethereum chain on 30 October. Totals for the other nine chains come from analytics firms and were not repeated. Prices are hourly closes on Binance spot. Times are UTC.

FAQ

Was Binance hacked?

Yes. On 29 October 2026 an attacker took about $6.3 billion from Binance hot wallets, starting at 20:05 UTC. Binance confirmed the incident at 02:23 UTC on 30 October.

How much was stolen from Binance?

Binance estimates about $6.3 billion. TRM Labs counts $6.36 billion across ten blockchains, and Chainalysis about $6.4 billion. It is the largest crypto theft on record.

Are funds on Binance safe?

Binance says user funds are safe because the theft hit its own hot wallets and most user assets sit in cold wallets. It has promised to cover all losses and will publish a Proof of Reserves report by Monday 2 November 2026.

When will Binance withdrawals reopen?

At 08:47 UTC on 30 October Binance said withdrawals should return in about 45 hours. Richard Teng later said “within 40 hours”, before a Sunday deadline. That points to Sunday 1 November 2026. Deposits keep working.

Who hacked Binance?

Binance has not named anyone. TRM Labs and Chainalysis link the theft to TraderTraitor, a North Korean group also blamed for the Bybit hack. North Korea usually denies such claims.

How much of the stolen money is frozen?

About $3 billion, Binance says. TRM Labs counts about $2.7 billion, mostly stablecoins blocked by Tether, Circle, Ripple and World Liberty Financial. ETH and BTC worth about $2.4 billion remain with the attacker.

Can I deposit to a crypto casino from Binance now?

Not until withdrawals reopen. You can still receive coins on Binance, including casino withdrawals, but you cannot send them out again until the service is back.

Gambling is for adults only and can become addictive. Play only with money you can afford to lose, and read our responsible gambling guide if it stops being fun.