Binance hack: what happened, what to do now, and what actually protects you

If you hold funds on Binance, start with the one distinction the coverage keeps blurring. By Binance's account so far, the theft on October 29, 2026 happened inside its systems. On everything published so far, no password you picked, no 2FA method, no setting on your side played any part in it, and none could have stopped it: Binance's account is that the unauthorized withdrawals were submitted from inside its systems. The danger to you begins after the hack, and it sits on your side: refund scams, fake support agents, malicious "claim portals" and trojanized apps that often follow a large breach. This post sorts what happened, what is still unknown, and each protective step by the threat it actually stops. Withdrawals are paused as of this writing, and Binance expects to resume them within 48 hours of its 04:36 UTC update. Everything here reflects the situation as of 06:40 UTC on October 30, 2026.

What actually happened at Binance?

TRM Labs estimates that about $6.36 billion left Binance across ten blockchains, with most of it moving in roughly 20 minutes starting at 20:05 UTC on October 29, followed by a second wave around 23:05 UTC. Ethereum accounted for about $3.79 billion and Bitcoin for 18,270 BTC, around $1.47 billion. Chainalysis put the figure at $5.912 billion at the time of theft, and its co-founder later spoke of about $6.4 billion and likely TraderTraitor involvement. By TRM's count, that is about four times the $1.5 billion Bybit theft of February 2025.

By 21:29 UTC Binance said it was "aware of reports of a potential security issue" and warned users not to trust unofficial links or requests for account information. It suspended withdrawals, and in its main statement at about 02:25 UTC on October 30 said the estimated total impact "sits at around $6.3B", with about $3 billion frozen on chain so far. According to Binance, its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Binance says it has found "no evidence of any wallet private key leak" and that the incident "stems from multiple factors". It has promised a comprehensive report with the root cause. Binance also says it will publish an updated Proof of Reserves once remediation is complete.

Per TRM, the funds came out of hot wallets, the wallets an exchange keeps connected to the internet so withdrawals can be signed quickly. TRM's assessment is that the "most likely explanation" is the attacker made Binance's hot wallet signing system sign transactions, after rehearsing on test wallets. TRM attributes the attack to North Korea's TraderTraitor group "with high confidence", and Chainalysis's co-founder also points to TraderTraitor. Both are analyst assessments. The FBI attributed the Bybit theft to the same group, but no government has made a statement on this incident.

Binance says it will cover all losses from the SAFU fund and the company's funds, and that "User funds are safe". Those are Binance's pledges, stated by Binance. For scale, CoinDesk reports SAFU holds roughly $1 billion in bitcoin and was set up in 2018, and that Binance held about $144 billion before the hack per DefiLlama, meaning the theft took around 4% of assets. Binance.US reportedly was not affected, per PTC News.

What is still not confirmed?

Quite a lot. Treat the following as open questions, not settled facts.

• The root cause. The laptop explanation is Binance's initial suggestion, and Binance itself says multiple factors were involved. Whether one compromised computer explains signing across ten chains is not established.
• The final loss. Figures from Binance, TRM and Chainalysis differ and are still moving.
• How much comes back. Frozen means an issuer such as Tether, or in one case a chain's security council, has blocked stolen tokens from moving on chain; returned means the money is back where it started, and no return has been reported. TRM estimates issuers froze about $2.67 billion, including roughly 1.77 billion USDT by Tether and 825 million USDC by Circle. But TRM also estimates over 420,000 ETH and 18,270 BTC, about $2.4 billion, are "beyond any issuer's reach". CoinDesk reports the bitcoin was split into 19 wallets that nobody can freeze, none of which had moved coins as of 04:23 UTC. Even if every frozen token came back, about $3.3 billion would remain, and SAFU's roughly $1 billion covers under a third of that, with Binance saying company funds cover the rest.
• Attribution. TRM and Chainalysis point to TraderTraitor; no government statement exists for this incident.
• Users and data. No Binance statement gives a number of affected users, says accounts were individually compromised, or addresses personal data either way.
• Timing. Binance said at 04:36 UTC it expects withdrawals "to resume within 48 hours" while a security revamp of the withdrawal service completes.
• Deposits. There is a plain conflict in Binance's own wording. Its 00:13 UTC and about 02:25 UTC statements said deposits and withdrawals were temporarily suspended. Its 04:36 UTC update said "Deposits remain unaffected and continue to operate as normal." Binance has not explained the difference.

What should you do right now if you use Binance?

None of these steps would have prevented the hack. All of them reduce what an attacker or scammer can do to you from here.

1. Use official channels only. Binance asked users to rely only on official Binance channels for updates. Before trusting any link, email address, phone number or social account, paste it into Binance Verify. Binance's security tips say it will never call you or message you on WhatsApp or other social media. Set the anti-phishing code so genuine Binance emails carry a phrase only you know.
2. Treat every refund, claim or unlock message as a scam. Per Binance, it does not proactively contact users through unofficial channels to offer giveaways or ways to unlock an account, and it will never request funds via private communications. Recovery services are the same trap in a suit. As Revoke.cash puts it, "There is no legitimate recovery process that requires your seed phrase." Never pay an upfront fee to anyone promising recovery.
3. Audit your API keys. If you have ever connected a trading bot or portfolio tracker, review the keys. Binance's API guidance says to use an IP whitelist on all keys and to avoid enabling all permissions on a single key. A key without an IP whitelist cannot initiate withdrawals, and inactive non-whitelisted keys are deleted after 30 days. Delete anything you do not recognize.
4. Turn on the withdrawal whitelist. With it enabled, per Binance, you can only withdraw to addresses on your whitelist, adding one requires 2FA, and changing the whitelist may suspend withdrawals for 24, 48 or 72 hours. The Whitelist Withdrawal Limit additionally delays newly added addresses. That waiting period is the point: it buys you time if someone gets into your account.
5. Check your devices and login history. Binance keeps a log of login attempts. Review it, and remove any device or session you do not recognize.
6. Passwords and 2FA, honestly. Binance's statements have not asked users to change passwords and say nothing about personal data either way. Change yours anyway if you reuse it on another site, if you clicked any link from a message about the hack, or if you ever read a code to anyone. And upgrade your second factor: Binance supports a passkey or authenticator app "as an alternative to SMS verification". They are not equal, as explained below.

Which scams follow a hack like this?

The hours after a famous breach are a busy time for impersonators, because fear makes people click. Chainalysis reports impersonation scams grew more than 1400% in 2025 compared with 2024, with the average scam payment rising from $782 in 2024 to $2,764 in 2025. Expect these shapes:

• The refund email. "Claim your compensation before the deadline." The link leads to a fake login page that harvests your password and 2FA code in real time.
• The support call. Someone claiming to be Binance security says your account is at risk and walks you through "verification". Binance says it will never call you.
• The recovery expert. After you lose money, a helpful stranger offers to trace it, for a fee, or asks for your seed phrase to "sync" your wallet. Both requests end the same way.
• The unlock service. With withdrawals paused, expect offers of a special channel to get your funds out early. Binance says it does not offer ways to unlock an account through unofficial channels.

Why does urgency work? Because, as the FTC notes, cryptocurrency payments typically are not reversible, and you are likely to find no one can step in to help recover funds from a stolen wallet. A scammer needs one signed transaction, once.

How do you secure crypto in general?

Start with the trade-off. Keeping coins on an exchange exposes you to exchange-side breaches like this one, and in exchange the platform may pledge to make you whole, as Binance has. Holding your own keys removes the exchange from the equation entirely, and puts every remaining risk on you. Chainalysis counted 158,000 individual wallet compromises and 80,000 unique victims in 2025, with $713 million stolen from individuals, down from a 2024 peak of $1.5 billion. No exchange-style pledge covers those losses. We are not telling you where to keep your money; we are telling you the risk moves with it.

Whatever mix you choose, these habits hold up:

• Know what a hardware wallet actually does. It keeps the private keys on a separate device and signs transactions there, so a compromised computer never holds them, but you still have to read what you approve on its screen.
• Keep your seed phrase offline. Written on paper or metal, never photographed, never typed into a website, never shared. Anyone who asks for it is taking your wallet, whatever they call the process.
• Prefer passkeys and hardware keys over codes. A passkey is bound to the real website: under the WebAuthn standard, credentials are scoped to one relying party and cannot be used by a lookalike domain. An authenticator app is good, but a convincing phishing page can relay its codes live. SMS is the weakest option: NIST's guidance treats SMS and voice verification as restricted. It also says plainly: "Passwords are not phishing-resistant."
• Whitelist withdrawal addresses on any exchange that supports it, so stolen credentials alone cannot redirect your coins.
• Revoke old token approvals. If you use DeFi, approvals "give permission to a smart contract to spend your tokens on your behalf" and, per Revoke.cash, they stay active indefinitely. Review them with Revoke.cash or Etherscan's token approvals page and cut the ones you no longer need.
• Use a separate email address for exchange accounts, one you use nowhere else, so a leak at some unrelated service does not hand attackers your crypto login.
• Download wallet apps only from official sources. This is not hypothetical for the group analysts name. CISA's TraderTraitor advisory describes spearphishing messages to crypto company employees that "mimic a recruitment effort and offer high-paying jobs" and push victims to download trojanized cryptocurrency applications on Windows or macOS. The same playbook, pointed at individuals, is a fake wallet update.

For the broader basics, from password managers to update discipline, see our online security hub and the October 2026 cybersecurity week roundup.

Which protection stops which threat?

This is the table worth keeping. Read the exchange-side column first.

Look at the exchange-side column. Against an exchange-side breach, almost every row reads No, because, on Binance's account so far, the attack ran inside its systems. The only Yes is holding the coins yourself, and that row carries its own cost: the 158,000 wallet compromises Chainalysis counted in 2025 happened in personal wallets, not at exchanges. There is no row that wins every column. That is why the sensible move is layering, not picking one.

Where does a VPN actually help?

A VPN sits in one column of that table and touches a second. Le VPN encrypts the traffic between your device and the VPN server, which means someone on the same cafe or airport network cannot read your traffic, and your ISP does not see which services you use. If you ever check an exchange or a wallet away from home, that matters; see our guide to public Wi-Fi security. Threat Protection (Block Online Threats on Windows and Android), a switch in current apps, adds DNS-based blocking of known malicious domains, which can stop you from reaching a flagged phishing site, though a page registered an hour ago may not be on any list yet. The Data Breach Scanner, included with an active service, checks the e-mail address on your Le VPN account against known leaks and e-mails you if it turns up.

And here is what a VPN does not do. It does not stop malware already on your device. It cannot block a phishing page nobody has flagged. It would not have touched this breach in any way, since, by Binance's account, it happened inside Binance's systems. It does not change an exchange's terms of service or which countries an exchange serves. And connecting from a new IP address may trigger extra security checks at an exchange, so expect an extra prompt. For a fuller picture of where the tool fits in a crypto setup, read our piece on VPNs and cryptocurrency security.

Until Binance publishes its post-mortem, facts about this hack come from its official accounts and named analysts. Anyone else who contacts you about it, by email, phone, DM or pop-up, wants something from you.