Developing story on Binance Hack 2026 — researched October 30, 2026.
Figures and service availability may change. This article distinguishes Binance’s statements from independent blockchain analysis and does not treat preliminary findings as a final investigation.
On October 29, 2026, attackers moved billions of dollars in cryptocurrency out of wallets associated with Binance. By the following day, the exchange had estimated the incident’s impact at approximately $6.3 billion and said that around $3 billion in affected assets had been frozen on-chain.
The numbers are extraordinary. But the more consequential question is how an attacker could cause a major exchange’s wallets to authorize withdrawals across multiple blockchains — even as Binance says it has found no evidence of stolen wallet private keys.
Here is what is confirmed, what independent investigators have observed, and what remains unknown.
Binance Hack 2026: The Key Facts#
| Question | What is known as of October 30, 2026 |
|---|---|
| When did the incident occur? | October 29, 2026, with major unauthorized outflows during the evening UTC. |
| How much was affected? | Binance estimates approximately $6.3 billion. Blockchain investigators report slightly different totals. |
| How much was frozen? | Binance says around $3 billion has been frozen on-chain. Frozen does not necessarily mean recovered. |
| What was the possible entry point? | Binance initially identified a potentially compromised DevOps engineer’s laptop, followed by additional points of breach. The root cause is not yet established. |
| Were private keys stolen? | Binance says it has found no evidence of a wallet private-key leak. |
| Are withdrawals available? | At the time of this review, Binance said deposits were operating normally but withdrawals remained paused pending security work. |
| Who covers losses? | Binance says it will use its SAFU fund and company resources to cover affected losses. |
These details are based on Binance’s October 30 incident announcement and subsequent service updates.
What Happened to Binance on October 29?#
Blockchain intelligence company TRM Labs reports that unauthorized transfers began around 20:05 UTC on October 29, initially involving XRP Ledger wallets.
Large outflows then appeared on other networks, including Ethereum, Bitcoin, Tron and Solana.
According to TRM, much of the theft unfolded in approximately 20 minutes, although other transfers occurred later in the evening.
This matters because the breach was not limited to a single token contract or an isolated blockchain application.
It involved wallet activity across several networks, each with different transaction formats and authorization methods.
Binance suspended withdrawals while it investigated.
In its October 30 announcement, the exchange confirmed the estimated $6.3 billion impact, revoked an affected address authorization and said it was working with issuers, blockchain investigators and law enforcement to trace the funds.
A later update acknowledged additional points of breach, making clear that the incident was more complex than a single compromised laptop.
The company has promised a technical post-mortem after verification is complete.
How Could $6.3 Billion Leave Binance Without a Reported Private-Key Leak?#
A cryptocurrency private key authorizes transactions, but an exchange’s withdrawal operation involves more than a key.
Software requests transfers, risk controls decide what is permitted, signing infrastructure produces authorized transactions, and blockchain networks confirm them.
If an attacker compromises the surrounding workflow, a transaction can receive a valid signature without the attacker necessarily extracting a private key.
That distinction is central to this incident.
However, it remains a working explanation, not a fully established account of every affected wallet.
Binance’s initial investigation pointed to a compromised DevOps laptop that may have allowed access to a service container and the submission of unauthorized withdrawal transactions.
Security researchers have examined the transactions themselves for clues about how those instructions were carried out.
The Ethereum EIP-7702 Finding#
TRM Labs and Elliptic describe an unusual event involving an Ethereum hot wallet.
A batch of 50 pre-signed authorizations associated with EIP-7702 was submitted, with one valid authorization delegating wallet behavior to attacker-controlled code.
Investigators say subsequent transactions drained assets from that wallet, with additional funds swept later.
EIP-7702 is a legitimate Ethereum mechanism that lets certain accounts delegate execution behavior to smart-contract code.
Its existence is not, by itself, a vulnerability.
The crucial unanswered question is how the attacker obtained the authority to make Binance’s wallet accept the delegation.
Other affected chains did not use the same Ethereum mechanism.
That broader pattern is why investigators are examining Binance’s transaction-approval and signing infrastructure rather than presenting EIP-7702 as an explanation for the entire attack.
Why Do Different Reports Show $6.3B, $6.36B or $6.43B?#
The figures are related but not identical.
Binance: Approximately $6.3 billion in estimated impact.
TRM Labs: Approximately $6.36 billion traced from Binance-associated wallets across ten blockchains.
Elliptic: Approximately $6.43 billion in assets identified across its analysis of affected wallets.
Different investigators can use different wallet-attribution sets, valuation timestamps and rules for including transfers.
Cryptocurrency prices also move while analysts are measuring the incident.
These estimates should not be treated as three separate thefts or combined into a larger total.
Likewise, the value of assets moved, the value frozen, the amount recovered, and any eventual customer reimbursement are four different measures.
Conflating them can make the scale of a developing incident harder to understand.
How Was Roughly $3 Billion Frozen — and Can Binance Recover the Rest?#
Some cryptocurrencies are issued by organizations that retain administrative powers over the tokens.
In certain circumstances, those issuers can blacklist an address or freeze particular token balances.
Investigators report that stablecoin issuers and other ecosystem participants used these mechanisms to restrict billions of dollars in affected assets.
Binance reported approximately $3 billion frozen.
Elliptic independently reported approximately $2.84 billion frozen in its October 30 review, using its own on-chain methodology and cutoff time.
Both numbers are snapshots, not necessarily contradictory final totals.
Frozen is not the same as returned.
A freeze may prevent an attacker from moving a token, but ownership, recovery procedures and eventual restitution still require additional steps.
Conversely, native assets such as bitcoin and ether do not have a central issuer able to freeze an address in the same way.
Their recovery presents different challenges.
The next meaningful measure is not simply how much more can be labelled or frozen, but how much can ultimately be secured and restored to the appropriate parties.
Are Binance Users’ Funds Safe? What About Withdrawals?#
Binance says customers will not bear losses from the attack.
The exchange has committed to covering the shortfall using its Secure Asset Fund for Users (SAFU) and company funds.
That is a public commitment from Binance.
The final financial effect and the details of reimbursement or balance-sheet restoration are not yet independently established.
Its later October 30 service update said deposits were operating normally while withdrawals remained paused during a security overhaul.
Binance expected withdrawals to resume within approximately 48 hours of that update, but did not provide a guaranteed reopening time for every asset or network.
If you use Binance, the practical priorities are straightforward:
- Check service availability through the official app or website.
- Keep records of affected balances or pending withdrawals.
- Be cautious of unsolicited messages offering compensation or accelerated withdrawals.
- Never reveal seed phrases, passwords or one-time codes to someone claiming to be support.
A temporary halt is not proof that every customer balance has been lost.
Equally, a promise to cover losses is not proof that all remediation is complete.
Both distinctions matter.
Who Is Suspected of Carrying Out the Binance Hack?#
TRM Labs has attributed the attack to TraderTraitor, a hacking operation it associates with North Korea, and describes its assessment as high confidence.
Elliptic has separately attributed the theft to North Korean actors based on its blockchain investigation and related evidence.
These are assessments by private intelligence firms.
Binance has not publicly confirmed an attacker identity in its cited incident notice, and publicly available attribution should not be mistaken for a completed law-enforcement determination.
The technical investigation and asset-tracing work are still evolving.
Why This Breach Matters Beyond Binance#
The immediate financial size makes the incident headline news.
Its underlying lesson may be more durable: secure private-key storage is only one layer of exchange security.
A platform can use strong cryptography and still depend on devices, service accounts, internal permissions, transaction policies and human approval processes.
When a withdrawal is validly signed on-chain, the network cannot determine whether the exchange intended to approve it.
That question belongs to the exchange’s internal controls.
For researchers evaluating centralized platforms, this incident makes several questions especially relevant.
How are withdrawal instructions authenticated?
Can a single compromised service change wallet behavior?
Which approvals require independent signers?
How quickly can suspect addresses be disabled?
How is customer protection funded and externally verified?
These are questions for Binance’s future post-mortem, not claims that particular controls were absent or failed in any specific way.
What Happens Next?#
Five developments will determine the lasting significance of the Binance breach.
Withdrawal restoration
A verified restoration of withdrawal services will be an important operational milestone.
Asset recovery
Investigators will need to establish how much of the affected cryptocurrency can ultimately be secured or recovered, rather than merely traced.
Technical investigation
Binance has promised a detailed post-mortem explaining the incident after its findings are verified.
Proof of Reserves
An updated Proof of Reserves may provide additional information about the exchange’s asset position following remediation.
Attacker attribution
Further evidence may clarify who orchestrated the attack and how access to the affected infrastructure was obtained.
The reported $6.3 billion impact is substantial.
But the story is not finished when a theft is detected or an address is frozen.
The full test will be whether the affected assets can be secured, customer obligations can be met, and the failures that enabled unauthorized withdrawals can be clearly explained.
Chainquiry’s Perspective#
In crypto, transaction finality is a feature.
At a centralized exchange, the harder problem is ensuring that only the right transactions reach the signing stage in the first place.
That is the central security question this incident raises.
Frequently Asked Questions#
Was Binance Hacked in October 2026?#
Yes. Binance confirmed a security incident on October 30, 2026, after unauthorized transfers from associated wallets on October 29.
It estimated the impact at roughly $6.3 billion.
How Much Money Did Binance Freeze After the Hack?#
Binance reported approximately $3 billion frozen on-chain as of October 30.
Independent investigators used somewhat different methodologies and reported slightly lower verified snapshots.
Frozen assets are not necessarily recovered assets.
When Will Binance Withdrawals Resume?#
As of the October 30 update reviewed for this article, withdrawals were paused while Binance completed security work.
The exchange expected service to resume within roughly 48 hours of its update.
Readers should check Binance’s official channels for the current status. The estimate is not a guarantee.
Did Hackers Steal Binance Private Keys?#
Binance says it has found no evidence of a private-key leak.
Researchers instead point to potentially compromised authorization or signing workflows.
The definitive root cause has not yet been published.
Will Binance Cover Customer Losses?#
Binance says it will cover losses using SAFU and its own funds.
The statement is a commitment, not an independent verification that every reimbursement and recovery step is complete.
Editorial note: Chainquiry prepared this explainer from Binance’s public disclosures, published blockchain-intelligence findings and technical documentation. Chainquiry did not independently trace every affected transaction or verify Binance’s internal systems.
Research reviewed October 30, 2026.
This article is informational and does not constitute financial or investment advice.
