Binance Hack: Is Your Money Safe? What to Do Now

In short: The Binance hack was confirmed by Binance itself on 30 October 2026: an attacker submitted unauthorized withdrawals, and its initial investigation points to a compromised DevOps engineer's laptop, according to the security incident update on its support site. Binance puts the estimated impact at about $6.3 billion, with roughly $3 billion frozen on-chain, and says it will cover all losses from its SAFU fund and company funds. Deposits and withdrawals are paused; the main risk to ordinary users right now is phishing scams exploiting the news, not a breach of their own accounts.

The Binance hack went from unconfirmed reports to a company-verified security incident in about five hours. On 29 October, Binance said only that it was aware of reports of a possible security issue and was investigating. By 30 October, it had confirmed the breach, estimated the damage, and promised to make users whole. Here's what Binance has said, what it hasn't, and what to do with your account while the investigation continues.

Was Binance actually hacked?

Yes, by Binance's own account. The exchange's security incident update states that its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak." Binance describes the findings as preliminary and says it "will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."

The day before, Binance's stance was more guarded. In a post on X, the company said, "Our teams are aware of reports of a potential security issue and are actively investigating." Separately, Binance founder Changpeng Zhao — who no longer runs the exchange but remains a major shareholder — wrote on X, "It does look like a hack on Binance." That was his personal read on the situation, not an official Binance confirmation, and it came before the company's own 30 October update.

How much money was stolen, and is that number final?

Binance's own figure is about $6.3 billion, with about $3 billion frozen on-chain so far, according to the company's incident update, which states: "The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far." That makes it larger than the previous record, the $1.5 billion Bybit hack in 2025, which CoinDesk notes was linked to North Korea. Binance has not said who was behind this attack; blockchain intelligence firm TRM Labs said it has traced it to "TraderTraitor," a North Korean hacking group, CoinDesk reported.

Stablecoin issuers moved quickly to freeze stolen funds. Tether's CEO said the company froze more than $1.567 billion in USDT tied to the incident, and Circle's CEO said it froze more than $800 million in USDC in coordination with law enforcement, according to CoinDesk's reporting. First Digital confirmed the FDUSD stolen in the attack had also been frozen. These figures may still change as the investigation continues; nothing here is final.

Are my funds safe on Binance?

Binance says yes. Its update states: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete." On 29 October, before the full picture was known, Binance had already posted on X, "User funds are completely safe."

That is Binance's own pledge, not an independent audit result published so far. As immediate steps, the same update says Binance has "temporarily suspended deposits and withdrawals while security checks are completed; revoked the affected address authorisation; engaged law enforcement and blockchain intelligence partners to trace and recover funds."

Was my account or personal data compromised?

Binance's update doesn't say, one way or the other. The incident it describes is about unauthorized withdrawals from the exchange's own systems, through a compromised employee laptop and a service container; it does not mention customer logins, passwords or personal data. Treat that as not yet answered rather than ruled out.

What should I do about my Binance account right now?

Follow this checklist while the situation develops:

1. Get updates only from Binance's own app or by typing binance.com into your browser yourself — not from links in texts, emails, or social media posts. Binance's update says plainly: "Please rely only on official Binance channels for updates."
2. Treat any call, text, email or direct message claiming to be "Binance support" as a scam attempt, especially if it asks for your login, a 2FA code, or your seed phrase. Binance warned on X on 29 October: "Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information."
3. Ignore any "compensation" or "refund" claim form that didn't come from the Binance app itself. You don't need to apply for anything — Binance says it will cover losses from its own funds.
4. Never pay anyone who contacts you offering to help "recover" lost crypto. The FTC warns that "nobody legit will call, email, send a letter, or contact you on social media with this kind of offer," and that a request to pay by gift card, crypto, or wire transfer is itself a sign of fraud.
5. Set up Binance's anti-phishing code in your account settings so you can tell real Binance emails from fakes.
6. Switch two-factor authentication from SMS to an authenticator app or a passkey, which are harder for scammers to intercept; see our guide on how to disable SMS authentication.
7. Review your API keys and your withdrawal address whitelist for anything you don't recognize, and remove it.
8. When deposits and withdrawals do reopen, don't rush through a link claiming "withdrawals have resumed" — go into the app directly and check there first. For more on spotting fake messages tied to breach news, see our guide on how to spot phishing after a data breach.

When will deposits and withdrawals resume?

Binance hasn't said. Its 30 October update confirms the suspension but gives no timeline for restoring service, and promises a fuller technical post-mortem once the investigation is complete and verified. Until Binance's own app or site shows withdrawals are active again, assume any message telling you otherwise is a scam.

Updated 30 October 2026: corrected how long Binance took to confirm (about five hours, not 24), added TRM Labs' attribution to a North Korean group, and clarified that only Circle cited law enforcement.