Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
An independent record of the October 2026 Binance hack
Organisation
The statements below are attributed to this speaker by the cited sources. Appearing here is not an accusation.
Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Hacken relays a Binance statement.
The world's biggest cryptocurrency exchange reported Thursday that approximately $6.3 billion was impacted in an apparent hack.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
Reviewer note: Binance states the time as 'around 2026-10-29 20:05 (UTC)'.
23:35 | Binance states that the verified frozen total is $2.54B.
Reviewer note: Hacken relays a Binance statement and cites TRM for it.
Binance said the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (11:35 pm UTC), not a time stated by the speaker.
the verified total of assets frozen in connection with the hack had reached $2.54 billion, clarifying differing figures circulating publicly, including references to $1.8 billion.
It said Friday that it was beginning to recover assets for users.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance, the world's biggest cryptocurrency exchange, worked on Friday to shore up public confidence after a record $6.3 billion hack of its platform, promising it would cover all losses from company funds and allow clients to trade again within days.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance said customer funds were safe and it is working with industry partners to freeze some of the affected assets, with about $3 billion located so far.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
The exchange also said on Friday afternoon US eastern time that its technical team was targeting a resumption of withdrawal services within approximately 34 hours.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance said it has set aside around $6.34 billion of company funds internally to cover the losses.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day.
Binance said it has temporarily suspended deposits as it conducts security checks, freezes funds and coordinates with law enforcement.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (12:07 am UTC), not a time stated by the speaker.
deposits as it conducts security checks, freezes funds and coordinates with law enforcement. It previously confirmed it had suspended withdrawals.
Binance said the current verified amount of assets frozen from the hack is now $3 billion.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (12:52 am UTC), not a time stated by the speaker.
Binance's update of 02:23 UTC, Oct 30 , says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak."
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
We have found no evidence of any wallet private key leak.
Please rely only on official Binance channels for updates.
We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
The estimated total impact sits at around $6.3B.
We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
As an immediate precaution, Binance has: - temporarily suspended withdrawals while security checks are completed; - revoked the affected address authorisation; - engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Note: This announcement was updated on 2026-10-30 to clarify deposits remain unaffected and continue to operate as normal.
Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, with service expected to resume within 48 hours.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (4:17 am UTC), not a time stated by the speaker.
Binance said it was investigating a potential security issue, then said it had temporarily suspended withdrawals on multiple networks as a precaution. Binance has said user funds are safe.
Binance has said the attack began with a compromised employee laptop and involved multiple breach points. It found no evidence of private-key leakage and said roughly $3bn of affected assets had been frozen.
Binance has pledged to meet customer losses through its SAFU reserve and company resources, announcing more than $6.34bn of company funds separate from roughly $3bn of frozen assets.
Binance’s investigation into its $6.3 billion hack has uncovered “additional points of breach,” the exchange said , after initially pointing to a potentially compromised laptop. The exchange said it was still gathering facts in coordination with law enforcement. Binance said it remained on track to resume withdrawals in 45 hours, while deposits remained unaffected.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (8:37 am UTC), not a time stated by the speaker.
Binance has set aside more than $6.34 billion in company funds to cover losses from the hack, the exchange said. The company said $5 billion of those funds were already held in the same tokens affected by the attack.
Reviewer note: Event time is the time Cointelegraph stamped its live-blog entry (10:55 am UTC), not a time stated by the speaker.
“We are still gathering the facts, and will share more directly as we have them,” it wrote.
Reviewer note: Binance post on X as relayed by Cointelegraph. Event time not stated.
The exchange also said it submits weekly reports on company funds to Abu Dhabi’s Financial Services Regulatory Authority under a requirement that predated the hack.
Binance said it has reserved over $6.34 billion in company funds to offset losses it suffered in a recent breach.
Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".
Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.
The cryptocurrency exchange said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.
It said it will cover all losses.
The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
At this stage, we have found no evidence that wallet private keys were leaked.
Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.
We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.
we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.
For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.
Approximately $3 billion has been frozen on-chain to date.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks.
We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.
We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount.
Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.
We are buying the remaining 20% of the lost token assets. We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02.
we have taken a new Proof of Reserve (PoR) snapshot at 2026-10-31 00:00 (UTC), and this has already been updated on the PoR website.
Reviewer note: The 00:00 UTC time is the snapshot time stated by Binance, not the time of the post.
A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here.
A portion of our Futures insurance fund. The remaining balance of the Futures insurance fund is a regulatory requirement.
The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload
The SAFU fund is held and managed by Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market (ADGM) Financial Services Regulatory Authority.
so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
The outstanding 10% consists of tokens outside the top ten listed above.
Our last update explained that Binance had set aside more than $6.34B in company funds to cover hacked losses, and we had already covered approximately 80% of the impacted amount of the hacked loss at that time. That covered amount is now up to 90%.
All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.
The replenishment employed: - A partial deployment of the Secure Asset Fund for Users (SAFU). This is expected to happen over the next 24 hours; users can view the updated balance here. - A portion of our Futures insurance fund. The remaining balance of the Futures insurance fund is a regulatory requirement. Users can check the updated balance of the fund here. - Binance's own corporate treasury.
The full zero-knowledge proof takes approximately 40 to 50 hours to generate due to the computational workload, so users holding any of these ten tokens can independently verify that their assets are at a minimum 1:1 backed once the full proof is generated, estimated to be by Tuesday, 2026-11-03 (UTC).
We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01) and will provide a further update as soon as details are confirmed.
Binance is committing to replenishing the SAFU to return the fund size to approximately US$1 billion.
Binance has consistently pledged to cover 100% of the losses from what is suspected to be crypto's biggest hack on record and said it has set aside more than $6.34bn in company funds to do so.
"Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement on Saturday.
In an update on Sunday, Binance said withdrawals had been restored on several of its networks, after they were suspended following the hack.
Binance said it had replenished the stolen assets using various funds and its own corporate treasury.
All holdings of the cryptocurrencies bitcoin, Ethereum and Tether are covered, along with seven other widely-traded crypto assets, the company said.
Binance's initial investigation suggested an engineer's laptop was compromised, which allowed access to unauthorised withdrawals, but a later update said they had uncovered "additional points of breach".
On Friday, the company said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update.
Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.
Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update. The outstanding 5% are tokens outside the top ten listed above, and are less liquid in the market and take longer time to source at the required scale.
Once the investigation is complete, we will publish a post-incident report with further details on the incident.
Deposit services remain open and are not affected by the incident.
November 1, 06:00 UTC: Binance announced it has begun reopening withdrawals, starting with $BTC Bitcoin network.
Reviewer note: The 06:00 UTC time is as written in Elliptic's update log, not a time stated by Binance.
Binance is preparing to resume phase one of withdrawals on 2026-11-01 between 06:00 and 09:00 (UTC).
Reviewer note: 06:00 UTC is the start of the window Binance announced, not a time at which withdrawals were confirmed open.
“First batch network now opened in phase one of withdrawals is $BTC bitcoin network,” Binance said on X.
Reviewer note: Binance's own words, quoted on X as reported by Cointelegraph.