Binance Hack October 2026: Timeline, Losses, Withdrawals, SAFU
The October 29, 2026 Binance hack: about US$6.3 billion affected, withdrawals paused and reopened in stages, SAFU coverage and what users should do now.
In this article
- The hack in five lines
- What can still go wrong
- Who is affected, and how
- The numbers
- Timeline: October 29 to November 8
- How the funds left
- Withdrawals: the pause and the staged restart
- Who covers the loss: SAFU and the corporate treasury
- What to do now if you use Binance
- Common mistakes after the hack
- Who can and cannot use Binance.com
- How the four exchanges compare on security in 2026
- Where things stand
This page collects what is known about the Binance hack of October 29, 2026: the hours, the amounts, the withdrawal pause and who covers the loss. Every figure says where it comes from and whether the source is official or third-party. Data checked on November 8, 2026.
The hack in five lines
- On October 29, 2026, attackers used stolen employee credentials to reach the internal service that signs withdrawals and drained hot wallets on several networks.
- Binance’s official estimate is about US$6.3 billion affected. About US$3 billion was frozen on-chain with partners.
- Withdrawals were paused the same day and reopened in stages from November 1, 2026.
- Binance says its SAFU fund and corporate treasury cover all stolen funds, and that user funds are safe.
- By November 8, media reports cited about 98% of affected assets replenished. Some less liquid assets were still being sourced, and there is no official “100% restored” announcement.
What can still go wrong
- A network that is still closed. Not every coin and network reopened on the same day. Sending an asset over a paused network can leave it stuck in transit.
- Fake “refund” offers. After a large hack, messages promising compensation tend to circulate. The announced coverage is handled by Binance itself; nobody needs to pay a fee or share a password to receive it.
- A moving target. The list of reopened assets changes with each Recovery Update. Information from two days ago can already be out of date.
Who is affected, and how
| Situation | What it means in practice |
|---|---|
| You hold a balance and don’t need to withdraw now | User funds are safe, according to the announcement. There is no technical reason to rush |
| You need to withdraw a specific coin | Check the latest Recovery Update to see whether that coin and network are open before you request it |
| You plan to deposit for the first time | Make sure the deposit network is active; deposits over a paused network may be credited late |
| You live in the EU | Binance has no MiCA licence and, according to third-party reports, stopped new EU services in July 2026; withdrawals were not affected by that change |
| You use another exchange | Third-party reports say Bybit stated it was not affected. The breach was in Binance’s own infrastructure |
The numbers
| Item | Value | Source type |
|---|---|---|
| Amount affected | About US$6.3 billion (third-party: US$6.34 billion) | Official / third-party |
| Frozen on-chain | About US$3 billion (TRM Labs: US$2.85–3 billion) | Official / third-party |
| Networks hit | No official total; forensic estimates say 9 to 10 networks | Third-party |
| Withdrawals paused | October 29, 2026 | Official |
| Restart began | November 1, 2026, 06:00 UTC | Official (Binance on X) |
| Assets replenished | About 98% on November 4 (95% before that) | Media |
| Latest update found | Recovery Update #9, November 6, 2026 | Official |
| SAFU size | About US$1 billion, held in BTC | Official (Binance Academy) |
Timeline: October 29 to November 8
All times are UTC.
| Date and time (UTC) | What happened | Source |
|---|---|---|
| Oct 29, 17:15–19:56 | Attackers log into a software engineer’s computer with credentials stolen from a wallet DevOps engineer, deploy a malicious container and trigger the attack script | Official announcement |
| Oct 29, 20:04–23:56 | Main draining phase, across networks including Ethereum, Bitcoin, Tron, XRP Ledger and Solana | TRM Labs (third-party) |
| Oct 29 | All withdrawals suspended for a security check | Official announcement |
| Oct 30, 02:23 | Security Incident Update: about US$6.3 billion affected, about US$3 billion frozen | Official announcement |
| Nov 1, 06:00–12:36 | First restart wave: 15 networks or assets, all reopened by 12:36 | Binance on X |
| Nov 1, 06:00–15:30 | US$4.649 billion withdrawn and US$1.01 billion deposited; net outflow of about US$3.64 billion | Binance data, via CNBC |
| Nov 3, 04:00 | More assets reopened: 31 on Ethereum and 20 on Solana | crypto.news (third-party) |
| Nov 4 | About 98% of affected assets replenished | Media (third-party) |
| Nov 6 | Recovery Update #9, with more assets reopened | Official announcement |
| Nov 8 | Less liquid assets still being sourced; no “100%” announcement | Binance statement quoted by media |
Binance posts everything on one announcement page that keeps receiving updates. Before any withdrawal, open that page and read the newest entry.
How the funds left
According to Binance, the attackers gained access to the internal withdrawal-signing service, likely through a compromised laptop belonging to a DevOps engineer, and issued unauthorized withdrawal orders. The company says it found no evidence of leaked private keys.
Security firm Safe Security traced part of the on-chain movements. The figures below are theirs, not Binance’s:
| Asset | Outflow from hot wallets (third-party) |
|---|---|
| XRP | 233.46 million XRP, from 5 wallets, between 20:05 and 20:09 UTC |
| BTC | 18,270 BTC |
| SOL | About 970,500 SOL |
| OP | About 44.2 million OP |
Binance has not published a full list of affected wallets or an official count of networks. Any exact “number of networks” is an estimate.
For account holders, the practical point is that the failure was in Binance’s internal processes, not in individual accounts. Changing a password and reviewing 2FA is still good practice, but it does not undo anything about this incident.
Withdrawals: the pause and the staged restart
When did Binance withdrawals come back?
The restart began on November 1, 2026, at 06:00 UTC. The first wave covered 15 networks or assets and finished at 12:36 UTC. On November 3, another 31 Ethereum assets and 20 Solana assets followed. Recovery Update #9 came out on November 6.
Why are some coins taking longer?
Binance said, as quoted by the media, that the remaining assets are less liquid in the market and take longer to source at the required scale. In plain terms, the exchange has to buy back what was taken before it can reopen that withdrawal.
How can you tell if your coin is open?
- Open the official announcement and scroll to the latest Recovery Update.
- Look for both the coin and the network you plan to use; both have to be open.
- On the withdrawal screen, check that the network shows as available before confirming.
- For large amounts, send a small test transfer first.
Withdrawing is not blocked as such; the network you pick has to be open.
Who covers the loss: SAFU and the corporate treasury
The official announcement says Binance will cover all stolen funds related to this incident through the Secure Asset Fund for Users (SAFU) and the corporate treasury. The official statement and third-party reporting agree: the loss sits with the platform, not with users.
| Question | Answer based on the sources |
|---|---|
| Is SAFU big enough on its own? | SAFU holds about US$1 billion in BTC, far below the amount affected; that is why the corporate treasury is also involved |
| How much came from SAFU and how much from the treasury? | Not published. Binance only reports replenishment progress (95%, then 98%) |
| Has the frozen US$3 billion been returned? | Frozen is not the same as recovered. The announcement mentions freezing with partners, with no timeline for return |
| Is there any sign reserves were topped up? | Binance’s proof of reserves showed BTC at 100.04% in the October 31, 2026 snapshot, according to third-party summaries |
A proof-of-reserves ratio above 100% says the reported assets cover user balances in those coins on that date. It does not show the company’s debts or guarantee the future. The guide proof of reserves explained shows how to read that number and compares the protection funds of all four exchanges.
What to do now if you use Binance
- Don’t act out of panic. The company says user funds are safe, and the restart is underway.
- Read the latest Recovery Update before withdrawing or depositing.
- Double-check network and address. A wrong-network transfer is usually irreversible.
- Review account security: 2FA on, a withdrawal address allowlist and an anti-phishing code if you use one.
- Keep records of balances and transactions from this period, in case you need to contact support.
- For long-term holdings, the alternative is a self-custody wallet; the crypto wallet basics guide explains the options.
Common mistakes after the hack
- Reading “98%” as “back to normal”. Binance itself says some assets are still being replenished. Check your specific coin.
- Confusing frozen with recovered. The roughly US$3 billion frozen did not come back automatically; user coverage comes from SAFU and the treasury.
- Clicking a “compensation” link. Any message asking for a password, 2FA code, recovery phrase or a payment to “release a refund” should be treated as a scam. Rely only on the official announcement.
- Sending coins over a paused network. The deposit or withdrawal can get stuck. Check the network list first, then transfer.
- Adding up figures from different sources. Official and third-party numbers differ slightly (US$6.3B vs 6.34B; US$3B vs 2.85B). They are estimates of the same event, not extra losses.
Who can and cannot use Binance.com
| Region | Status (November 8, 2026) |
|---|---|
| United States | Not served. US users are directed to Binance.US, a separate company with a smaller product range |
| Canada | Not served since Binance left in 2023 |
| European Union | No MiCA licence; Binance withdrew its application in Greece in June 2026 and, according to third-party reports, stopped new EU services from July 1, 2026 |
| Restricted list | Also includes the Netherlands, Cuba, North Korea, Iran, Crimea, Donetsk and Luhansk (third-party summaries of the official page; versions differ slightly) |
Readers elsewhere should check Binance’s official list of prohibited countries before opening an account, since the official page could not be read in full when this was checked.
How the four exchanges compare on security in 2026
| Binance | Bitget | Bybit | Gate | |
|---|---|---|---|---|
| Major 2026 incident | Hack on Oct 29, about US$6.3B, covered by SAFU and the company | Hack on Sep 24, about US$350–390M, covered by the protection fund | None found (one in February 2025) | None found |
| User fund | SAFU, about US$1B in BTC | Over US$464M (September 24, 2026) | Derivatives insurance fund; size not published | SAFU; US$500M as of August 8, 2025 (third-party, may be outdated) |
| Proof of reserves (latest found) | BTC 100.04% on Oct 31, 2026 (third-party) | 135% overall, 19 assets (September 2026) | All 50 assets above 100% (Oct 27, 2026, Hacken) | 118.49% overall (September 2026) |
| MiCA (EU) | No licence | No licence yet | Yes, through Bybit EU (third-party) | Yes (Malta), though its restricted-locations page still lists some EU countries |
| With the Satovela code | 10% fee rebate + new-user rewards | 20% off trading fees | No code yet | 20% off trading fees |
Data checked on November 8, 2026; the official pages always prevail. The exchange comparison page has the full table, and the Bitget review covers the September hack in detail.
Where things stand
The October 29, 2026 hack was large, but Binance’s response so far has followed a verifiable pattern: a pause, an announcement the next day, a staged restart and coverage announced through SAFU and the treasury. Two things are still missing: an announcement that every asset is back, and a breakdown of how much came from each source.
Anyone deciding to open a Binance account can see how the 10% rebate and new-user rewards work in the Binance referral code guide, and can sign up through the referral link.
FAQ
How much was stolen in the Binance hack?
Binance's official estimate is about US$6.3 billion affected; third-party analysts put it at US$6.34 billion. About US$3 billion was frozen on-chain with partners.
Will Binance users lose money because of the hack?
According to the official announcement, no. Binance says it will cover all stolen funds through its SAFU fund and its corporate treasury.
Are Binance withdrawals working again?
They reopened in stages from November 1, 2026. By November 8, media reports cited about 98% of affected assets replenished, with some less liquid assets still being sourced. There is no official announcement of a full restart.
Were Binance private keys leaked?
Binance says it found no evidence that wallet private keys were leaked. The attackers used stolen employee credentials to reach the internal service that signs withdrawals.
Can US or Canadian residents use Binance.com?
No. Binance.com does not serve residents of the US or Canada. US users are directed to Binance.US, a separate company.
Content is for education only and is not investment advice. Crypto and stocks can lose value. Risk disclaimer · Affiliate disclosure