Binance reported a hack in which approximately $6.3 billion in assets were drained from addresses associated with the exchange. This is a preliminary estimate of the incident’s scale, not the final amount of customer losses.
On October 30, 2026, the company stated that, together with its partners, it had frozen approximately $3 billion, suspended withdrawals, and would cover the losses using funds from the SAFU user protection reserve and its own capital. The exchange links the possible start of the attack to the hacking of an engineer’s work laptop, but has not yet determined the exact cause.
The main concern for users right now is not to speculate on who is to blame, but to understand what happened to their accounts and when withdrawals will resume. According to a Binance update posted at 7:36 a.m. Moscow Time on October 30 on its official X account, deposits are working again, while withdrawals remain paused while security is being reviewed. The company expects to resume withdrawals within 48 hours, but the exact date should be checked in the official app and on the exchange’s announcements: this is an estimate, not a guarantee.
The most important thing right now is not to panic and not to make hasty decisions. Mass withdrawals, attempts to circumvent restrictions, and clicking on suspicious links can create more problems than the situation itself. If your assets are on Binance, that doesn’t mean they’re lost. It’s important to calmly assess the situation, check the status of your transactions, and ensure your account is secure. Below is a practical checklist: what you can check and do right now, where to turn if problems arise, and what steps will help minimize risks.
What Users Should Do Right Now
* If you need to exchange cryptocurrency, you don’t have to use a centralized exchange or a P2P platform. An alternative option is crypto exchange services, through which you can exchange digital assets for rubles or another currency. But here, too, it’s important to follow security measures: verify the service’s domain, the exchange terms, refund policies, and the recipient’s payment details. We’ve previously covered this topic and prepared a checklist for verifying crypto exchange services and instructions for exchanging cryptocurrency online. You should be especially careful when choosing a service during major market events, when scammers may take advantage of the frenzy and offer exchanges on suspiciously favorable terms. Rushing into such transactions is rarely a good idea.
What is known about the Binance hack
In an official statement dated October 30, Binance described unauthorized withdrawal transactions. The company’s preliminary assessment is that an attacker may have gained access to a DevOps engineer’s work laptop, then to a service container, and used it to send transactions that were not authorized by the system owner. This is still the version from the early hours of the investigation. Binance later reported that it is investigating other potential points of compromise; it is too early to attribute the entire attack to a single device.
The exchange’s statement includes an important caveat: “We have found no evidence of any wallet private key leak”—the company has not yet found evidence of a leak of wallet private keys. This wording does not equate to a statement that the keys were definitely not compromised: the investigation is ongoing. Binance promises to release a technical analysis after verifying the facts and to update its reserve verification once recovery efforts are complete.
October 30, 5:25 a.m. Moscow Time: The exchange disclosed preliminary details about the attack and noted that the investigation is ongoing.
The independent firm TRM Labs tracked transfers from addresses it attributes to Binance across ten blockchains. According to its calculations, the bulk of the funds was moved in approximately 20 minutes on the evening of October 29, UTC time. This estimate is based on public transactions; only the exchange’s own investigation can confirm the full path of access to its internal systems. Therefore, the observed movement of funds and the explanation of exactly how the attacker was able to initiate it should be considered separately.
How Events Unfolded
- October 29, around 11:05 p.m. Moscow time.
- TRM Labs detected the start of a large wave of transfers from Binance addresses. Analysts indicate 20:05 UTC.
- October 30, 4:36 a.m. Moscow time.
- Binance announced a temporary suspension of deposits and withdrawals and promised to cover the losses.
- October 30, 5:25 a.m. Moscow time.
October 30, 07:36 Moscow Time: Binance reported that deposits are active and withdrawals are paused.
These times represent when the announcements were published and when tracked transactions began; the transactions themselves may have occurred between updates. The status of transactions and the amount of frozen assets may change as new addresses are verified. If you see different figures between updates, compare the publication time and what exactly is being counted: all affected assets, confirmed withdrawals, or the portion already frozen.
Why the $6.3 billion figure does not represent the same final loss
Binance’s estimate covers the assets affected by the incident. Some of the funds have already been blocked with the involvement of companies and organizations that may restrict the movement of specific tokens or addresses. A freeze does not equate to the return of funds to the exchange’s accounts: this will require further action and verification of asset ownership. Another portion remains under scrutiny by analysts. The final amount that can be recovered is unknown at the time of publication.
In an update at 1:55 p.m. Moscow time on October 30, Binance reported that it had allocated more than $6.34 billion of its own funds to cover the affected assets. According to the exchange, $5 billion of this amount is already in the same tokens in which the losses were incurred; it intends to acquire the missing assets on the market and through over-the-counter transactions. This is a reserve for liabilities, not the amount of stolen funds that have already been recovered. The company accounts for the approximately $3 billion previously frozen separately.
October 30, 1:55 p.m. Moscow Time: Binance reported separately on its own funds to cover losses and on frozen assets.
Therefore, the estimates—“approximately $6.3 billion affected,” “approximately $3 billion frozen,” and “more than $6.34 billion set aside”—cannot be added together or subtracted to arrive at a final tally of losses.
The first figure reflects the preliminary scale of the incident, the second—the announced freezing of a portion of assets, and the third—the exchange’s own funds allocated to cover losses.
Independent analysts may arrive at slightly different figures due to the timing of their assessments and token exchange rates. What matters most to readers is what portion of the funds became inaccessible to the attacker, how much will be returned, and how the exchange will fulfill its promise to its customers.
What About User Funds and the Exchange’s Operations?
Binance states: “User funds are safe.” The company promises to cover losses using the SAFU fund and its own funds. For now, this is a commitment from the exchange, not a published audit report following the attack. It promises to release an updated reserve confirmation and technical report later. The fact that withdrawals have been temporarily suspended does not mean that every customer’s balance has been affected; it means that regular withdrawal transactions cannot be processed until the audits are complete.
In its initial announcements, Binance suspended both deposits and withdrawals. A later update states that deposits are working, while withdrawals remain suspended while security measures for the withdrawal service and associated addresses are being strengthened. If you have already sent a deposit, do not make a duplicate transfer due to interface delays. Save the transaction ID, network, amount, and address, then check the status in your account and contact only official support. MSG explained the verification process for such transfers in an article about transferring USDT between wallets.
The withdrawal suspension also affects users who wanted to send assets to their personal wallets. While the button is unavailable, we cannot promise a workaround or a specific time for service restoration. Once the service resumes operations, please recheck the network and the recipient address in the withdrawal form. The MSG article on non-custodial wallets without KYC explains how self-custody works and where users keep their keys. This guide helps clarify the difference between your own address and your exchange balance, but it is not intended as advice to urgently transfer assets.
Who Was Behind the Attack
Binance has not yet named the identified perpetrator or published a definitive breakdown of the breach. TRM Labs has put forward its own theory based on an analysis of transactions and other data. This is an attribution by a research firm, not the conclusion of a Binance investigation or a court ruling. In this article, we do not present the theory about the perpetrator as a proven fact: it does not alter either the confirmed scale of the withdrawal or the actions currently available to users.
There is also a technical distinction between “hacking the blockchain” and “gaining the ability to conduct transactions through the exchange’s systems.” Based on the available information, it does not appear that the cryptography of Bitcoin, Ethereum, or other networks was compromised. Preliminary data suggests that the issue involves access to infrastructure and withdrawal permissions. The exact list of compromised systems will become clear after the promised technical report is released.
Conclusion and Outlook
Enough is known to confirm a major attack on Binance’s infrastructure and unauthorized transfers. However, it is not yet possible to determine the final extent of the losses, the exact cause, or the perpetrator. The promise to compensate for losses and the freeze on some assets reduce uncertainty for customers; however, it will only be possible to assess the outcome after withdrawals resume, the technical report is published, and new data on reserves is released.
The next verifiable milestone is the resumption of withdrawals following security updates. Binance expects to complete this within 48 hours; a phased verification of individual assets or networks is also possible. This is our forecast based on the company’s announced plan, not a confirmed timeline. The next question is how much of the frozen assets will be recovered and whether an independent audit will confirm the claimed coverage of liabilities. This article will be updated as official data becomes available.
This material is for informational purposes only and does not constitute financial advice. Information regarding the progress of the investigation and the availability of transactions is current as of October 30, 2026, at 3:20 p.m. Moscow Standard Time.
