Binance Hack: $6.3 Billion Gone, Withdrawals Paused — What It Means for Your Earn Balance

On the evening of 29 October 2026 an attacker emptied Binance hot wallets on ten blockchains. Binance's own estimate of the damage is about $6.3 billion — roughly four times the $1.5 billion taken from Bybit in February 2025, the record until now. Here is what is confirmed, what is not, why we have cut Binance's safety grade from B to C, and what it means if you keep money in Binance Earn.

All times are UTC. The figures are preliminary and come from Binance's own statements and from the on-chain analytics firm TRM Labs; we will update this page as they change.

What is confirmed

• About $6.3B is affected. "The estimated total impact sits at around $6.3B," Binance said in its Security Incident Update on 30 October. TRM Labs, which traced every transfer, counts $6.36B at the price of each asset at the moment it was taken.
• About $3B is frozen. Tether, Circle, Ripple and World Liberty Financial froze stablecoins in the attacker's wallets, and Arbitrum's Security Council froze ETH and ARB. Binance put the verified frozen total at $2.54B at 23:22 on 29 October and at "around $3 billion" at 00:52 on 30 October.
• Binance says it will pay. "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe," the exchange said. Co-founder and co-CEO Yi He: "Binance will cover all hacking losses."
• Deposits work, withdrawals do not. At 04:36 on 30 October Binance said withdrawals "remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours."
• The likely entry point was a laptop. Binance's initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It says it has found "no evidence of any wallet private key leak" and promises a technical post-mortem and an updated Proof of Reserves.

How it unfolded

From TRM Labs' reconstruction of the on-chain record:

• 28 October, morning — the attacker's operator wallet receives three small withdrawals from Tornado Cash; rehearsals on test wallets follow the next day.
• 29 October, 20:05–20:09 — five Binance wallets on the XRP Ledger send 233.46 million XRP to a single address.
• About 20:10 — Binance wallets on Solana and Optimism follow.
• 20:20 — a Binance Bitcoin hot wallet sends 18,270 BTC. On Ethereum, one transaction installs 50 pre-signed EIP-7702 authorizations that turn a well-known Binance hot wallet into a sweeper the attacker controls; three and a half minutes later it sends out 167,464 ETH and 1.615 billion USDT.
• 21:01 and 21:04 — Tether freezes 971.1 million USDT and Circle freezes 823 million USDC in the main receiving wallets.
• 21:29 — Binance's first public statement: it is "aware of reports of a potential security issue".
• 23:05 — a second wave reaches Binance wallets on Avalanche and Polygon.
• 30 October, 02:25 — Binance publishes the $6.3B estimate and the laptop explanation.

Ethereum accounts for about $3.79B of the outflows and Bitcoin for $1.47B; Tron, the XRP Ledger and Solana make up most of the rest. TRM estimates that after the freezes the attacker still holds more than 420,000 ETH and 18,270 BTC — about $2.4B that no issuer can freeze.

How big this is

Among the venues we track, the previous record was Bybit's $1.5B in February 2025. Bitget lost about $387.5M just five weeks ago, on 24 September. Binance's estimate is more than four times Bybit's loss.

Who did it

That is not officially known. TRM Labs attributes the attack "with high confidence" to TraderTraitor, the North Korean unit the FBI blamed for the Bybit hack, pointing to the Tornado Cash funding, the long staging and the pre-signed authorizations executed in one burst. Binance says only that it is working with law enforcement "to confirm the identity of these criminals". As of 30 October no government agency has publicly attributed the attack.

Why we cut Binance from B to C

We grade every venue on five public checks: regulation, proof of reserves, flexible withdrawal, an insurance fund and two years without a hack. Binance passed four until 29 October; it fails the track-record check now. A loss the venue covers still counts as a failure — the same rule that put Bybit at C after February 2025 and moved Bitget from A to B after September. Binance is now C-rated, three checks out of five, and its card shows a "Withdrawals paused" note instead of sign-up links until withdrawals resume. The full method is on our transparency page.

The SAFU fund and the monthly proof of reserves still pass. But the part that is not frozen, about $3.3B, is several times the $1B SAFU figure we list, so most of Binance's promise rests on the company's own money.

What it means for your Binance Earn balance

• Your balance should still be there. Binance says user funds are safe and that it will cover every loss. Nothing published so far suggests customer balances were debited.
• You can't move money off Binance right now. Withdrawals are paused; Binance expects them back within 48 hours of its 30 October update. It has said nothing specific about Simple Earn redemptions — check the app rather than assume either way.
• Don't add new money until withdrawals are back. Deposits work, but anything you send now can't leave until the withdrawal service reopens.
• Expect scams. Binance asks users to "rely only on official Binance channels". Fake "refund" and "verification" links follow every big hack.
• Spread it out. No single venue should hold everything you have in crypto, however big it is.

If you are deciding where to keep stablecoins while Binance sorts this out, here are flexible base rates on A- and B-rated venues where withdrawals work, as of 30 October 2026:

Rates float and change daily; the live numbers are on each venue's page and on the USDT and USDC boards. Bitget was itself hacked on 24 September; it covered the loss and reopened withdrawals in stages, which is why it is B rather than A. One caveat on OKX: its USDC rate is a floating lending rate. It sat at 3.5% all day on 29 October, then from 22:00 UTC that evening hourly rates ran between 5.6% and 19.9%; the 5.79% shown is OKX's average and is unlikely to last.

Two readings

The calm one: "I believe Binance can absorb the loss comfortably," Jeff Ko, chief analyst at ViaBTC, told The Block, adding that the market was already leaning bearish. The worried one: "It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks," Tim Sun, senior researcher at HashKey Group, said, as quoted by France 24. On the day, Bitcoin slid below $77,000 and BNB lost about 7%, according to The Block.

What we're watching

• Whether withdrawals reopen within the 48 hours Binance gave.
• The final loss figure: $6.3B is Binance's preliminary estimate.
• How much of the frozen ~$3B comes back.
• The technical post-mortem and the updated Proof of Reserves.
• Any official attribution.

We will update this article and Binance's card as each of these lands. For how Binance compares with its closest rival on everything else, see Bybit Earn vs Binance Earn.

Sources: Binance, Security Incident Update and service update, and posts on X by co-CEO Yi He, 29–30 October 2026; TRM Labs, North Korea Steals USD 6.36 Billion From Binance, 30 October 2026; The Block; France 24. Not financial advice.