Yes — this is accurate. Binance, the world’s largest cryptocurrency exchange by trading volume was hit by a major security incident on October 29th 2026 resulting in the theft of approximately $6.3 billion from its hot wallets. It is widely regarded as the largest cryptocurrency theft in history.
What happened
Attackers compromised Binance’s hot wallets (the internet-connected wallets used to process customer withdrawals) and drained funds across roughly 9–10 blockchains including Ethereum, Bitcoin, Tron, Solana and others. Most of the outflows occurred in a short window of about 20–40 minutes starting around 20:05 UTC on October 29th.
Binance’s investigation initially pointed to a compromised DevOps engineer’s laptop that allowed access to a service container used to submit unauthorized withdrawals. Later updates described it as a “complex attack” with additional points of breach (including possible use of Ethereum’s EIP-7702 account-delegation feature). The company has stated it found no evidence of private key leakage.
Response and recovery
- Withdrawals paused : Binance suspended withdrawals while rebuilding and securing its withdrawal service and related addresses. Deposits resumed operating normally relatively quickly.
- User funds protected : Binance has repeatedly confirmed that user funds are safe and that it will cover all losses using its Secure Asset Fund for Users (SAFU) emergency reserve plus company funds. It has set aside more than $6.34 billion, with about $5 billion already held in the exact tokens that were stolen.
- Frozen assets : Roughly $3 billion (mostly stablecoins such as USDT and USDC) has been frozen on-chain through cooperation with issuers (Tether, Circle and others) and partners. The remaining portion (primarily non-freezable assets like BTC and ETH) is still with the attackers or has been moved.
- Timeline for resumption : As of late October 30 updates, Binance was targeting a phased resumption of withdrawals within roughly 34–48 hours (pointing toward around Sunday, November 1) subject to completed security checks. An initial Proof of Reserves snapshot was planned with results expected by Monday, November 2.
Attribution
Blockchain intelligence firms including TRM Labs (with “high confidence”) and Chainalysis have linked the attack to North Korea’s TraderTraitor unit (associated with the Lazarus Group), citing similarities to prior incidents such as the 2025 Bybit hack. Binance itself has not publicly attributed responsibility to any specific party.
The exchange continues to work with law enforcement (including reports of cooperation with the FBI and others), blockchain intelligence firms and industry partners on tracing, freezing and recovery efforts. A full technical post-mortem is expected once the investigation is complete.
This remains a developing situation. For the absolute latest status on withdrawals or reserves, check official Binance announcements directly.