Binance Hack: $6.3B Impact and What Users Should Know

Binance has confirmed a security incident. On 29 October 2026 an attacker submitted unauthorized withdrawals from Binance hot wallets. Binance puts the total impact at about $6.3 billion, says around $3 billion has been frozen, and says it will cover all losses from its SAFU fund and company funds.^[1]^[2] Withdrawals are paused; deposits work.^[3] This post sets out what Binance and the blockchain confirm, and what it means for anyone who may later receive these funds. Updated 30 October 2026, 09:00 UTC.

What Binance has said

All times are UTC, 30 October 2026, from Binance's official X account:

Time	What Binance said
00:52	The verified total frozen is around $3 billion.^[4]
01:36	Binance will cover all losses. Deposits and withdrawals were suspended while it runs security checks, freezes funds and works with law enforcement.^[5]
about 02:25 (last edit)	The incident may involve a compromised DevOps engineer's laptop. That let an attacker reach a service container and submit unauthorized withdrawals. Binance found no evidence that wallet private keys leaked. Estimated total impact: about $6.3 billion.^[1]
04:36	Deposits work as normal. Withdrawals stay paused during a security overhaul of the withdrawal service; Binance expects to resume within 48 hours.^[3]
08:47	The laptop was not the only problem: Binance found "additional points of breach". Outflows stopped when withdrawals were paused. Withdrawals are on track to resume in about 45 hours.^[2]

Binance says it will publish a full technical post-mortem and an updated Proof of Reserves when the work is done.^[1] It has not named the attacker.

Changpeng Zhao, Binance's founder, wrote at 21:15 UTC on 29 October that it "does look like a hack". He thanked Tether for freezing about $971 million and Circle for about $823 million. He no longer manages Binance.^[6]

What the blockchain shows

We checked the main Ethereum transactions ourselves.

20:24 UTC, 29 October. An outside address, 0x7C8601d4645b93cea45F71e118A729332e6B5CA0, called a sweep function on the wallet Etherscan labels "Binance 14" (0x28C6c06298d514Db089934071355E5743bf21d60). About 167,464 ETH, about 1.615 billion USDT and 62 other tokens moved to 0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c.^[7]

20:41 UTC. The same outside address moved 780 million USDC from "Binance: Hot Wallet 34" to the same receiving address.^[8]

Next. The receiving address sent about 195,460 ETH on to 0x8532FA14ACAf483729C449b8458aedDb900543D4. Etherscan now labels the receiving address "Binance Hot Wallet Exploiter 2" and warns that it is linked to the Binance hot wallet exploit.^[9]

These Ethereum transfers add up to about $3.3 billion. Binance's $6.3 billion figure covers the whole incident; it has not published a breakdown by blockchain.

What is frozen

On 30 October we queried the USDT and USDC contracts directly. Both report the receiving address 0x5227…CB2f8c as blacklisted, so the roughly 1.17 billion USDT and 823 million USDC still on it cannot move.^[10]^[11] The two contracts also report the Binance 14 wallet as blacklisted, and USDC reports the same for Hot Wallet 34. Neither issuer has explained these entries. The address that sent the 195,460 ETH on is not frozen: ETH has no issuer that can freeze it.

This is why Binance can say "around $3 billion" is frozen while the impact is about $6.3 billion. Stablecoins can be frozen by their issuer.^[12]^[13] Native coins such as ETH and BTC cannot.

Why this matters to ordinary users

The unfrozen part, roughly half by Binance's own figures, will move. After the 2025 Bybit hack the FBI said the thieves quickly converted part of the funds and spread them across thousands of addresses on several blockchains. It asked exchanges, bridges and analytics firms to block transactions with, or derived from, the listed addresses.^[14] We cover that case in The Bybit Hack: How the Stolen Funds Were Laundered.

Coins from this incident can reach you weeks from now, from a P2P buyer or a small exchange, many hops away from the theft. AML checkers mark such funds as stolen funds, and exchanges may hold a deposit while they review it.

What to do

Follow only Binance's official channels. Binance itself asks users to rely on them.^[5] Ignore screenshots of "statements" and "compensation forms" from strangers.
Wait for withdrawals to reopen. Binance expects about 45 hours from 08:47 UTC on 30 October.^[2] No one can get your funds out earlier for a fee.
Check large incoming payments before you accept them, especially ETH, BTC and stablecoins in the coming weeks. See how to check USDT before you receive it.
Ignore anyone who offers to "recover" funds. The FBI says private recovery companies cannot issue seizure orders, and law enforcement does not charge victims.^[15]
Never give a seed phrase or connect your wallet to a site that offers to check whether you are "affected". A real AML check needs only a public address. See fake AML checkers, and compare real ones in our service ranking.

We track this and other major incidents, with flagged addresses, in our hacks and freezes tracker.

General information, not legal or financial advice. Rules differ by country and change; check the linked sources.