The key point
In the early hours of October 30 (Taipei time), an attacker sent large unauthorized withdrawals out of Binance’s hot wallets. Binance estimates the total impact at about US$6.3 billion. It says about US$3 billion of the stolen coins are frozen on-chain, so the attacker cannot move them. Binance says its SAFU fund (a user-protection fund Binance sets aside) and company funds will cover all losses. As of 02:30 UTC, October 30, 2026 (10:30 Taipei), withdrawals and deposits are still paused, with no restart time.
How Binance is fixing it: current status
| Item | Status as of 02:30 UTC, Oct 30 (10:30 Taipei) |
|---|---|
| Who covers user losses | SAFU fund plus company funds will cover all losses (announcement at 02:23 UTC, 10:23 Taipei) |
| SAFU fund | Will be used |
| Total loss | Binance estimates the total impact at about US$6.3 billion. This is not the final loss. The figure after frozen and recovered funds are subtracted has not been published |
| Frozen | About US$3 billion of the stolen coins are frozen on-chain. For example, Tether and Circle locked the USDT and USDC in the attacker’s addresses, so the attacker cannot move them |
| Withdrawals | Paused, no restart time |
| Deposits | Paused, no restart time |
| Binance Alpha trading | Paused, no restart time |
| Authorizations on affected addresses | Revoked |
| Proof of Reserves (PoR) | An updated version will be published after the fix is complete |
| Incident report | The initial investigation points to a compromised DevOps engineer’s laptop. The full technical report is still to come |
| Tracing the funds | Working with law enforcement and blockchain intelligence partners |
This table is updated whenever Binance makes a new move.
What happened
Times are in UTC, with Taipei time in brackets. A hot wallet is an exchange wallet that stays connected to the internet so deposits and withdrawals can happen at any time.
| Time | Event |
|---|---|
| About 20:24 UTC, Oct 29 (about 04:24 Taipei, Oct 30) | Large outflows begin from Binance hot wallets on several chains, including Ethereum, Arbitrum and Avalanche |
| 21:15 UTC, Oct 29 (05:15 Taipei, Oct 30) | CZ posts: “User funds are safe! It does look like a hack on Binance.” |
| 22:15 UTC, Oct 29 (06:15 Taipei, Oct 30) | Binance pauses withdrawals |
| 00:13 UTC, Oct 30 (08:13 Taipei) | Binance officially says it will cover all losses, and pauses deposits too |
| 00:52 UTC (08:52 Taipei) | Binance updates the frozen total to about US$3 billion |
| 02:23 UTC (10:23 Taipei) | Binance publishes an incident update: total impact estimated at about US$6.3 billion, SAFU fund and company funds to cover all losses |
How the theft happened: Binance’s initial investigation and Blockaid’s analysis
Binance’s announcement at 02:23 UTC (10:23 Taipei) says its initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which let an attacker get into a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of any wallet private key leak. The full technical report will come after the investigation is complete.
“Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.”
The security firm Blockaid saw on-chain that the attacker used EIP-7702, an authorization mechanism, to send 50 authorizations at once, and only 1 of them hit. That turned a hot wallet into a contract that sweeps the funds out. This is Blockaid’s analysis. Binance has not confirmed it. Binance says it has revoked the authorizations on the affected addresses.
I have a Binance account. What should I do?
This section lists factual safety practice only. It is not buy or sell advice.
- Withdrawals, deposits, and Binance Alpha trading are all paused. Check Binance’s official announcements for the restart time.
- Follow announcements only from Binance’s official accounts, such as @binance on X.
- Binance says it will publish an updated Proof of Reserves (PoR) after the fix is complete.
- Ignore anyone who messages you offering to “unfreeze” your funds or “help with a withdrawal.” Never give a verification code or seed phrase to anyone.
- Phishing sites and fake support accounts increase during incidents like this. Check the URL before you click a link.
Penchan’s summary
Here is where Binance’s fix stands. It estimates the total impact at about US$6.3 billion and says about US$3 billion of the stolen coins are frozen. It says its SAFU fund and company funds will cover all losses. In 2019, when 7,000 BTC were stolen from Binance’s BTC hot wallet, Binance also covered the loss from its SAFU fund, and withdrawals resumed about a week later.
Four things are still unknown: the final loss after frozen and recovered funds are subtracted, when withdrawals and deposits will resume, when Binance Alpha will resume, and what the full technical report says. I will update the status table above as Binance posts new announcements.
Further reading
Disclosure: this site’s card comparison pages contain Binance referral links. This article contains no referral links. This article is current as of 02:30 UTC, October 30, 2026 (10:30 Taipei). The situation is still developing, and the content may be out of date.