Binance Hack October 2026: Withdrawals, $3B Frozen & SAFU

Binance says a security incident on October 29 affected approximately $6.3 billion in crypto, with about $3 billion frozen and withdrawals still paused. A subsequent company-authored update says deposits are operating normally. Binance has pledged to cover losses using its SAFU reserve and company funds, but frozen assets are not necessarily recovered assets, and completed customer reimbursements have not been verified.

Published: October 30, 2026
Research cutoff: October 30, 2026, 09:22 UTC
Reporting note: All figures and service statuses below are historical snapshots. This article covers Binance.com; services at separately operated regional platforms may differ.

Binance withdrawal and deposit status: What customers need to know

Here is the status I can establish from the official information available at the research cutoff.

Service	Latest reported position	What remains uncertain
Crypto withdrawals	Paused while Binance updates security controls	No independently verified service-restoration notice
Crypto deposits	Binance says operating normally in a subsequent update	Earlier support notice said deposits were suspended; live transaction processing was not independently tested
Spot trading	No incident-wide trading status confirmed in the reviewed official notices	Individual pairs or accounts may have separate restrictions
Futures and derivatives	No comprehensive incident-specific status confirmed	Contract-level restrictions and risk controls require separate verification
Fiat deposits and withdrawals	Not established by the reviewed incident notices	Availability may depend on region, payment provider and service

Official status sources: Binance Security Incident Update and Binance’s subsequent deposit and withdrawal update, published by its verified Binance News account.

There is an important difference between those statements. Binance’s support announcement, dated October 30, says both deposits and withdrawals were temporarily suspended. The subsequent service update says deposits are operating normally while withdrawals remain paused. The exact time of the latter Binance Square publication is not displayed in the accessible page, although reporting places a corresponding update from Binance co-CEO Yi He at approximately 04:17 UTC on October 30.

Binance has also said it expects to begin restoring withdrawal services within 48 hours of that update. I would treat that strictly as a target, not a guaranteed deadline. It does not mean every blockchain, asset, customer or withdrawal method will become available simultaneously.

Until a restoration notice appears and the affected service is confirmed as working, I would not describe Binance withdrawals as reopened.

For account-specific information, use the official Binance Support Center, reached through the verified website or app.

What has Binance actually confirmed about the security incident?

The first thing I want to separate is what Binance has acknowledged from what investigators still need to establish.

In its October 30 security announcement, Binance disclosed:

• An estimated total incident impact of approximately $6.3 billion.
• A preliminary investigative lead involving a potentially compromised DevOps engineer’s laptop.
• Possible unauthorized access to a service container and the submission of unauthorized withdrawal transactions.
• No evidence found so far of wallet private-key leakage.
• Approximately $3 billion in affected assets frozen on-chain with industry partners.
• Temporary service restrictions and revocation of affected address authorization.
• A commitment to cover losses using the Secure Asset Fund for Users (SAFU) and company funds.

Binance says it has engaged law enforcement and blockchain intelligence partners to trace funds. It has also promised a technical post-mortem and updated Proof of Reserves once remediation is completed.

That is a substantial disclosure. It is not a completed independent forensic audit.

In particular, Binance’s statement that user funds are safe should be understood as the company’s assurance and financial commitment, rather than proof that every affected balance is immediately withdrawable.

I consider that distinction essential. Customers need to know not only whether their exchange says it will make them whole, but how the commitment will be implemented and whether normal access has returned.

How the Binance hack unfolded: The October 29–30 timeline

Independent blockchain researchers describe an unusually fast, multi-chain sequence.

According to TRM Labs’ October 29 investigation, preparation may have begun at least 36 hours before the main unauthorized transfers. TRM links early operator-wallet activity and on-chain contract preparation to October 28, although that does not independently establish when or how an employee workstation may have been compromised.

The most useful verified and reported milestones are:

Date and time (UTC)	Development
October 28 onward	TRM identifies preliminary on-chain preparation associated with the suspected attacker
October 29, approximately 20:04–20:05	First major unauthorized transfers begin, according to Bitquery and TRM
October 29, approximately 20:20–20:24	Major Bitcoin, Tron and Ethereum transfers occur
October 29, 20:57–21:25	Bitquery records issuer restrictions, including Tether and Circle freezes, followed by Tether’s public disclosure
October 29, later evening	Binance publicly investigates the security issue and restricts withdrawal services
October 29, 23:56	Bitquery records the last transfer in its reconstructed incident window
October 30, early hours	Additional restrictions and asset tracing continue
October 30	Binance publishes preliminary technical findings, its approximately $6.3 billion impact estimate and approximately $3 billion frozen figure
October 30, approximately 04:17	Binance co-CEO Yi He reportedly updates customers that deposits are operational and withdrawals are expected to begin resuming within 48 hours

The transaction times come primarily from Bitquery’s on-chain investigation. The later service-update time is reported by FinanceFeeds and is consistent with the content carried by Binance’s verified news account.

One detail worth preserving: TRM counts activity across ten blockchains, while Bitquery’s investigation describes nine chains. Their datasets and classification methods have not yet been reconciled. I would not pretend those independent investigations are identical simply because they reach similar overall dollar estimates.

Where the billions stand: Affected, frozen and actually recovered

This is the part of the Binance incident that deserves the most careful reading.

The estimated amount affected, the amount successfully immobilized, and the amount returned to Binance or its customers are three different financial measurements.

Binance hack financial breakdown

Measure	Reported amount	Source and cutoff	What it means
Binance’s estimated total impact	Approximately $6.3 billion	Binance, October 30	Company’s preliminary aggregate estimate
TRM’s estimated gross unauthorized outflows	Approximately $6.36 billion	TRM, transfers valued at theft-time prices; analysis through October 30, 00:30 UTC	Investigator’s traced transfer valuation
Chainalysis’ earlier confirmed amount	At least $5.912 billion	Chainalysis, 00:30 UTC October 30, quoted by Reuters	Earlier investigator-confirmed minimum
Binance’s frozen-assets estimate	Approximately $3 billion	Binance, October 30	Company-reported on-chain immobilization
TRM’s frozen-assets estimate	Approximately $2.7 billion	TRM’s October 30 analysis	Researcher’s narrower independently reported freeze calculation
Assets demonstrably returned to Binance	Not established	Reviewed sources through 09:22 UTC	No verified aggregate return amount
Customer compensation already paid	Not established	Reviewed sources through 09:22 UTC	No verified completed reimbursement total
Final net financial loss	Not established	Investigation ongoing	Requires reconciled accounting, recovery and valuation

Source: Binance · TRM Labs · Reuters

Why do some reports say $5 billion, $5.9 billion or $6.36 billion?

Early reporting was based on incomplete wallet identification, changing token valuations and transfers observed across different chains.

For example, the earlier roughly $5 billion to $5.8 billion figures appeared while researchers were still identifying suspicious outflows. Chainalysis subsequently reported confirming at least $5.912 billion at a specific cutoff. TRM’s larger $6.36 billion calculation values identified unauthorized transfers at their individual theft-time prices.

Those figures are not necessarily mutually exclusive, but they are not interchangeable either.

A complete reconciliation needs the token quantities, chains, identified source wallets, valuation timestamps and treatment of later swaps. Otherwise, there is a real risk of counting one stolen asset more than once as it moves between addresses or changes form.

I would use Binance’s approximately $6.3 billion estimate as the headline company figure, while clearly attributing TRM’s $6.36 billion calculation to its investigation.

How much did Tether, Circle and other partners freeze?

Two of the most important early responses came from stablecoin issuers:

• Tether: CEO Paolo Ardoino reported freezing more than 1.567 billion USDT associated with the incident.
• Circle: CEO Jeremy Allaire reported freezing more than 800 million USDC in coordination with law enforcement. On-chain investigators have cited approximately 823 million USDC.

Together, these figures suggest approximately $2.39 billion of issuer-related restrictions at the reported snapshots.

But they are components of the broader freeze response, not additional funds to add to Binance’s $3 billion figure.

Reuters’ incident reporting also describes intervention involving Ripple and World Liberty Financial. TRM places issuer freezes at approximately $2.67 billion, with further network-level action involving Arbitrum.

According to TRM, Arbitrum’s Security Council restricted approximately 8,426 ETH and 74.6 million ARB associated with the incident. The dollar valuation of these assets changes with market prices.

Different freeze totals may therefore reflect different cutoffs, definitions and sets of restricted assets.

The exact current aggregate still needs a reconciled, asset-by-asset inventory.

Frozen crypto is not the same as recovered crypto

Here is the distinction I would focus on most.

When an issuer restricts its stablecoin tokens, it may stop particular addresses from moving those tokens. That can prevent further transfers and preserve the possibility of a later resolution.

It does not necessarily reverse the unauthorized transfer.

It does not automatically return the tokens to Binance.

And it does not prove the exchange has recovered usable assets or reimbursed customers.

Native assets such as BTC work differently. Bitcoin does not have a centralized token issuer capable of placing a contract-level freeze on native BTC. But Bitcoin can still be restricted by a custodian that controls it or seized through lawful processes when authorities gain control of the relevant keys or custody.

Nor does moving Bitcoin into multiple addresses make it irretrievable by definition. Such movement can complicate tracing and enforcement, but a split across wallets does not by itself establish that laundering succeeded.

I would therefore avoid headlines claiming “$3 billion recovered” unless there is documentary evidence of actual recovery into verified control.

That evidence has not been established in the material reviewed for this article.

Readers interested in understanding these traces can explore the on-chain analytics tools and blockchain explorers listed by Cryptolinks. These resources help explain observable transactions, but public wallet movements alone do not prove legal ownership or final recovery.

Will Binance cover customer losses? What SAFU actually means

Binance’s response includes an unusually consequential promise: it says it will cover losses from both its SAFU fund and company funds.

This matters because the estimated security incident is substantially larger than the fund’s recently published target value.

What is Binance SAFU?

The Secure Asset Fund for Users was introduced in 2018 as an emergency reserve intended to help protect customer assets during exceptional incidents.

In its SAFU explanation updated October 13, 2026, Binance describes a reserve valued at approximately $1 billion, held entirely in Bitcoin following a conversion completed earlier in 2026.

Binance says the fund is managed by Nest Clearing and Custody Limited, an entity regulated in the Abu Dhabi Global Market, and that a portion serves regulatory capital-reserve purposes. The value of the Bitcoin holdings can fluctuate.

That published valuation is useful context, but it is not an independently verified October 30 liquidity statement.

The fund is not the same thing as government-backed bank deposit insurance. Nor should it be described as an independent insurance policy automatically paying customers when a specified event occurs.

Is the SAFU fund large enough to cover the hack?

SAFU alone is not being presented as the entire solution.

Binance has specifically committed to using its own company funds as well. That distinction should not be lost in headlines that simply say the exchange has a SAFU reserve.

But I would still want independent evidence about available resources, liquidity, the treatment of immobilized assets, and the effect of any additional obligations.

A company saying it intends to cover losses is different from demonstrating that every related obligation has been fully funded and settled.

When will Binance reimburse affected customers?

At the research cutoff, I could not establish an official incident-specific compensation schedule or completed payment total from the reviewed disclosures.

The publicly reviewed information also does not establish:

• A final list of affected products or eligible customers.
• Detailed exclusions or rules for calculating each user’s loss.
• Whether reimbursement will be in the original cryptocurrency or another asset.
• A verified claims-submission procedure or compensation address.
• A payment timetable.

The phrase “all losses” should not automatically be extended to unrelated trading losses, market-price declines, futures liquidations, missed opportunities or third-party phishing scams.

Those questions require explicit terms from Binance.

My reading: The SAFU and company-funds commitment is important, but proof of coverage will come through its implementation—not the promise alone.

What about Binance Proof of Reserves?

Binance says it will publish an updated Proof of Reserves after remediation.

That publication could help customers examine the backing of specified assets and how balances changed following the incident.

It would not, by itself, be equivalent to a comprehensive audit of every company asset, debt, operating obligation, customer liability and source of immediately available liquidity.

I would want the new snapshot to identify its accounting date, covered assets, liabilities and methodology, with clear explanations of how the incident affected customer backing and how any gaps were addressed.

How could the attacker withdraw funds without a confirmed private-key leak?

Binance’s preliminary explanation points to a potentially compromised engineer’s laptop and access to an operational service container.

That is not the same allegation as an attacker stealing every affected wallet’s private keys.

A centralized exchange operates several interconnected layers. A workstation or service could be used to request transactions, a withdrawal system might authorize them, and separate signing infrastructure could eventually execute them on a blockchain.

In principle, an attacker who gains sufficient control over a trusted authorization path may be able to induce unauthorized transactions without visibly exporting the signing keys.

That does not prove which controls failed here. It explains why the two statements—unauthorized withdrawals and no detected private-key leakage—are not inherently contradictory.

Why investigators are discussing Ethereum’s EIP-7702

TRM’s technical report describes an Ethereum-specific mechanism involving EIP-7702 authorizations.

EIP-7702 allows certain Ethereum accounts to delegate execution behavior to smart-contract code. TRM says the attacker used pre-signed authorizations associated with a Binance hot wallet, enabling unauthorized contract-controlled movements.

That observation supports further investigation of how those authorizations were produced and approved.

It does not, on its own, establish that Ethereum’s protocol was broken.

TRM also reports ordinary signed withdrawals on other chains. The Ethereum execution path should not be casually presented as the explanation for every asset moved.

The important unresolved questions include how the workstation was compromised, what the service container could access, which approvals the attacker controlled, whether signing policies were bypassed, and what protections have since been independently validated.

A detailed post-mortem will be needed to answer those questions responsibly.

For general context on custody, signing and account protection, I maintain a directory of blockchain security resources. The present incident is also a reminder that securing customer logins and securing an exchange’s internal withdrawal infrastructure are different security challenges.

Was North Korea behind the Binance hack?

There is a serious investigative attribution, but I would not describe the perpetrator’s identity as officially established.

TRM Labs attributes the attack to TraderTraitor, which it identifies as a North Korean hacking unit. TRM characterizes that judgment as high confidence and says it uses a combination of on-chain and off-chain intelligence.

Its published discussion points to attack preparation, patterns resembling previous incidents and other investigative indicators.

The Associated Press separately reported that Chainalysis also considered TraderTraitor the likely perpetrator.

That is more substantial than an anonymous social-media accusation.

Nevertheless, publicly reported investigative judgments are not the same as a law-enforcement finding naming those responsible for this particular Binance incident.

The FBI previously attributed the February 2025 Bybit theft to North Korea’s TraderTraitor activity. That earlier attribution provides relevant context, but it should not be mistaken for an FBI confirmation of the October 2026 Binance attack.

Binance itself says it is working with law enforcement to identify the criminals.

For now, I would write that blockchain investigators attribute the attack to North Korea-linked TraderTraitor, with the company’s own investigation still continuing.

What should Binance customers do now?

The operational restrictions may be frustrating, particularly for anyone who needs to move funds. But I would not treat every alarming message, withdrawal rumor or compensation offer as genuine.

These are the practical precautions I would prioritize:

1. Check the verified Binance website or app. Use the official announcement and the Support Center. Check the status of the specific asset, network and service you intend to use.
2. Do not send a test deposit while its support is uncertain. An announcement that deposits are operational does not independently establish normal processing for every route or regional product.
3. Never pay an unlocking or recovery fee. A message demanding a crypto transfer to release a withdrawal, restore a balance or access SAFU compensation should be treated as suspicious.
4. Protect your credentials. Do not disclose passwords, two-factor authentication codes, wallet recovery phrases or private keys to anyone claiming to represent support.
5. Preserve your records. If you have an account-specific issue, retain the transaction ID, asset, network, relevant timestamps, case number and official support correspondence. Avoid publicly exposing sensitive account information.

Cryptolinks maintains a crypto scam and suspicious-site directory that can help readers recognize common warning signs.

For longer-term custody decisions, the best crypto exchanges comparison, Binance exchange review, and non-custodial wallet resources provide useful starting points. Those are general educational resources; they are not confirmations of any platform’s current operational status.

I would not recommend a rushed mass withdrawal or redeposit strategy based solely on this developing incident. The appropriate decision depends on verified service access, individual exposure and custody needs.

How Bitcoin, Ethereum and BNB reacted

Cryptocurrency markets weakened as news of the incident circulated, although the full relationship between the incident and broader price movements cannot be isolated from the available data.

A Cointelegraph live report recorded the following historical snapshot for October 30 at approximately 01:19 UTC:

Asset	Price at reported snapshot	Reported 24-hour change
Bitcoin (BTC)	Approximately $76,937	-4.9%
Ethereum (ETH)	Approximately $2,211	-5.7%
BNB	Approximately $693	-8.0%

These are historical rolling 24-hour figures, not live prices, and the measurement window begins before the incident’s disclosure. The entire decline should not automatically be attributed to the attack.

Did the Binance hack trigger $1.5 billion in crypto liquidations?

CoinDesk reported on October 30 at 02:22 a.m. EDT (06:22 UTC) that CoinGlass data showed approximately $1.53 billion in market-wide leveraged crypto liquidations over the preceding 24 hours.

Of that amount, approximately $1.29 billion represented long positions. CoinDesk reported roughly $754.6 million in liquidations on Binance, with other venues contributing to the broader total.

That is a derivatives-market measurement, not the value of additional cryptocurrency stolen from Binance.

It also does not establish that every liquidation was caused by the hack, nor that Binance’s reimbursement commitment covers those positions.

For readers unfamiliar with leverage, a sharp adverse price move can force an exchange to close a leveraged position when its available margin becomes insufficient. That can amplify volatility even without a new theft of the underlying assets.

The difference between a security loss and a leveraged trading loss is worth understanding. Cryptolinks has further material on crypto derivatives platforms and an earlier Bitcoin liquidation analysis.

Four statements that sound more conclusive than they are

Statement	What it establishes	What it does not establish
“$3 billion frozen”	Binance reports that substantial affected assets have been immobilized	That $3 billion has been recovered and returned
“All losses will be covered”	Binance has made a company-level commitment involving SAFU and its own resources	That claims have been settled or all terms independently verified
“No evidence of private-key leakage”	Binance says its investigation has not found such evidence	That all operational authorizations and signing controls remained secure
“Deposits are normal; withdrawals will resume”	Binance has published an updated service position and estimated restoration window	That every transaction method works or that reopening is guaranteed by a deadline

This is the framework I would use to judge the next announcements.

Binance hack FAQ

Is Binance still hacked?

Binance has confirmed a security incident and says it has revoked affected authorization and begun remediation. The publicly reviewed evidence does not establish that every root cause has been resolved or that a comprehensive independent security review has been completed.

Are Binance withdrawals working again?

At the October 30, 09:22 UTC research cutoff, the latest verified company-authored service update still described withdrawals as paused. Check the official service status for any later change.

Can I deposit crypto to Binance?

Binance’s subsequent October 30 update says deposits are operating normally, despite its earlier notice describing a suspension. That is the company’s reported position, not an independently tested guarantee for every asset or network.

How much crypto has Binance recovered?

No verified aggregate amount of assets actually returned to Binance or reimbursed to customers was established in the reviewed material. Approximately $3 billion was reported frozen, which is a different measurement.

Will Binance pay back affected customers?

Binance says it will cover losses through SAFU and company funds. Detailed eligibility terms, reimbursement methods, completed payouts and timelines still require verification.

Who hacked Binance?

TRM Labs and Chainalysis link the attack to North Korea-associated TraderTraitor activity. At this cutoff, the reviewed material does not establish a final public law-enforcement attribution for this particular incident.

Is Binance SAFU an insurance policy?

SAFU is an exchange-established emergency reserve, not government-backed deposit insurance. Binance says company resources will also be used for this incident.

When will Binance withdrawals resume?

Binance has given an estimated 48-hour window to begin resuming services, attributed to its October 30 update. That is a forecast, not a guaranteed completion time. The official reopening status is more important than any countdown.

What I would watch next

There are six developments that would meaningfully change my assessment.

First, verified service restoration. Binance needs to publish clear updates showing which deposit and withdrawal routes have resumed, whether restrictions remain and whether normal processing is stable.

Second, reconciled asset accounting. I want a transparent inventory of unauthorized outflows, affected tokens, restricted assets and any asset movements occurring after the initial transfers.

Third, documented recovery. Actual recovery should be supported by evidence of returned control, successful reissuance where applicable, or legally documented transfers—not merely another large freeze announcement.

Fourth, coverage implementation. Binance should explain how customer compensation works, what is covered, when obligations will be settled and which resources have been allocated.

Fifth, the technical post-mortem. The company needs to clarify the initial entry point, authorization failures, signing controls, affected systems and remediation testing.

Sixth, updated independent attribution. Investigative assessments may become stronger or weaker as more evidence emerges. Any new official law-enforcement finding should be distinguished from private-sector analysis.

My conclusion: The next numbers matter more than the headline

The Binance security incident is already significant by any reasonable measure. Binance estimates approximately $6.3 billion in impact, independent researchers report extensive multi-chain unauthorized transfers, and the exchange says about $3 billion in affected assets has been frozen.

Yet the biggest customer questions are still open.

When will normal withdrawals be restored? How much of the frozen crypto will actually be recovered? How will Binance fund and carry out compensation? And what failure allowed this incident to happen?

For me, those are the questions that deserve more attention than the race to call this the largest crypto hack in history.

I will judge the response by documented restoration, transparent accounting, meaningful recovery evidence and completed customer protection—not assurances alone.

For continuing coverage and practical cryptocurrency research, visit Cryptolinks and its crypto news archive.

Editorial disclosure: This article is for news and educational purposes, not individualized financial advice. Binance’s statements are attributed to the company, and the investigative findings are attributed to their respective researchers. Internal Cryptolinks links are informational references; readers should check the site’s applicable affiliate disclosures.

Research methodology: Company notices and verified company-authored service updates were prioritized for operational status. TRM Labs and Bitquery were used for independently reported blockchain analysis, with Reuters, Associated Press, Cointelegraph and CoinDesk providing additional reporting. Direct inspection of all underlying blockchain transactions, customer account access, full company financial records, and completed reimbursements was not performed. Figures and reported statuses may change after October 30, 2026, 09:22 UTC.