Binance hack: $6.3bn stolen, are your funds safe?

On 29 October 2026, according to Binance itself, about $6.3 billion in crypto was taken from its wallets, the biggest theft in crypto to date. Binance says customer balances are safe and that all losses will be covered, but withdrawals were still paused at the time of writing. The hack has not been confirmed by any regulator; the amounts and the culprit come from Binance itself and from analytics firms.

The Binance hack in short

• Amount: Binance puts the damage at about $6.3 billion. Chainalysis arrives at about $5.9 billion, TRM Labs at about $6.36 billion. The figures differ by source and by time of counting.
• When: Thursday 29 October 2026. According to TRM Labs, most of it disappeared within about 20 minutes, spread across ten blockchains.
• Withdrawals: Binance has halted withdrawals until the security issue is resolved. According to a report by IBTimes, deposits were not affected.
• Your balance: Binance says it will reimburse all losses from the SAFU fund and its own resources, and that user funds are safe. That is a pledge from the company, not a guarantee from a regulator.
• Frozen: about $3 billion, according to Binance. Tether chief executive Ardoino says Tether froze more than $1.57 billion in USDT; Circle chief executive Allaire cites more than $800 million in USDC.
• Culprit: TRM Labs and Chainalysis point to TraderTraitor, the North Korean hacking group. Binance itself has not named anyone.
• Cause (provisional): a compromised laptop belonging to a DevOps employee. Binance found no sign of a leaked private key.

What happened, according to the sources

The first reports on 29 October came from onchain data: large amounts disappearing from wallets linked to Binance. An initial count by Decrypt came to at least $5.57 billion, of which $3.51 billion on Ethereum, $1.44 billion (18,270 BTC) on Bitcoin and $630 million on Tron. That was an interim figure; the total was later estimated higher.

Binance at first said only that it was investigating a possible security issue. An update followed on 30 October: an initial investigation points to a compromised laptop belonging to a DevOps employee, which gave an attacker access to a service container and let them submit unauthorised withdrawals. A full technical report will follow later.

TRM Labs describes the preparation: at least a day and a half, with a wallet funded through small Tornado Cash withdrawals and code that was first tested on other wallets. On Ethereum, according to TRM, the attackers used EIP-7702 to link a Binance hot wallet to a contract that only they controlled. On the other nine blockchains, validly signed transactions sent the funds away; TRM's most likely explanation is that the attacker gained control of the signing system for Binance's hot wallets. A hot wallet is a wallet that is kept online so that an exchange can pay out quickly.

What is frozen and what is not

Frozen is not the same as recovered: the money is stuck, but it only comes back after separate legal steps. TRM writes that the attackers still hold well over 420,000 ETH and 18,270 BTC, together about $2.4 billion, which issuers cannot freeze. To sell quickly, they sold USDT for ETH at a rate more than 10% below the market price.

Worked example: does this fit within the SAFU fund?

Binance is covering the loss with the SAFU fund (about $1 billion in bitcoin, according to CoinDesk) and its own resources. A worked example, not a Binance figure:

That is a sum built on estimates from three sources; if frozen funds do not come back, the remainder will be higher. The total damage is roughly 4% of the around $144 billion that Binance managed before the hack, according to DefiLlama (CoinDesk).

How big is this compared with earlier hacks?

We wrote about the Bitget hack earlier in Bitget hack: $388m stolen, balances intact. Chainalysis chief Jonathan Levin sees TraderTraitor as the likely culprit, because, according to SecurityWeek, funds from the Bitget hack were mixed with proceeds from Binance.

What does this mean for you as a European investor?

If you still have a balance on Binance. Binance does not hold a MiCA authorisation and suspended its EU services on 1 July (no new orders, deposits or sign-ups; withdrawals were still possible). More on that: Binance app disappears from Google Play in parts of the EU. That balance may now be stuck, because withdrawals are paused. Binance says the balance is safe; no date for resuming withdrawals has been given in this news.

If you have no balance on Binance. Then this does not directly affect your money. Do watch out for scams: news like this brings fake emails and fake sites promising ‘compensation’. Only go to the official site, never via a link in an email or messaging app, and never share your seed or login details.

Why this is different from a bank failure. An exchange is not a bank. There is no deposit guarantee as there is on a bank account; what you get is the company's pledge, backed by its own fund. The SAFU fund is a reserve held by Binance itself.

What you can do yourself. What you are not actively trading belongs on a wallet whose keys you hold: see our guide to self-custody and how to choose a crypto wallet. If you want to know which supervisor a platform falls under, check the authorisation yourself or look at the overview of MiCA authorisations. An authorisation does not prevent a hack, but it shows who supervises.

Country-specific rules (tax, an exchange's liability) differ per member state and do not come from the sources of this article; for tax, see crypto tax in Europe.

What is not certain yet

• The exact amount. Binance says about $6.3 billion, Chainalysis about $5.9 billion, TRM $6.36 billion. Earlier counts were lower ($2 billion at The Motley Fool, $5.57 billion at Decrypt) and were revised.
• The culprit. TRM Labs and Chainalysis speak with high confidence of TraderTraitor; ZachXBT names the Lazarus group. According to CoinDesk, no government has officially confirmed this yet, and Binance has not named anyone.
• When withdrawals will resume. Binance says it will resume them once security is back in order, without giving a date.
• Whether customers will really notice nothing. Binance says user funds are safe; that is the company's statement. The technical report is still to come.
• Whether there will be EU consequences. The sources consulted say nothing about European users or supervisors. If news about that emerges, this piece should be the first to be updated.

This article is not investment advice. Crypto can lose a lot of value and you can lose your entire stake.

Frequently asked questions

Is my money at Binance safe after the hack?

According to Binance it is: the company says all losses will be reimbursed from the SAFU fund and its own resources. That is a pledge from Binance. Withdrawals are paused for now.

How much was stolen from Binance?

Binance estimates about $6.3 billion. Chainalysis and TRM Labs arrive at about $5.9 billion and about $6.36 billion. According to Binance, about $3 billion is frozen.

Who is behind the Binance hack?

TRM Labs and Chainalysis name TraderTraitor, a North Korean group. Binance has not officially named anyone and, according to CoinDesk, there is no official government confirmation.

What is the SAFU fund?

The Secure Asset Fund for Users is a reserve fund held by Binance itself, about $1 billion in bitcoin according to CoinDesk. It is not a government deposit guarantee.

Is Binance still allowed to operate in the EU?

Binance does not hold a MiCA authorisation and has not offered new services in the EU since 1 July, according to our earlier article. Whether that changes because of the hack is not stated in the sources.

Sources

Read on 30 October 2026.

• CoinDesk: Binance loses over $6 billion in the largest crypto hack to date (29 October, updated 30 October 2026)
• SecurityWeek: $6 Billion Binance Hack Bears Hallmarks of North Korea's TraderTraitor (30 October 2026)
• IBTimes UK: 'User Funds Are Safe!': Binance Says After $6.3 Billion Hack (30 October 2026)
• Decrypt: Binance Drained of $5.5 Billion in Suspected Hack, Tether and Circle Freeze $1.8 Billion (29 October 2026)
• Reuters via CTV News: World's biggest crypto heist (29 October, updated 30 October 2026)
• The Motley Fool: Crypto Market Today, Oct. 29 (29 October 2026)