Binance $6.3 Billion Hack: What We Know, What Binance Says and What Users Should Do

Updated November 2, 2026. This is a developing story and we update this article as new information is published. It is general information, not financial advice.

Update, November 3: proof of reserves published, next phase of withdrawals due

According to reporting on November 2 and 3, Binance published a zero-knowledge proof of reserves covering ten assets (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC) that users can verify independently (The Block). Not every supported asset is covered yet, so a further snapshot is planned, which outlets report for November 4. Binance says it has covered about 95% of the affected amount (CNBC).

Withdrawals restarted in phases on November 1, but only the first 15 networks and assets were restored, with the next phase expected on Tuesday, and some assets such as HYPE were reported as still switched off (Bankless, Bitcoin.com). Net outflows of about $3.64 billion were reported for the first days, and coverage differs on how far total exchange assets have fallen, so treat the numbers as preliminary. The FBI has reportedly attributed the attack to North Korea-linked hackers.

This is a news summary from public reports, not financial advice. Check Binance's official announcements for the current status of each network before moving funds.

Update, November 2: withdrawals reopen in phases

• Withdrawals reopened in phases from November 1, starting with bitcoin. According to CoinDesk, services resumed across 15 networks and assets in the first phase by about 12:36 UTC on November 1, while others, including Cardano, Chainlink, Hyperliquid, Litecoin and NEAR, were still being tested.
• About $3.64 billion in net outflows after reopening, according to CNBC and The Block, as customers rushed to move funds off the platform. Binance said withdrawal volumes declined and were stabilising after the first spike.
• Coverage rose to about 95% of the affected assets, up from 90%, using company funds. The remainder is less liquid tokens outside the top ten. This is replacement of assets, not recovery of the stolen funds from the attacker.
• Proof of reserves: the full cryptographic proof is expected around November 2 or 3, and reports differ on the exact day.

Summary

• On Thursday, October 29, 2026, Binance suffered what CoinDesk called the largest crypto hack to date: about $6.3 billion of crypto was stolen.
• About $3 billion of the stolen assets has been frozen onchain, according to Binance.
• Binance says it will absorb the losses and that it has already replaced about 90% of the stolen assets; the main tokens, including BTC, ETH, USDT, BNB, SOL, USDC and XRP, are reported as fully backed again.
• Binance reopened withdrawals in phases from Sunday, November 1 (see the update above).
• The FBI said it determined North Korea was responsible, and blockchain analytics firms TRM Labs and Chainalysis had already pointed to the North Korea-linked group TraderTraitor.

What happened

CoinDesk reported that attackers drained wallets that Binance had listed as backing customer holdings. According to CoinDesk’s October 30 and 31 coverage, roughly 18,270 BTC (about $1.4 billion at around $78,500 per bitcoin) was split into 19 wallets, 17 of which held exactly 1,000 BTC each. Binance’s co-CEO Richard Teng said on Friday that investigators had found additional breach points beyond an initially suspected compromised employee laptop, so the exact method was still unclear at the time of reporting.

What Binance says it is doing

• Covering the losses. Binance said it had set aside more than $6.34 billion in company funds, including about $5 billion held in the affected cryptocurrencies, and wrote: “Binance will absorb the financial impact of these stolen funds, not our users.”
• Replacing assets. It is using its corporate treasury, part of its futures insurance fund and a partial deployment of the SAFU emergency fund. The remaining 10% is in less liquid tokens that may take longer to buy on the market. Binance also committed to restoring SAFU to about $1 billion.
• Proof of reserves. Binance published a snapshot taken at midnight UTC on October 31 showing coverage ratios of 100% or more for the named tokens. The full cryptographic proof, which lets users verify their own balances, was expected in the first days of November (reports say November 2 or 3).
• Investigation. The investigation remains open and Binance has not itself publicly named the attacker.

Why it matters

The previous record crypto exchange hack was Bybit’s roughly $1.5 billion theft in February 2025, which was also attributed to North Korea’s Lazarus Group (see our Bybit review). The Binance incident is more than four times larger. A CoinDesk review also noted that the drained wallets were among those Binance had pointed to as proof that customer assets were fully backed, which is why the new proof-of-reserves release is being watched closely.

What users should do (general safety tips)

• Use official channels only. Scammers exploit incidents like this with fake “compensation” or “withdrawal” links. Do not click links in messages, and type the exchange address yourself or use the official app.
• Secure your account. Enable two-factor authentication or passkeys, an anti-phishing code and a withdrawal address whitelist.
• Check the proof of reserves when the full release is published, and watch Binance’s official announcements for withdrawal status.
• Do not keep more on any exchange than you need. For long-term holdings, consider self-custody with a hardware wallet.
• Check your local rules. Binance is not available in every country.

Other exchanges

CoinDesk reported on October 29 that Bybit said it was not affected by the incident and that trading and withdrawals were running normally. We have not seen reports of impact on MEXC or BingX at the time of writing.

What we are watching next

• Whether the remaining networks and assets reopen and how outflows develop.
• The full proof-of-reserves release on November 2 or 3.
• The investigation findings, including how the attackers got in, and any recovery of the frozen funds.
• Regulators’ reactions in the United States and elsewhere.

What Binance's proof of reserves actually shows

The official page says account balances are verified 1:1 with a zk-SNARK mechanism and a published Merkle root. The snapshot we saw is dated October 31, 2026, 00:00 UTC, after the hack and before withdrawals reopened. It lists ratios of 100.04% for BTC, 100.00% for ETH and USDT, 101.30% for BNB, 106.08% for USDC and 100.99% for XRP, which means on-chain wallets cover net customer balances for those assets at that moment. It does not cover every asset, it predates the reopening, and it is not a full solvency audit, which is why a further snapshot is being prepared.

Where did the money go? The flows after the reopening

On DefiLlama's tracker this morning Binance showed about $124.3 billion in tracked assets and net outflows of roughly $3.25 billion over 24 hours and $15.4 billion over seven days, while OKX, Bitfinex and Bitget showed positive 30-day flows. We break down the numbers, and why they do not all match, in our analysis Binance net outflows hit $15 billion in a week.

Frequently asked questions

Was Binance hacked?

Reports describe a theft of about $6.3 billion on October 29, 2026, the largest crypto hack on record. Binance has said it will cover the loss itself.

Can I withdraw from Binance now?

Withdrawals restarted in phases on November 1, starting with 15 networks and assets. Check Binance's official status for each network before moving funds.

Is my money safe on Binance?

No exchange can promise that. Binance says it has replaced about 95% of the affected assets and publishes a proof of reserves, but both have limits. Only keep on an exchange what you can afford to have delayed.

Who was behind the attack?

The FBI has reportedly attributed it to North Korea-linked hackers. Treat attribution as reported, not final.

Related on ToolReviewHub

Read our Binance review, which includes the fee table, compliance history and a security section updated for this incident, and our Bybit review.

Sources

• CNBC: Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack (November 2, 2026)
• CoinDesk: Binance opens crypto withdrawals in phases starting with bitcoin (November 1, 2026)
• CoinDesk: Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach (October 31, 2026)
• CoinDesk: Bitcoin stolen from Binance tops Tesla’s holdings (October 31, 2026)
• CNBC: Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday (October 31, 2026)
• CoinDesk: Binance says customer money is safe after huge hack drains key reserve wallets (October 30, 2026)

Editorial note: figures come from the reports above and Binance’s statements as of November 1, 2026 and may change. We have not independently verified the attribution or the amounts.