Binance hot wallet stolen of about $
On October 30, 2026, at 04:05 (UTC+8), Binance's hot wallet was attacked, losing approximately $6.3 billion in token assets. Binance said it has prepared more than $6.34 billion in company funds, about 80% of the stolen funds have been backfilled, approximately $3 billion has been frozen on-chain, and it plans to resume withdrawals in stages by token within about 34 hours, with the first proof-of-reserves snapshot to be taken within 12 hours.
Event timeline
- [10-30 19:53] Binance: About 80% of stolen funds have been backfilled, withdrawals to resume in stages within about 34 hours (PANews)
- [10-30 20:27] About 80% of stolen funds have been replenished, Binance expects to resume withdrawals in stages within 34 hours (Odaily Planet Daily)
Background and impact
On October 30, 2026, at 04:05 (UTC+8), Binance's hot wallet was attacked, losing approximately $6.3 billion in token assets. Binance subsequently released Security Incident Progress Announcement #2, disclosing investigation and asset compensation progress over the past 24 hours. The two sources differ in the timestamps on the articles: Odaily Planet Daily marked it as October 30, 2026, 20:27, and said the announcement was released at 3:33 a.m. that morning; PANews marked it as October 31, 19:53. The two are consistent in their statements on the loss amount, backfill ratio, and subsequent time points.
On the funding side, Binance said the loss will be borne in full through the SAFU fund and the company's own funds, and will not be passed on to users. Binance has currently prepared more than $6.34 billion in company funds, of which more than $5 billion equivalent in corresponding token assets such as USDC, USDT, BTC, ETH, and BNB has been secured, about 80% of the stolen funds have been backfilled, and the remainder is being purchased through market and OTC channels. At the same time, Binance has frozen approximately $3 billion in assets on-chain. Based on the disclosed information, the assets used for backfilling are mainly stablecoins and mainstream tokens.
Regarding the cause of the attack, Binance said the initial investigation believed the incident may have involved a compromised laptop, and follow-up investigation found that other intrusion points also existed; at this stage, no evidence of wallet private key leakage has been found, and further technical investigation results are expected to be published within about 48 hours. Regarding next steps, Binance plans to resume withdrawals in stages by token within about 34 hours, will conduct the first proof-of-reserves snapshot within 12 hours, and will publish the results before November 2 (Monday).
From the perspective of information completeness, the withdrawal resumption schedule, the proof-of-reserves snapshot results, and the technical investigation conclusions are three verifiable observation points. Binance, on the one hand, emphasizes that no evidence of private key leakage has been found, while on the other hand confirming that other intrusion points exist, indicating that the attack path has not yet been fully characterized, and the investigation conclusions within about 48 hours need to be awaited. Such security incidents usually also drive users' attention to exchange entry points and account security settings, including the use and verification of commonly used entry points such as Binance binance registration APP download, OKX registration APP download, HTX registration APP download, Gate.io registration APP download, and Bitget registration APP download, but the final impact of the incident itself still depends on the actual situation disclosed at the above milestones.
FAQ
### When will withdrawals