PrefaceOn October 29, 2026, attackers drained about $6.3 billion from Binance's hot wallets, most of it in roughly 20 minutes. It is the largest crypto hack on record, according toCBS News, citing TRMPrefaceOn October 29, 2026, attackers drained about $6.3 billion from Binance's hot wallets, most of it in roughly 20 minutes. It is the largest crypto hack on record, according toCBS News, citing TRM

Binance's $6.3 Billion Hack: Who Pays When a Crypto Exchange Loses Billions?

#Industry Perspectives

4$0.01101-0.81%

QUICK$0.004508+1.03%

NOT$0.0003473-1.08%

Author: Emmanuel Olamiye

2026/11/03 21:07

Preface

On October 29, 2026, attackers drained about $6.3 billion from Binance's hot wallets, most of it in roughly 20 minutes. It is the largest crypto hack on record, according toCBS News, citing TRM Labs, and more than four times the $1.46 billion stolen from Bybit in 2025.

Binance says its users will not pay. It says it will cover the loss from its own money and two reserve funds. The FBI says North Korea did it. But "who pays" is a bigger question than one company's promise. It also depends on whose money was in those wallets, how much can be recovered, and what happens when an exchange cannot cover a loss.

This guide explains how Binance is paying, how past hacks ended, and what to check now. Facts are as of November 1, 2026, and the story is still developing.

Quick Answer: Who Pays for the Binance Hack?

Binance says it does. It has set aside more than $6.34 billion from its treasury, its SAFU emergency fund and part of its Futures insurance fund, and says about 95% of the stolen assets are replaced. Binance says customers lose nothing. If frozen funds are returned, its net loss shrinks. If an exchange cannot pay, crypto customers have no deposit insurance to fall back on.

Key Takeaways

Attackers took about $6.3 billion from Binance hot wallets on October 29, 2026, the largest crypto hack on record.
The FBI blamed North Korea's TraderTraitor group on October 31.
Binance says it will absorb the loss using its treasury, its SAFU fund and part of its Futures insurance fund, not user money.
Binance says about 95% of stolen assets are replaced, with ten major tokens fully backed.
About $3 billion was frozen, mostly stablecoins, but roughly $3 billion more sits in coins issuers cannot freeze.
Binance says the wallet held its own funds, but a CoinDesk review found the wallets had been listed among assets backing customer balances.
Withdrawals reopened on November 1, and Binance reported about $3.64 billion in net outflows in the first nine and a half hours.
Crypto has no FDIC or SIPC safety net, so Binance's promised proof of reserves is the next test.

Key Terms Explained

Hot wallet: a wallet connected to the internet so an exchange can process withdrawals quickly.
Cold wallet: an offline wallet, where most customer funds are usually stored.
SAFU: Binance's Secure Asset Fund for Users, an emergency reserve started in 2018.
Proof of reserves: a published check showing an exchange holds enough assets to match customer balances.
Freeze: a stablecoin issuer blocking an address so stolen tokens cannot move.

1. What Happened in the Binance Hack?

1.1. The Timeline

October 29, about 20:05 UTC: Binance says its hot wallets were compromised. TRM Labs says about $6.36 billion left Binance wallets across 10 blockchains, mostly in about 20 minutes, perCBS News.
October 29 to 30: Tether, Circle and Ripple freeze funds, and Binance pauses withdrawals while saying user funds are safe.
October 30: Co-CEO Richard Teng says Binance has set aside more than $6.34 billion, including $5 billion already held in the stolen tokens, perDecrypt.
October 31: The FBI names North Korea, and Binance says 90% of the loss is replaced.
November 1: Binance withdrawals reopen in phases from about 06:00 UTC, and Binance reports 95% replaced.

1.2. How Did the Binance Hack Happen?

Binance first said the incident may involve a compromised DevOps engineer's laptop, which gave an attacker access to a service container where they submitted unauthorized withdrawals, perThe Hacker News. It later found additional breach points and said it saw no evidence that private keys leaked.

Teng said the attacker also used an Ethereum feature called EIP-7702 to take control of a hot wallet, bypassing Binance's normal approval controls, and a self-destruct mechanism that erased traces. TRM said a phishing explanation covers Ethereum but leaves the other chains unexplained, perBitcoin.com. Elliptic said the attacker appears to have got Binance's own systems to sign transactions rather than stealing its keys, perThe Hacker News. Binance has not yet published a full technical post-mortem.

2. Who Was Behind the Binance Hack?

TRM Labs blamed TraderTraitor, North Korea's elite hacking unit, "with high confidence" within hours, and Chainalysis called it the likely culprit, perThe Hacker News. Analysts describe the group as a subunit of the wider Lazarus Group, perFree Press Journal. On October 31, the FBI confirmed it. The FBI, the US Secret Service and IRS Criminal Investigation say the attackers are converting stolen assets mainly into Ether and expect them to be laundered through DeFi and instant swap services, perThe Hacker News.

Elliptic counts $6.43 billion stolen across 11 blockchains, and says the theft nearly doubles what North Korea-linked actors have taken in recent years. The same group has been tied to the Bybit, DMM Bitcoin, KelpDAO and Bitget thefts. Firms count differently, so treat $6.3 billion to $6.43 billion as the range.

3. Who Pays When a Crypto Exchange Loses Billions?

3.1. Binance's Own Money

Binance says it has set aside more than $6.34 billion of company funds. Using our own arithmetic, that is about 3.7% of the $171 billion in assets Binance reports, perThe Block. The coverage rose from about 80% on October 30 to 90% on October 31 and 95% on November 1, pertech-ish. Binance says ten tokens are fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It is still buying the remaining, less liquid tokens on the market and through private trades.

3.2. The Reserve Funds

Binance says it used a partial deployment of SAFU, part of its Futures insurance fund, and its corporate treasury, according toCointelegraph, which noted Binance did not say how much came from each source. SAFU moved 7,499 BTC, about half its holdings and roughly $580 million, and Binance plans to refill it to about $1 billion. SAFU has done this before, covering a 7,000 BTC theft in 2019.

The Futures insurance fund is different. It normally absorbs losses from traders who go bust on leveraged positions. Binance says it took only the amount above the level its rules require, and also says no exchange can completely avoid auto-deleveraging, where winning traders' positions are partly closed when losses are not covered, pertech-ish.

3.3. Whose Money Was in the Wallet?

Teng says the compromised wallet held Binance's own money, because Binance never uses customer funds, and that most customer coins sit in cold wallets.TokenPost explains the legal logic. When users deposit, the exchange typically takes ownership and credits an account balance.

But a CoinDesk review of Binance reserve data found the compromised wallets had previously appeared in a list of assets backing customer balances, perTheCryptoUpdates. tech-ish separately found Binance's main Ethereum hot wallet on the list of wallets in Binance's own proof of reserves. That does not settle who would have borne the loss, but it explains why the proof of reserves matters.

3.4. Recoveries

About $3 billion was frozen, mostly stablecoins, per Binance. Elliptic says $2.85 billion was frozen by Tether, Circle, Ripple, Arbitrum and Optimism, perThe Hacker News. Bitcoin and Ether cannot be frozen that way. Elliptic counted about $3.21 billion still beyond any issuer's reach, and Bitquery found 18,270 BTC that had not moved, as of Saturday pertech-ish.

Fundstrat's Sean Farrell told CNBC the breach does not currently appear to create meaningful solvency risk for Binance, asIBTimes Australia quoted him. If frozen stablecoins are returned, Binance's net loss falls. Binance has not said how much it expects to recover.

3.5. What If Binance Could Not Pay?

Then customers would be largely on their own. Crypto on an exchange is generally not covered by FDIC deposit insurance or SIPC, and a 2022 analysis by law firm Nixon Peabody saysno government program protects exchange customers, who would likely be unsecured creditors. In the EU, MiCA makes licensed custody providers liable for lost client crypto, capped at its market value when lost, perESMA's MiCA rulebook. That is a claim on the firm, not deposit-style insurance. Mt. Gox shows how slowly such cases can end.

4. How Past Crypto Exchange Hacks Were Paid For

Bitfinex, 2016: It cut every customer balance by about 36% and issued BFX tokens, which were redeemed within eight months.
Coincheck, 2018: It reimbursed about 46.3 billion yen, roughly $420 million, from its own funds, then sold itself to Monex.
Binance, 2019: SAFU covered a 7,000 BTC theft in full.
Bybit, 2025: About $1.46 billion was stolen, and users were made whole through reserves and partner loans.
Mt. Gox, 2014: Repayments began in 2024, and an October 16, 2026 trustee notice pushed the deadline to October 31, 2027.

MEXC Learn documented 81 exchange hacks since 2011, and found only about 40% ended with users fully reimbursed. Read the full breakdown inCrypto Exchange Hacks: 81 Breaches, $5.1B Stolen, Only 40% Paid Back.

5. Binance Hack Impact on Bitcoin, BNB and Regulation

Bitcoin fell about 5% in 24 hours, perCointelegraph, and touched a six-week low of $76,368, while BNB fell about 6.4% to $696, perYahoo Finance. After withdrawals reopened, Binance reported $4.65 billion withdrawn against $1.01 billion deposited in about nine and a half hours, a net outflow of $3.64 billion, or 2.1% of its assets. DefiLlama showed $4.05 billion in net outflows over 24 hours, but co-CEO Yi He said the tracker counted some of Binance's new hot wallet addresses as outflows, perTheStreet.

In Washington, CFTC Chairman Michael Selig cited the hack to push a voluntary federal registration route for offshore exchanges, perCryptobriefing. Senator Cynthia Lummis said the stalled CLARITY Act would have given firms legal cover to freeze suspicious transactions the moment law enforcement calls, perCointelegraph. The Digital Chamber urged Congress to give the CFTC authority over exchanges and keep customer and company funds separate, perThe Block.

6. What Crypto Users Should Do Now

Check Binance's proof of reserves when it is published. Learn what any proof of reserves shows and what it does not, using this guide tocrypto exchange transparency and proof of reserves.
Limit what sits on any exchange. Keep trading funds on platforms and long-term savings in your own wallet. This guide tocrypto wallets, hot and cold explains the difference.
Compare exchanges on evidence. Seewhich exchanges publish proof of reserves. MEXC says it publishes monthly Hacken-audited reports, so read the latest one yourself, as covered inIs MEXC Safe?
Beware scams. Ignore anyone offering to "unlock" or speed up a withdrawal, and never share your seed phrase.
Check your own balance. MEXC users canverify their assets in the proof of reserves.

Conclusion

Binance's response has been fast and large. It found billions of its own money in about three days, reopened withdrawals, and has so far kept customers whole. That is a better outcome than most past exchange hacks.

But the incident exposed the limits of the system. Customers have no deposit insurance, the question of whose money was in the wallet is still being tested, and the proof of reserves is Binance's word until you can check it. Treat this as a prompt to verify, diversify and keep your own keys for long-term savings. Start with ourguide to proof of reserves.

Frequently Asked Questions (FAQ)

1. Did Binance get hacked, and how much was stolen?

Yes. Binance confirmed its hot wallets were compromised around 20:05 UTC on October 29, 2026, with about $6.3 billion in token assets stolen. TRM Labs counts $6.36 billion and Elliptic $6.43 billion. It is the largest crypto hack on record, and Binance says user funds are safe and it will cover the loss.

2. How did the Binance hack happen?

Binance first pointed to a compromised DevOps engineer's laptop that gave an attacker access to a service container to submit unauthorized withdrawals. It later said it found more breach points and that the attacker used EIP-7702 to take control of a hot wallet, bypassing approval controls. A full technical post-mortem has not been published.

3. Who hacked Binance?

The FBI says North Korea's TraderTraitor unit did it. The FBI, Secret Service and IRS Criminal Investigation say the group is converting the stolen assets mainly into Ether and is expected to launder them through DeFi and instant swap services. Binance had earlier said its own investigation had not attributed responsibility to any individual.

4. Will I get my money back from Binance?

Binance says users will not bear the loss and that customer balances are unaffected. Withdrawals reopened in phases from November 1.NPR notes Binance is not necessarily bound to repay under current regulations, so its promise rests on its own reserves. The proof of reserves will show whether customer balances are backed.

5. Who pays for the Binance hack?

Binance says it does, not its users. It set aside more than $6.34 billion from its corporate treasury, part of its SAFU emergency fund and part of its Futures insurance fund. About 95% of the stolen assets were replaced by November 1, and Binance is buying the rest. If frozen funds are recovered, its final cost falls.

6. Can I withdraw from Binance now?

Yes, in phases. Binance began reopening withdrawals around 06:00 UTC on November 1, starting with Bitcoin, then Ether, USDT, USDC and BNB across 15 networks. Other tokens return after security checks, with no date given. Binance warns of delays, says withdrawals now go out from new wallets, and says deposits are unaffected.

7. What is the SAFU fund?

SAFU stands for Secure Asset Fund for Users. Binance started it in 2018 as an emergency reserve for hacks and similar events. It covered a 7,000 BTC theft in 2019. In this incident, 7,499 BTC, worth about $580 million, moved out of it, and Binance says it will refill the fund to about $1 billion.

8. Can the stolen crypto be recovered?

Partly. About $3 billion was frozen, mostly stablecoins like USDT and USDC that issuers can block. Bitcoin and Ether cannot be frozen that way, and roughly $3 billion more sits in such assets. The FBI says it is being converted mainly into Ether. Binance has not said how much it expects to recover.

9. How did the Binance hack affect Bitcoin and BNB prices?

Bitcoin fell about 5% in 24 hours and touched a six-week low of $76,368, while BNB fell about 6.4% to $696, per Yahoo Finance and Cointelegraph. Bitcoin was back near $78,000 on Sunday, per The Block's price ticker. Prices move quickly, so check live data, and note that this is not financial advice.

10. What is the biggest crypto hack ever?

The Binance hack is the largest on record at about $6.3 billion, according to TRM Labs and CBS News. That is more than four times the Bybit theft of about $1.46 billion in February 2025. The FBI attributed both thefts to North Korea's TraderTraitor group, and Elliptic says the Binance theft nearly doubles what North Korea-linked actors have stolen in recent years.

Disclaimer: This article is for information only and is not financial, legal, or tax advice. Crypto assets are volatile and carry risk, and this story is still developing. Figures change quickly, so verify current details with official sources. Do your own research and consult a qualified professional before making decisions.

Market Opportunity

4 Price(4)

$0.011

$0.011$0.011

USD

4 (4) Live Price Chart

The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to Emmanuel Olamiye. If you believe any content infringes upon the rights of a third party, please contact [email protected] for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.