Hackers Drain $6.3B From Binance in Record Crypto Heist: How to Protect Your Wallet

Hackers stole about $6.36 billion in cryptocurrency from Binance wallets on Oct. 29, 2026, according to blockchain intelligence firm TRM Labs, the largest crypto heist on record. Binance estimates the impact at $6.3 billion and says it will cover all losses from its SAFU fund and company funds. If you hold crypto on any platform, expect scammers to use this news as bait: check your account only in the official app, and never share your seed phrase.

Key Takeaways

• TRM Labs puts the theft at about $6.36 billion, drained from Binance wallets on 10 blockchains, mostly within 20 minutes.
• Binance says user funds are safe and that it will cover all losses. Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused.
• TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group.
• Binance’s early findings point to one engineer’s compromised work laptop, plus additional points of breach still under investigation.
• The biggest risk for most people now is follow-on scams: fake support messages, fake refund sites, and fake recovery firms.

No compromise. Promise

Your credit, finances, and info, all kept Safer Than Safe.

Learn more

What Happened in the Binance Crypto Heist

Attackers moved billions of dollars in crypto out of Binance’s hot wallets, the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs’ Oct. 29 analysis, most of the roughly $6.36 billion left in about 20 minutes starting at 20:05 UTC (4:05 p.m. ET), across 10 blockchains. That is about four times the $1.5 billion Bybit hack of February 2025, previously the largest on record.

Binance’s own estimate puts the impact at about $6.3 billion. Binance says it and its blockchain partners have frozen about $3 billion in affected assets on-chain, while TRM Labs estimates the attacker still holds about $2.4 billion in assets that issuers can’t freeze.

Is Your Money on Binance Safe?

Binance says yes. Late on Oct. 29, Binance said user funds are safe and that it will cover all losses from its SAFU fund and company funds. SAFU, short for Secure Asset Fund for Users, is an emergency reserve Binance set up to cover losses from incidents like this one.

In an Oct. 30 video update, Binance co-CEO Richard Teng said Binance has reserved more than $6.34 billion of company funds to cover the stolen assets, $5 billion of which is already held in the exact tokens taken, according to Decrypt.

What that means for you as of October 30, 2026:

• Deposits and withdrawals: Binance briefly suspended deposits and withdrawals. Deposits are back to normal, and withdrawals remain paused while Binance completes a security revamp of its withdrawal service. In the same video, Teng said Binance aims to reopen withdrawals within about 40 hours, ahead of a Sunday, Nov. 1 deadline, once the rebuilt service passes testing, according to WinBuzzer.
• Your balance: Teng said the exchange never uses customer funds, “so they are not impacted,” according to Bitcoin.com News; the losses hit Binance’s corporate holdings. Teng advised anyone concerned to check their balance and contact Binance support. You don’t need to file a claim, pay anyone, or move funds to protect your balance.
• US: Binance.US, a separate platform that serves US residents, said it has not been affected, according to the BBC.
• Next updates: Binance says it will publish a technical post-mortem when its investigation is complete. Get updates only from Binance’s official app, website, or verified social accounts.

Who’s Behind the Hack and How It Worked

TRM Labs attributes the attack with high confidence to TraderTraitor, which it calls North Korea’s elite hacking unit. Chainalysis reached the same conclusion after watching stolen Binance funds mix with funds from an earlier exploit tied to North Korea. The FBI attributed the 2025 Bybit hack to the same group, which is part of North Korea’s Lazarus Group.

The attack reportedly started on a single device. Binance’s initial investigation suggests it may have begun with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit withdrawals. Binance has found no evidence that wallet private keys leaked, but it later said it uncovered “additional points of breach” and hasn’t published a root cause.

TRM Labs reports that on Ethereum, the attacker submitted 50 pre-signed authorizations so that one would work, handing control of a Binance hot wallet to a contract only the attacker could command.

The lesson for everyone else: a compromised computer can hand attackers the keys to accounts it touches. The same logic applies at home. If malware lands on the laptop or phone you use for crypto, an attacker can capture passwords, swap wallet addresses you copy, or approve transactions in your name. Learn more in our guide to how data breaches happen and how to avoid them.

Scams That Can Follow the Binance Hack

Scammers often target crypto holders after major exchange incidents. After FTX collapsed in 2022, McAfee Labs found several phishing sites targeting FTX users, including one that asked people to submit their crypto wallet phrase to receive a refund.

“When news about such big breaches breaks, there tends to be panic and confusion for consumers. Scammers will try and take advantage and leverage this incident by making contact over Email, text/whatsapp, a phone call,” says McAfee’s Head of Threat Research Abhishek Karnik.

“Avoid such interactions that come out of the blue. The key is don’t panic, don’t react to inbound messages, and don’t have a knee-jerk reaction. Consumers shouldn’t let urgency override verification. If you are curious about your account at Binance, verify it but by navigating to the trusted website and not clicking on a link you received inadvertently from a text or email. The breach may be the headline, but the secondary scam wave could reach far more consumers.”

Watch for these red flags:

For more warning signs, see our guide on how to spot a crypto scam.

How to Protect Your Crypto Right Now

The most important step is to verify every message about your account through the official app, never through a link. These steps apply whether you use Binance, another exchange, or your own wallet:

1. Check your account only in the official app or by typing the web address yourself. Scam messages copy real branding and link to look-alike sites. Bookmark the real site and use only that.
2. Never share your seed phrase or private keys. No legitimate exchange, wallet, or recovery service needs them. Treat any request for them as a scam.
3. Use an authenticator app, passkey, or hardware security key for two-factor authentication. These are harder to intercept than codes sent by text message.
4. Turn on your exchange’s extra protections. If your exchange offers a withdrawal address allowlist or an anti-phishing code in its emails, turn them on. They make unauthorized withdrawals and fake emails easier to catch.
5. Review and revoke wallet permissions you don’t recognize. Connecting a wallet to a site can grant it ongoing permission to move certain tokens. Use your wallet’s settings or a block explorer’s approval checker to remove ones you no longer use.
6. Keep the devices you use for crypto updated and clean. The Binance hack reportedly began on one laptop. Install system and browser updates promptly, avoid unknown apps and browser extensions, and consider a dedicated device for large holdings.
7. Double-check every address before you send. Some malware swaps a copied wallet address for the attacker’s. Compare the first and last several characters before confirming.
8. Don’t act on urgency. Pressure to move funds, pay a fee, or confirm details “within the hour” is a sign of a scam. You don’t need to pay anyone or move funds to protect your Binance balance.

Exchange vs. Self-Custody: What’s the Difference?

Neither option removes all risk; they trade one set of risks for another. Here’s how they compare:

Whichever you choose, the same rule applies: nobody legitimate will ask for your seed phrase. For more background, see our guide to blockchain security. This article doesn’t recommend specific wallets, exchanges, or investments.

What to Do If You’ve Already Been Targeted

If you clicked a suspicious link, shared account details, or sent crypto after this hack, act quickly to limit the damage. Scammers are skilled at timing their messages to major news, and anyone can be caught off guard.

1. Stop all contact. Don’t reply, and don’t send more money or crypto, even if the person promises a refund or says one more fee will unlock your funds.
2. Secure your accounts. Change your exchange and email passwords from a device you trust, and turn on app-based two-factor authentication. Sign out of all other sessions if your exchange allows it.
3. If you shared your seed phrase, move what’s left. Create a new wallet with a new seed phrase on a clean device, and transfer any remaining funds there. The old wallet is no longer safe.
4. Revoke wallet permissions. If you connected your wallet to a suspicious site, revoke the approvals it received.
5. Contact the platform you sent from. Report the transaction to your exchange or wallet provider through its official support channel. Exchanges can sometimes flag or freeze funds that reach another platform.
6. Check your devices. Update your operating system and remove apps or browser extensions you don’t recognize. If you installed something a scammer sent, run a full security scan.
7. Protect your identity if you shared personal details. If you gave out your Social Security number, ID photos, or bank details, go to IdentityTheft.gov and consider a free credit freeze with Equifax, Experian, and TransUnion.
8. Keep records. Save wallet addresses, transaction IDs (hashes), dates, amounts, screenshots, phone numbers, and messages. Investigators and platforms need them.

If you’re a Binance customer and haven’t interacted with a scammer, you don’t need to pay anyone or move funds. If you’re concerned, check your balance and contact Binance support through its official app. Don’t pay anyone who offers to file a claim for you.

How to Report It

Report scams and suspicious messages tied to the Binance hack to these channels:

• FBI Internet Crime Complaint Center: file at ic3.gov, and include wallet addresses and transaction IDs.
• Federal Trade Commission: report at reportfraud.ftc.gov.
• Binance: report phishing and fake accounts through Binance’s official app or website support.
• Your local FBI field office or police: contact them if you lost money or were threatened. The IC3 recommends contacting a local FBI field office about fake law firms.

The Binance hack is the largest crypto theft on record, but for most people, the next risk arrives by email, text, or direct message. Check your account only through the official app, never share your seed phrase, and treat any unsolicited offer to recover or protect your crypto as a scam.

FAQ

Can stolen crypto be recovered?

Sometimes, but only in part. Some tokens can be frozen: about $2.7 billion of the Binance theft has been frozen, mostly by stablecoin issuers, according to TRM Labs. Recovery isn’t guaranteed: TRM Labs estimates the attacker still holds about $2.4 billion beyond issuers’ reach. Be wary of anyone who contacts you offering to recover crypto for a fee, the FBI’s IC3 warns.

Can someone steal my crypto if they have my wallet address?

Not with the address alone. A wallet address lets people see your balance and send you funds. To move your crypto, a thief needs your private key or seed phrase, or needs you to approve a malicious transaction.

Can you lose crypto in a cold wallet?

Yes. A cold wallet keeps your keys offline, which reduces exposure to online hacks. You can still lose funds if someone gets your seed phrase, you lose your only backup, or you approve a malicious transaction.