Binance Hack Explained: What Is Confirmed, What Is Disputed and What Users Should Do Now

The Binance hack, first reported on October 29, 2026, is described by several outlets as the largest crypto theft on record. Binance confirmed a security incident, paused withdrawals and later put the estimated impact at about 6.3 billion dollars. Reports published on the morning of October 30 show the figures are still moving, so every number below carries its source.

For users, the Binance hack raises two separate questions. The first is what has actually been confirmed, and the second is what individual users should do while an investigation is still under way. Treating a Binance hack headline as settled fact before the post-mortem is published is the most common mistake, and the sections below mark where the evidence is firm and where it is not.

What Happened in the Binance Hack?

TechCrunch reported on October 29 that Binance confirmed it was dealing with a security incident after users reported funds being drained from its wallets. A Binance spokesperson said the exchange had temporarily suspended withdrawals on multiple networks as a precaution. TRM Labs, a blockchain intelligence firm, says the main theft began at 20:05 UTC on October 29 and that funds left Binance-attributed wallets on ten blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana.

According to TRM, Ethereum accounted for about 3.79 billion dollars of the total. The previous record was the 2025 hack of the exchange Bybit, which TechCrunch put at 1.4 billion dollars and Al Jazeera at 1.5 billion dollars. A separate exploit of the prediction market Polymarket on the same day, involving a few million dollars, was reported by TechCrunch as apparently unrelated.

What Has Binance Confirmed So Far?

According to Binance’s announcement, as reported by Forbes and CryptoNews, the company estimates the total impact at about 6.3 billion dollars. Its initial investigation found that a company engineer’s laptop may have been compromised, which could have let an attacker reach internal systems and submit unauthorized withdrawals. Binance said it found no evidence that wallet private keys were leaked, and that it revoked the affected address authorization.

Binance also said it froze about 3 billion dollars of the affected assets with blockchain partners, that user funds are safe, and that it will cover all losses using its Secure Asset Fund for Users and other company funds. It said it is working with law enforcement and blockchain investigators, and that it will publish a technical post-mortem and an updated proof of reserves. U.Today reported that co-CEO Yi He said withdrawals are expected to be restored within 48 hours and that deposits are unaffected. That statement is relayed from a social media post, and the 48 hours is an expectation, not a confirmed date.

What Is Still Disputed or Unconfirmed?

The total loss differs by source. Binance estimates about 6.3 billion dollars, TRM puts it at about 6.36 billion dollars at the prices when the assets were taken and about 6.23 billion dollars at current prices, and an on-chain analysis by a CertiK engineer, relayed by TechFlow, gives about 6.28 billion dollars. Earlier estimates ranged from 2 billion to 5.7 billion dollars, and they were later superseded.

The frozen amounts also differ. Binance cites about 3 billion dollars, TRM counts about 2.7 billion dollars frozen on-chain, Tether’s chief executive said more than 1.56 billion dollars of Tether was frozen, and Circle’s chief executive said about 800 million dollars of USDC was frozen. The reports do not say how far these figures overlap.

The cause is not settled. Binance describes the laptop compromise as preliminary. TRM assesses that the most likely explanation is a compromise of the signing infrastructure behind Binance’s hot wallet. Binance says it found no evidence of leaked private keys, while on-chain analysts describe authorizations signed by the wallet’s key, and no source explains how those signatures were obtained. TRM and Chainalysis attribute the attack to a known state-linked hacking group, while Binance has made no statement about who is responsible. Also unknown are the size of the Secure Asset Fund, the date withdrawals fully resume and whether all stolen assets will be recovered.

How Did the Attack Reportedly Work?

TRM and the CertiK engineer’s analysis describe the Ethereum part of the attack in similar terms. The attacker used an Ethereum feature called EIP-7702 delegation to make a Binance hot wallet run a sweeper contract that the attacker controlled. TRM said the attacker prepared 50 pre-signed authorizations, one of which matched the wallet’s transaction counter at the moment of execution. On the other nine chains, funds left through ordinary signed transfers.

A hot wallet is a wallet connected to the internet that exchanges use to process withdrawals, so it holds only part of customer assets by design. TRM said that about 2.4 billion dollars remained with the attacker at the time of its report, including more than 420,000 ETH and 18,270 BTC, and that laundering through decentralized exchanges and lending protocols had begun. Binance has not yet confirmed these technical details.

How Did Markets React?

Forbes reported that early on Friday Bitcoin fell about 4.5%, Ether fell 5.2% and BNB fell more than 7%. CryptoNews, citing Coinglass, reported that Bitcoin moved from above 81,000 dollars to around 76,400 dollars and that derivatives liquidations reached about 1.5 billion dollars. Al Jazeera reported a drop of about 5% for Bitcoin.

These moves came at the same time as the news, but no source shows that the hack was the only cause. Some analysts quoted in the reports described the declines as relatively modest, and an academic quoted by Al Jazeera said a loss of confidence could dampen prices and push some traders toward other venues, which is his opinion.

What Should Users Do Now?

The first step is to rely only on official channels. Binance itself warned users to beware of scams and not to trust unofficial links or requests for account information. After a large incident, fake support accounts, fake compensation forms and fake withdrawal-resumption pages usually appear, so a message that asks for a recovery phrase, a wallet connection or a password should be treated as unsafe, whichever platform it claims to represent.

Users of any exchange can also review their own account protections. That means turning on every available two-factor option, preferring an authenticator app or a passkey over text messages, setting an anti-phishing code and a withdrawal address whitelist where the platform offers them, using a unique password, and checking the login history for unfamiliar devices. These steps do not protect against a platform-level breach, but they reduce the risk from the account-level attacks that tend to follow headlines like this one.

Finally, decisions made in a hurry carry their own risk. Moving assets between platforms, trading on rumors or chasing recovery offers is more likely to cause losses than the news itself. Exchange custody and self-custody involve different risks, so any change should be made calmly, with the official post-mortem and the platform’s own announcements in hand.

Where Can Users Review Their Account Security Settings on WEEX?

WEEX’s app offers an example of where these settings can be found. Its Security page lists the login password, a passkey, Google Authenticator, a fund code, a two-factor authentication toggle, an anti-phishing code and the login history, so each of them can be reviewed in one place. 

WEEX also keeps an official verification page that states its official website and says that channel administrators never privately ask for personal, financial or account information or request transfers, which is a useful reference when a message claims to come from support. WEEX also states that it maintains a 1,000 BTC protection fund, whose coverage is subject to its terms and exclusions and which does not remove market risk.

Conclusion

The Binance hack is confirmed as a major security incident, and Binance says user funds are safe and that losses will be covered, but the total, the frozen amounts, the technical cause and the attackers are all still unsettled. Until Binance publishes its post-mortem and updated proof of reserves, the figures in this article should be read as the best available estimates, each tied to its source. In the meantime, the most useful action is account-level security and careful attention to official channels only.

FAQ

1. What happened in the Binance hack?
Binance confirmed a security incident on October 29, 2026, paused withdrawals and later estimated the impact at about 6.3 billion dollars. The Binance hack involved unauthorized withdrawals from its wallets on multiple blockchains.

2. Are user funds safe after the Binance hack?
Binance says user funds are safe and that it will cover all losses using its Secure Asset Fund for Users and company funds. This is the company’s own statement, and the post-mortem has not been published yet.

3. How much was stolen in the Binance hack?
Estimates differ by source. Binance says about 6.3 billion dollars, TRM says about 6.36 billion dollars at theft-time prices, and early reports ranged from 2 billion to 5.7 billion dollars.

4. Has Binance resumed withdrawals after the Binance hack?
Binance paused withdrawals, and co-CEO Yi He said they are expected to be restored within 48 hours, according to U.Today. This is an expectation, not a confirmed date.

5. What should users do after the Binance hack?
Users should rely on official channels only, ignore messages that ask for recovery phrases or passwords, review two-factor settings and login history, and avoid hurried decisions based on rumors.