Binance hack: what Binance has said and what to do

iPhoneAndroidMacWindowsUpdated

In an announcement on 30 October 2026, Binance said the "estimated total impact sits at around $6.3B" in a security incident, and that it will cover all losses from its SAFU fund and the company's funds. At 10:55 UTC the same day it said it had begun recovering affected assets for users, and that $3bn had been frozen. These details are still developing; Binance's announcements page and its official X account carry the latest.

Quick answer

Binance disclosed a security incident on 29 and 30 October 2026. It estimates the total impact at around $6.3B, says around $3 billion is frozen, and says it will cover all losses. In its 08:47 UTC update on 30 October, withdrawals were paused and deposits unaffected. Rely only on Binance's official channels, and treat anyone who calls you claiming to be Binance as a scammer.

What has Binance said so far?

Binance's statements have come through its official X account and a Binance announcement titled "Security Incident Update (2026-10-30)". In order, with times in UTC:

  1. 29 October, 21:29: Binance said its teams were aware of reports of a potential security issue and were investigating. In the same post it warned users to remain cautious of scams and not to trust unofficial links, messages or requests for account information.
  2. 29 October, 22:15: it said its team was conducting security checks and that withdrawals would resume once the issue was fully resolved.
  3. 29 October, 23:22: it gave the verified frozen total as $2.54 billion, and said it may continue to increase.
  4. 30 October, 00:52: it put the verified frozen total at around $3 billion.
  5. 30 October, 02:25: the announcement. Binance said the estimated total impact was around $6.3 billion, that it had found no evidence of any wallet private key leak, and that it would publish an updated Proof of Reserves once the remediation is complete.
  6. 30 October, 04:36: Binance said deposits were unaffected and operating as normal, and that it expected to resume withdrawals within 48 hours.
  7. 30 October, 08:47: an investigation update. Binance said it was still on track to resume the withdrawal service in 45 hours, that outflows ceased when it paused withdrawals, and that it had frozen around $3 billion so far.
  8. 30 October, 10:55: Binance said it had begun recovering affected assets for users and had reserved over $6.34B of company funds to cover the incident, $5B of it already held in the exact token assets that were impacted. It said it was buying the rest through market and OTC channels, which can take longer. It put the frozen total at $3bn.

The announcement says Binance has revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners to trace and recover funds. It says Binance will share a detailed technical post-mortem once the investigation is complete.

How did Binance say it happened?

On 30 October at 02:25 UTC, its announcement said: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

Two hours later it said the incident "stems from multiple factors" and that its security team was tracing the attack path through the compromised computer, which "may be the entry point". At 08:47 UTC it added: "our subsequent investigation has uncovered additional points of breach." Binance has said a comprehensive report with the root cause will follow.

Binance hasn't said who was behind the attack, or how the laptop came to be compromised. It says it is working with law enforcement to confirm the identity of those responsible.

Is my money on Binance safe?

Binance says it is. Its announcement states: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe."

Here's the position in Binance's statements on 30 October 2026:

  • Withdrawals: paused. At 08:47 UTC Binance said it was on track to resume the withdrawal service in 45 hours.
  • Deposits: working. A post at 00:13 UTC said deposits and withdrawals were both suspended; Binance then updated its announcement to say deposits remain unaffected and continue to operate as normal.
  • Binance Alpha: on 29 October Binance said Binance Alpha trading had been temporarily suspended, and would resume once the security issue is resolved.

None of Binance's statements up to 10:55 UTC on 30 October ask customers to move their funds or change settings. They ask people to rely only on official Binance channels for updates and to contact Binance Customer Support with questions. For the latest position, check Binance's announcements page and its official X account directly, not screenshots or reposts.

How do I avoid scams after the Binance hack?

Assume that messages about the incident may be fake. Binance's own first post on 29 October told users to be cautious of scams and not to trust unofficial links, messages or requests for account information. Its support pages add some firm rules:

  • Binance says that anyone calling you and claiming to be from Binance is a scammer.
  • It says it will never proactively contact users through unofficial channels to offer investment advice, giveaway entries or a "backdoor" to unlock an account.
  • It says it will never ask you to send coins to an address for any reason.

The US Federal Trade Commission (FTC) says scammers pretending to be from the government may tell you to send crypto to a wallet address "for safe keeping", and that only scammers demand payment in cryptocurrency.

How do I check a message really came from Binance?

Use Binance's own tools rather than anything in the message.

Binance Verify. Binance says you can use it to check whether a source officially represents Binance, including a website link, email address, phone number, X (Twitter) account or Telegram ID. Binance adds that you should still be careful even if a Telegram ID shows as "Verified".

Anti-Phishing Code. This is a set of letters and numbers you choose. Binance says it appears in all genuine emails and SMS from Binance, and that if the code shown is incorrect or missing, the message may be phishing and should be reported.

To set it up in the Binance app:

  1. Open the menu, tap your profile and go to Account Info.
  2. Select Security, then tap Anti-Phishing Code and Create.
  3. Enter your code, tap Submit, and verify with your 2FA or passkey.

On the Binance website, it's under Account > Security > Advanced Security.

Where do I report a Binance scam?

Report suspected impersonation to Binance through Binance Support on its official website. Then report it to the authorities where you live:

  • UK: Report Fraud, online at reportfraud.police.uk or by calling 0300 123 2040. In Scotland, contact Police Scotland on 101. Scam calls can be reported by texting 7726 with the word "Call" followed by the caller's number.
  • US: the FTC at ReportFraud.ftc.gov, and the FBI's Internet Crime Complaint Center at ic3.gov.

Our guide to spotting fake security emails covers the general signs of a scam message.

More questions

Was Binance hacked?

Binance calls it a security incident, and in its 08:47 UTC update on 30 October it said: "This was a complex attack." On 30 October 2026 it estimated the total impact at around $6.3B and said it will cover all losses from its SAFU fund and the company's funds. Details may change as its investigation continues.

When will Binance withdrawals resume?

On 30 October at 08:47 UTC, Binance said it was still on track to resume the withdrawal service in 45 hours. Check Binance's official announcements for the current status.

Someone from "Binance support" called me about the hack. Is it real?

No. Binance says that anyone calling you and claiming to be from Binance is a scammer, and that support is only available through its official website. Hang up, don't share codes or send any crypto, and check contacts with Binance Verify.

Who was behind the Binance hack?

Binance hasn't said. As of 30 October 2026, it says it is working closely with law enforcement to confirm the identity of those responsible. Until Binance or an official body names anyone, treat claims about who did it as unconfirmed.

Sources