ForecastsPro Get ForecastsPro Log in

Binance hack: is my money safe? What is known as of 31 October 2026, and what you can check

As of 31 October 2026, Binance says it will cover all losses from the hack it announced on Thursday 29 October116. About $6.3 billion of assets were affected, and withdrawals are still paused216. Two things are not yet known: the full cause, and the exact time withdrawals reopen.

Published By ForecastsPro

In short

  • Binance says about $6.3 billion of assets were affected (30 October 2026). The BBC reports that it may be the largest crypto hack ever recorded12.
  • Binance says it will cover all losses2. At 10:55 UTC (world standard time) on 30 October, it said it had set aside more than $6.34 billion of company funds14.
  • Withdrawals are still paused. At 19:33 UTC on 30 October, Binance said it aims to start reopening them, in phases, within about 34 hours, which would be early on Sunday 1 November16.

What happened at Binance?

Binance is a crypto exchange with more than 300 million registered users1. The theft began at about 20:05 UTC on Thursday 29 October 2026, when the first funds left Binance wallets5. TRM Labs, a company that tracks crypto payments, says most of the theft happened within about 20 minutes5.

Binance’s first checks showed that the laptop of one of its engineers had been hacked. From there, the attacker got into a “service container”, a part of Binance’s systems. There, the attacker sent withdrawals that Binance had not allowed2.

Richard Teng, one of Binance’s two chief executives, said Binance had so far found “no evidence of any wallet private key leak”1. A private key is the secret code that controls a crypto wallet. At 08:47 UTC on 30 October, Binance said its investigation had found “additional points of breach”, meaning other ways the attacker got in. Binance called it “a complex attack”3. At 14:33 UTC, Richard Teng said the attacker used EIP-7702, a feature of Ethereum, to get approval to act for one of Binance’s hot wallets. A hot wallet is a wallet that stays online for withdrawals. That approval did not go through Binance’s normal checks15. At 19:33 UTC, Binance said it expects to share more technical findings within about 48 hours16.

About half of the assets, about $3 billion, are frozen13. Frozen means blocked, so the attacker cannot move or use them. Tether and Circle, which make the USDT and USDC coins, froze about $2.4 billion of them together1.

What does Binance say about customer money?

Binance says “user funds are safe”3. A Binance spokesperson said: “Users will not bear the financial impact of this incident.”4 In other words, Binance says users will not pay for the loss. Richard Teng said Binance never uses customer funds, that what was hit was Binance’s own hot wallet, and that most customer assets are kept in cold wallets, which are offline15.

Binance says the money will come from its SAFU fund and company funds2. SAFU is Binance’s emergency fund for users. By February 2026, it held 15,000 bitcoin, then worth about $1 billion6. At 10:55 UTC on 30 October, Binance said it had already set aside more than $6.34 billion of company funds14. Richard Teng said $5 billion of that money is already held in the same coins that were stolen, such as USDT, USDC, BTC, ETH and BNB, and that Binance is buying the rest15. At 19:33 UTC, Binance said this $5 billion covers about 80% of the amount affected, and that it is buying the other 20% on the market and in private deals16. We found no Binance figure for the part that comes from SAFU.

Binance also says it will share a post-mortem: a report on what went wrong. After the repair work, it will publish an updated Proof of Reserves2. A Proof of Reserves shows the assets an exchange holds for its customers. Binance says all user funds will be checked in public this way14. Richard Teng said a full Proof of Reserves report is due by Monday 2 November, with a first view before that if possible15. At 19:33 UTC on 30 October, Binance said it would take a first snapshot of its reserves (its holdings at one moment) within about 12 hours, with results expected by Monday16. As of 31 October 2026, about 13:05 UTC, we found no Binance statement that the snapshot was taken, and no published results.

What is known, and what is not yet known?

The table sums up the facts as of 31 October 2026, 13:05 UTC.

QuestionKnownNot yet known
How much?About $6.3 billion affected, about $3 billion frozen23The final loss, after freezes and any recovery
How did the attacker get in?An engineer’s hacked laptop, then other ways in, including an EIP-7702 approval over a hot wallet2315The full cause. On 30 October at 19:33 UTC, Binance said more findings should follow within about 48 hours16
Who did it?Two companies that track crypto payments link it to TraderTraitor15Binance has not said who did it, and we found no government that has
Who pays?Binance says it will cover all losses1, and that it has set aside more than $6.34 billion of company funds14How much comes from SAFU, and what the Proof of Reserves report shows (results due by Monday 2 November1516)
WithdrawalsStill paused. At 19:33 UTC on 30 October, Binance said it aims to start reopening them, in phases, within about 34 hours, once its security checks are done16The exact time, and which coins reopen first
Customer API keys (used by trading apps)We found no report that any leakedWe found no Binance comment on them

What can I check in my Binance account today?

These checks cover your own account, not what happens inside Binance.

  1. Your API keys. An API key lets a program, such as a trading bot, work in your account7. On the Binance website, open your profile, then Account, then API Management8. Binance Academy, Binance’s learning website, says a bot should have trade access “but never withdrawal rights”. It also says to delete keys you no longer use, and to cancel a leaked key at once7. Binance recommends an IP restriction on every key, so the key works only from internet addresses that you choose9.
  2. Two-step login (2FA). Binance Academy says an authenticator app, a phone app that makes login codes, is generally more secure than codes by SMS. It also suggests checking your device list and recent logins, and removing devices you do not recognise10.
  3. The anti-phishing code. This is a code you choose. Binance includes it in all real emails and SMS it sends you. If it is wrong or missing, the message may be phishing: a fake message that tries to steal your login or your money. You set it under Account, Security, Advanced Security11.
  4. Scams. Binance asks users to trust updates only from official Binance channels2. Binance Verify, a page on Binance’s website, checks whether a website, email, phone number or social account is really Binance’s12. As of 31 October 2026, we found no Binance statement that asks users to apply, to log in through a link, or to pay to get their losses back.

What does the hack mean if I use a trading bot?

An API key without withdrawal permission limits what a leaked key can do: whoever steals it cannot send your coins out with it. But Binance warns that a thief with a trading key can still make your account buy, from the thief’s own account, coins that few people trade. That moves your money to the thief, with no withdrawal9.

A key setting cannot protect you if the exchange itself is hacked. Binance says the attacker sent the withdrawals from inside Binance’s own systems2.

As of 31 October 2026, the Binance statements we read do not mention customer API keys, trading or API access. We make an AI trading app. In its Real money mode (live trading: real money from your own Binance account), the app accepts a key only if the key cannot withdraw and is IP-restricted. More on keys: Are crypto trading bots safe?

Questions and answers

When will Binance withdrawals resume?

Withdrawals stay paused until Binance’s systems are confirmed to be secure, said Yi He, one of Binance’s two chief executives1. At 14:33 UTC on 30 October 2026, Richard Teng said Binance was rebuilding its withdrawal service, and would switch it back on only after strict testing15. At 19:33 UTC, Binance said it aims to start reopening withdrawals, in phases, within about 34 hours, once its security checks are done, with an update at each phase16. That would be early on Sunday 1 November, UTC time. It is an estimate. Deposits work normally, Binance says316. Binance’s own announcements have the latest.

Who hacked Binance?

It is not confirmed. Chainalysis and TRM Labs, two companies that track crypto payments, say the attack was carried out by TraderTraitor, a hacking group they link to North Korea. TRM Labs says it has “high confidence” in this5, and the BBC reports that Chainalysis said the same1. Binance has not named anyone. North Korea has denied involvement in past hacks1.

Are my Binance API keys safe after the hack?

As of 31 October 2026, we found no report that customer API keys leaked, and no request from Binance to change them. This does not prove that no key leaked. Binance’s words “no evidence of any wallet private key leak” are about its own wallets, not customer keys1. You can review your keys on the API Management page8.

Should I withdraw my crypto from Binance?

That is your decision, and this article is not financial advice. As of 31 October 2026, withdrawals are still paused16. The facts to watch are when withdrawals reopen, Binance’s technical findings and post-mortem, and its Proof of Reserves results, due by Monday 2 November21516.

Is Binance.US or Coinbase affected?

As of 30 October 2026, Binance.US says its platform is not affected, because the hack was at Binance.com. Coinbase said it was unaffected1.

How can I tell if a Binance refund message is fake?

Binance Verify, a page on Binance’s website, checks whether the email, phone number or account that sent it is really Binance’s. The page says Binance never asks for money or coins in private messages12. The FTC, the US consumer protection agency, warns about refund scams. Scammers contact people who lost money and pretend to be the company or a government agency. Then they ask for a fee first, or for personal details13.

How we checked this

We first read the sources on 30 October 2026, and re-checked Binance’s announcements and its posts on X on 31 October 2026 at about 13:05 UTC. Facts change by the hour, so each one carries its date, and its time where we know it. This article is information, not financial, legal or tax advice.

We are not part of Binance or of any company named here, and none of them has approved this article. Found a mistake? Write to support@forecastspro.com.

Sources

  1. BBC News, Osmond Chia and Angus Thompson, 30 October 2026. Crypto giant Binance hit by $6.3bn hack suspected to be largest in history. Used for: about $6.3 billion affected and thought to be the largest crypto hack on record, about half frozen, about $2.4 billion frozen by Tether and Circle, Binance’s promise to cover all losses, the attribution by Chainalysis and TRM Labs with high confidence, Richard Teng on wallet private keys, Yi He on withdrawals, Binance.US and Coinbase, and Binance’s registered users.
  2. Binance, announcement, 30 October 2026, 02:23 UTC. Security Incident Update. Used for: about $6.3 billion affected, the engineer’s laptop and the service container, covering all losses from SAFU and company funds, the post-mortem and the updated Proof of Reserves, and official channels only.
  3. Binance on X, 30 October 2026, 08:47 UTC. Investigation update. Used for: additional points of breach, a complex attack, Binance’s words “user funds are safe”, about $3 billion frozen, and deposits unaffected.
  4. Fox Business, Michael Sinkewicz, with Reuters, updated 30 October 2026, 10:45 UTC. Thieves make off with $6.3B from Binance: ‘Biggest hack in history’. Used for: the spokesperson’s words that users will not bear the financial impact.
  5. TRM Labs, blog, 29 October 2026 (02:10 UTC on 30 October, updated 19:41 UTC on 30 October). North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History. Used for: the first funds leaving Binance wallets at about 20:05 UTC on 29 October, most of the theft in about 20 minutes, and the attribution to TraderTraitor with high confidence.
  6. The Block, Naga Avan-Nomayo, 12 February 2026. Binance finalizes $1 billion SAFU reserve conversion into bitcoin. Used for: SAFU as an emergency fund for users, held as 15,000 bitcoin, worth about $1 billion at the time.
  7. Binance Academy, updated 26 May 2026. What Is an API Key and How to Use It Securely? Used for: what an API key does, trade access but never withdrawal rights for a bot, deleting unused keys, and cancelling a leaked key at once.
  8. Binance help, published 9 April 2018, updated 20 March 2025. How to Create API Keys on Binance? Used for: the way to the API Management page.
  9. Binance blog, 24 March 2025. How to Secure Your API Keys on Binance: 5 Tips For Protecting Your Crypto. Used for: an IP restriction on every key, and how a thief with a trading key can move your money with no withdrawal.
  10. Binance Academy, updated 26 June 2026. Secure Your Binance Account in 7 Simple Steps. Used for: authenticator apps and SMS codes, and checking devices and recent logins.
  11. Binance help, published 21 April 2023, updated 28 August 2026. What Is an Anti-Phishing Code and How to Set It up on Binance? Used for: the code in genuine emails and SMS, a wrong or missing code, and where to set it.
  12. Binance, no date on the page, read 30 October 2026. Binance Verify. Used for: what the page checks, and that Binance never asks for funds or tokens in private messages.
  13. US Federal Trade Commission, consumer advice, December 2023. Refund and Recovery Scams. Used for: scammers who contact people who lost money, pretend to be the company or a government agency, and ask for a fee first or for personal details.
  14. Binance on X, 30 October 2026, 10:55 UTC. Update on recovering affected assets. Used for: more than $6.34 billion of company funds set aside, and all user funds checked through the Proof of Reserves.
  15. Richard Teng, co-chief executive of Binance, on X, 30 October 2026, 14:33 UTC. An update on the security incident (transcript). Used for: the EIP-7702 approval over a hot wallet that skipped Binance’s normal checks, Binance’s own hot wallet hit and customer funds not used, most customer assets in cold wallets, $5 billion already held in the stolen coins and the rest being bought, the withdrawal service being rebuilt and switched back on only after strict testing, and the Proof of Reserves report due by Monday with a first view before that if possible.
  16. Binance, announcement, 30 October 2026, 19:33 UTC (posted on X at 19:58 UTC). Security Incident Update #2 (2026-10-30). Used for: Binance covering all losses, withdrawals still paused, with a phased reopening set to start within about 34 hours once security checks are done, with an update at each phase, deposits working, the $5 billion covering about 80% and the other 20% being bought on the market and in private deals, a first Proof of Reserves snapshot within about 12 hours with results by Monday 2 November, and more technical findings within about 48 hours.

ForecastsPro is an AI crypto trading bot with a hard-coded risk manager. See it work in the live demo: it is free and uses sample data, not real money.

More from the blog