In this field note
What is known, and what is still being investigated
On 29 October 2026, assets moved from Binance wallets during a security incident. In its incident notice, updated 30 October, Binance estimated the impact at approximately $6.3 billion and said it had worked with partners to freeze roughly $3 billion. A frozen asset is not necessarily an asset already returned to its owner.
Blockchain analytics firm TRM Labs estimated about $6.36 billion in transfers across ten blockchains, based on its on-chain snapshot at 00:30 UTC on 30 October. Its earlier freeze estimate is therefore not a current recovery total. TRM attributes the attack to a North Korea-linked group; that is the firm’s assessment, and the investigation is ongoing.
Binance’s initial notice suggested a compromised employee laptop may have been involved and said it had found no evidence of a wallet private-key leak. In a later company update, its CEO described additional points of breach. The final technical report was not available in the notices we reviewed; do not treat the first explanation as a complete root cause.
Are customer funds covered?
Binance says it will cover losses. Its CEO also said company funds were reserved for that purpose and described the affected hot wallet as Binance’s own. The company plans to publish updated proof of reserves. These are Binance’s claims and commitments; we have not independently audited its reserves, verified individual balances or confirmed that a particular customer has recovered funds.
CCN’s analysis of Binance’s October reserve disclosure reports that an affected hot wallet had appeared among assets supporting customer balances in that earlier snapshot. An old snapshot does not establish the exchange’s present assets or liabilities, or prove a current shortfall. Updated figures and independent verification are needed to assess the current position.
Keep these three things separate: the estimated amount affected, assets frozen during tracing, and any actual recovery or compensation. None alone proves the other two. The company’s incident notice is the place to check for changes to its stated position.
Can I withdraw or deposit?
In its 30 October notice Binance said it had temporarily suspended withdrawals while security checks were completed. The notice was later corrected to say that deposits remained unaffected. The company’s CEO subsequently described a planned reopening after further checks, not a guarantee of the exact time for every customer.
We have not signed in to an account or tested a withdrawal. Service availability can change and different Binance entities or regions may operate differently. Open the official app or type the known official address yourself, then check the latest notice and your own account’s available functions. Avoid treating a screenshot, a countdown or this article’s date as proof that withdrawals have resumed.
What should I check before responding to a message?
Security incidents can attract fake support and recovery offers. Check the sender and navigate independently to the official app or website rather than using an unexpected message link. Never give anyone your recovery phrase, private keys, password or one-time codes. Do not send money to a purported recovery address or connect a wallet because an unsolicited message asks you to.
The private-key guide explains why a device PIN and recovery material protect different things. If something in your account looks wrong, use support accessed from the official service rather than replying to an unsolicited contact.
Does self-custody remove every risk?
No. A custodial exchange and a self-custody wallet place responsibility in different places. When a service controls the spending keys, access depends partly on its systems and withdrawal rules. With self-custody, you are responsible for the backup, recipient checks and recovery. Mistakes, phishing, device compromise or lost recovery material can still cause loss.
| Question | Custodial exchange account | Self-custody wallet |
|---|---|---|
| Spending authority | The service controls the keys under its arrangement | Your wallet setup controls the keys |
| Access | Depends on the service and account restrictions | Depends on your device, backup and compatible software |
| Main responsibility | Check the provider’s controls and terms | Protect and test the recovery process |
A compatible software wallet can be used on a phone or computer you already own; a hardware signer is a separate purchase, not a requirement. Our hardware versus software wallet comparison explains the trade-offs, and the hardware-wallet guide covers checking and recovery. Neither guarantees security.
If you later decide to transfer assets and the service permits it, first check the asset, network, full destination, withdrawal fee and receiving wallet’s recovery process. A small test transfer can expose a mistake but may incur an additional fee; it cannot prove a later transaction will be correct. The Bitcoin fee calculator explains network-fee assumptions and is not a quote for an exchange withdrawal.
Sources and timing
We read Binance’s incident notice, its CEO update, TRM’s on-chain analysis, and CCN’s analysis of an earlier reserve snapshot on 30 October 2026, around 19:00 UTC. This is a dated snapshot, not a live service-status page. The investigation, availability, recovery totals and company commitments should be checked again before relying on them.
Frequently asked questions
How much was affected in the Binance hack?
Binance estimated approximately $6.3 billion in its 30 October incident notice. TRM Labs independently estimated $6.36 billion from transfers on ten blockchains, based on its earlier 00:30 UTC snapshot. Values and recovery figures can change.
Has Binance promised to cover losses?
Yes. Binance said it would cover the losses using its own funds and that it planned to publish updated proof of reserves. A promise and a future report are not the same as independent verification of an individual account or a completed recovery.
Can I withdraw from Binance now?
Binance's incident notice said withdrawals were temporarily suspended for security checks. Availability may change and may differ by region or service. Check the latest official notice and the status in your own account; we have not tested a withdrawal.
Do I need to buy a hardware wallet?
No. A compatible self-custody software wallet may be usable on a device you already own. Any self-custody choice requires a secure backup and understanding of the supported network and recovery process.
Put it to work
Bitcoin fee calculatorSources are listed above. This guide explains the mechanics; it is educational information, not a recommendation to invest or buy mining equipment.
