Skip to content

A dark computer monitor showing lines of programming code with colourful syntax highlighting

News · Security and scams

Binance hack 2026: what the blockchain shows about the $6.3 billion theft

Published 2026-10-30By the CryptoGuardz Register Desk4 min read19 sources

Photo: Jakub Żerdzicki / Unsplash

In short, from the documents

Is Binance safe after the $6.3bn hack

Binance says about $6.3 billion was taken from its hot wallets on 29 October 2026 and about $3 billion has been frozen. On Ethereum, a single transaction emptied the hot wallet labelled Binance 14 into an attacker address, and 197,460 ETH was still sitting untouched in a second address on 30 October.

Piece published 2026-10-30Reviewed by CryptoGuardz Register Desk, editorial desk

Binance puts the total impact of the 29 October 2026 hack at about $6.3 billion. On Ethereum most of the theft came in one transaction: at 20:24:23 UTC the hot wallet labelled Binance 14 sent 167,464 ETH and 1.6 billion USDT to an attacker address. About $3 billion has been frozen, Binance says; it has paused withdrawals and says it will cover all losses.

Binance is on the exchange register. This brief reads the Ethereum leg from the explorer. The other chains are not traced here.

What the document says

Binance's incident update gives a preliminary cause and a promise:

Binance will cover all losses from the SAFU fund and the company's funds.

Binance, Security Incident Update, retrieved 2026-10-30

Binance@binance

We are working non-stop to resolve this issue. Binance will cover all losses. As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We are working around the clock and will…

30 October 2026View on XBinance's own post promising to cover all losses and suspending deposits and withdrawals.

The same update says the attack "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container", that Binance has "found no evidence of any wallet private key leak", and that a technical post-mortem will follow. It gives no date for it.

On X, Binance put the verified frozen total at $2.54 billion late on 29 October, then at around $3 billion. Tether's chief executive said Tether froze more than 1.567 billion USDT, and Circle's said Circle froze more than 800 million USDC. On 30 October Binance said deposits operate normally and withdrawals stay paused, with resumption expected within 48 hours.

What the blockchain shows

All Ethereum figures were read on Blockscout and Etherscan on 30 October 2026.

Timeline of the Binance 14 hot wallet theft: contract created at 15:59, delegation at 20:20, the sweep of 167,464.25 ETH and 1,615,409,499 USDT at 20:24, 195,460 ETH moved on at 20:38, token swaps from 01:17 and 17,260 ETH sent on at 05:15 on 30 October. — Each step can be rechecked on a public explorer from the transaction links in the sources. Graphic: CryptoGuardz, from the sources cited below, CC BY 4.0

the largest hack. ever.Video by voidzilla on YouTube. Watch on YouTubeCoffeezilla's video on the Binance theft, a walk-through of the same incident traced on-chain in this section.

Time (UTC)	Event
29 Oct, 15:59	Address 0x7C86...5CA0 creates a contract, 0x63e8...fAe (unverified on Etherscan)
29 Oct, 20:20	0x7C86...5CA0 sends an EIP-7702 authorisation transaction (type 4) to Binance 14, delegating it to 0x63e8...fAe
29 Oct, 20:24	That address calls "sweep" on Binance 14; 167,464.25 ETH, 1,615,409,499 USDT, 62.6 million RLUSD and dozens of other tokens move to 0x5227...2f8c
29 Oct, 20:38	0x5227...2f8c sends 195,460 ETH to 0x8532...43D4
29 Oct, 20:41 to 23:56	Six more sweeps of Binance 14, including 1,699.9 and 369.8 ETH to 0x5227...2f8c and 128.5 and 2,961.9 ETH to 0xA97b...8d10
30 Oct, 01:14	0x5227...2f8c sends a further 2,000 ETH to 0x8532...43D4, taking it to 197,460 ETH
30 Oct, 01:17 to 04:06	588 payments from DEX routers (mostly Uniswap's) and the WETH contract bring 17,193 ETH back to 0x5227...2f8c
30 Oct, 05:15	0x5227...2f8c sends 17,260 ETH to 0x03b0...20ea

Three things stand out. The authorisation transaction is on-chain: at 20:20:59 UTC Binance 14 was delegated to the 0x63e8 contract under EIP-7702, the mechanism TRM Labs describes, and the sweep followed 3 minutes and 24 seconds later. Etherscan still showed Binance 14 as "Delegated to" that contract on 30 October. The contract itself was created 4 hours and 25 minutes before the sweep. And the 0x8532 address held 197,460 ETH on 30 October and had sent nothing out, so most of the stolen ETH had not moved past its second stop.

Those 588 payments are tokens being turned into ETH, which a stablecoin issuer cannot freeze, and the 17,260 ETH sent onward at 05:15 is close to their total. Aave's account shows the same aim: a wallet in the attacker's cluster supplied 60 million USDT and borrowed 19,762 WETH before Aave froze its markets. From 04:42 UTC on 30 October the attacker address also received more than 20 dust transfers from lookalike addresses, the address-poisoning pattern seen after the Duelbits hack.

What it changes for users

Withdrawals are paused. Clause 16.4 of Binance's Terms of Use lets it suspend withdrawals "at such time deemed appropriate by Binance" to resolve incidents, and says that once they are resolved, "Binance will resume withdrawals." It sets no time limit.
The promise to cover losses is in an announcement, not in the terms.
TRM Labs attributes the attack "with high confidence" to the North Korean group TraderTraitor, and Chainalysis' co-founder made a similar assessment. Binance and law enforcement had not named an attacker by 30 October.

A single figure: 197,460 ETH held by the address 0x8532...43D4 on 30 October 2026, with no outgoing transaction. — Most of the ETH taken on Ethereum was parked in one address as of 30 October. Graphic: CryptoGuardz, from the sources cited below, CC BY 4.0

Binance US$6.3b crypto heist likely linked to North Korea, says expertVideo by CNA on YouTube. Watch on YouTubeA news report from CNA on the Binance theft and the North Korea attribution discussed in this section.

Binance@binance

Service Update Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details.…

30 October 2026View on XBinance's latest service update, the source for the 48-hour withdrawal estimate.

Quick answers

How much was stolen from Binance?

Binance estimates about $6.3 billion. TRM Labs puts it at about $6.36 billion at the time of theft, and Chainalysis estimated about $5.912 billion at the time of theft.

Can I withdraw from Binance now?

Not as of 30 October 2026. Binance said withdrawals stay paused and it expects to resume within 48 hours. Deposits operate normally.

Is Binance safe after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. That is a company statement. No post-mortem or updated proof of reserves had been published by 30 October.

More analysis

2026-10-24CoinDCX 2026: 15.8 million USDT left an old CoinDCX deposit address compromised in July 2025A Tron address that CoinDCX says it retired after its July 2025 hack sent 15,819,002 USDT to a new wallet on 21 October 2026. CoinDCX denies a new breach, says a sweep of deposits to old addresses failed for a period, and says it absorbed the losses.2026-10-30KuCoin ends all services in Russia and Belarus in 2026, with deadlines sent by private noticeKuCoin said on 29 October 2026 that it is discontinuing all services for users in Russia and Belarus, effective immediately. Affected users get their deadlines to close positions and withdraw in an individual notification, not in the public notice.2026-10-30OFAC sanctions North Korea IT worker network in 2026 and lists 8 crypto addresses Tether has frozenOn 28 October 2026 OFAC sanctioned 10 people and one entity tied to North Korea's IT worker schemes and listed 8 Ethereum and Tron addresses. The USDT contract records freezes on all 8, seven of them on 28 October.2026-10-30Polymarket hack 2026: how a compromised vendor script drained traders on 29 OctoberPolymarket says one of its third-party providers was compromised on 29 October 2026 and that everyone affected will be made whole. The provider named in research and by its own warning is DebugBear, whose monitoring script carried wallet-draining code; about $2.65 million in POL was traced to one wallet.2026-10-29Binance restricts 8 services in Brazil ahead of the central bank's 30 October 2026 licence deadlineSince 27 October 2026 Binance users in Brazil can no longer open new margin trades, take new loans or join Launchpool, and 22 tokens have left trading there. Tomorrow, 30 October, is the last day for crypto firms already operating in Brazil to ask the central bank for a licence.2026-10-29Coinbase Ireland fined €3.25 million in 2026 for failing to safeguard customer fundsThe Central Bank of Ireland announced on 22 October 2026 that it had fined Coinbase Ireland €3,252,618 and reprimanded it for safeguarding and outsourcing breaches between November 2020 and August 2025. The settlement notice says the account meant to protect customers' money was underfunded every day from 1 January 2023 to 27 June 2024, by up to €5.2 million.

Sources

About this piece

Compiled by the CryptoGuardz register team from the sources listed above. Research and drafting are AI-assisted and reviewed by a named editor before publication. Nothing here is a recommendation to gamble. If a figure or a reading is wrong, tell us and the correction is logged in public.

Add CryptoGuardz as a preferred source on Google to see our pieces more often in Top Stories.