All incidents · Oct 29, 2026
Unauthorized withdrawals from Binance hot wallets
BinanceExchangeOngoingEthereum, Bitcoin, Tron, Solana
On October 29, 2026, Binance said an attacker had submitted unauthorized withdrawals. The estimated impact was about $6.3 billion. The company said about $3 billion had been frozen by partners. More than $6.34 billion in company funds was set aside to cover the loss, of which $5 billion was already held in the same tokens that were affected. Yi He and CZ said the company would bear the loss. As of the morning of October 31, withdrawals were still paused.
Other figures
- Loss6.01billion USDDecrypt, relaying Arkham · as of Oct 30, 2026
- Frozen1.567billion USDTether: frozen USDT · as of Oct 29, 2026
- Frozen800million USDCircle: lower bound of frozen USDC · as of Oct 29, 2026
- Frozen27million USDYi He: USD1 frozen · as of Oct 29, 2026
Sequence
Newest first · UTC
Oct 312026 · Sat
CZ said the ones to deal with were North Korean hackers
Statement · CZ · @cz_binance
In the same thread, CZ went on to write that he did not want a conflict with one of the strongest builders in the world. The ones he had to deal with were North Korean hackers. This is his claim.
Fight with one of the strongest builders in the world? No thx. Let's fight the North Korean hackers.
CZ clarified that he never said he would sell SPCX
Revision · CZ · @cz_binance
Someone read the previous day's SPCX post as CZ using a stock sale to apply pressure. CZ replied that he never said he would sell SPCX. He brought up the holding because the thread compared the situation to FTX, which made it seem Binance lacked funds, and he did not think that was so. His point was that Binance also holds positions outside crypto assets, and in a field the other person knows. He wrote that he does not make threats. For the other person, this holding is a drop in the ocean.
I never said “selling SPCX shares”. I mentioned we have them only because the FTX comparison in the thread may have implied we lacked funds, which is not true.
Yi He said again, in Japanese, that the AAVE stake was not in the frozen amount
Statement · Yi He · @heyibinance
She wrote that the 60 million staked as AAVE was not among Binance's freeze targets. After this excess collateral is released through formal procedure, the loss is expected to fall by 14 million. This is the same claim as the Chinese reply the day before.
AAVEとしてステーキングされている60Mは、Binanceにおける凍結対象には含まれておりません。今後、正式な手続きを経てこの過剰担保分を解除することで、14Mの損失を軽減できる見込みです。
Yi He said Binance could still cover it
Statement · Yi He · @heyibinance
Yi He replied to a suggestion that people donate. On funds, the company had always spent within its income. Binance could still more or less cover it. Donations could go to charity and to people who need them. Half an hour later she replied to worries about solvency. She said trading volume, fees, user scale, and the quarterly BNB burn were public.
资金方面我们一直量入为出，币安还算可以兜底，捐款大家可以捐给慈善和需要的人。
Oct 302026 · Fri
The co-chief executive said Binance would bear the loss
Statement · Richard Teng · @_RichardTeng
While reposting a Binance update, Richard Teng wrote the bottom line. The financial impact of the stolen funds would be borne by Binance, not by users. He restated the reserve of more than $6.34 billion, about $3 billion frozen, and that withdrawals would resume only after the security checks were finished.
Bottom line: Binance will absorb the financial impact of these stolen funds, not our users.
Yi He said the heavy loss was real, and the SPCX shares still did not need to be sold
Statement · Yi He · @heyibinance
Yi He replied in the thread that was still discussing whether to sell the shares. The heavy loss was real. The SPCX shares still did not need to be sold.
不至于，大出血是真的，SPCX股票还不用卖。
CZ compared this loss in bitcoin terms
Statement · CZ · @cz_binance
Binance founder Changpeng Zhao said $6.3 billion is the largest in dollar terms, but not in bitcoin terms. He gave Mt. Gox's 650,000 bitcoin as an example. He stressed that the platform would bear this one, and that users were protected. This is a statement by the shareholder and founder. It is not an audited list of losses.
$6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC! ... Most importantly, we protect our users.
Yi He posted a video of about four minutes
Statement · Yi He · @heyibinance
The post text was only "User funds are SAFU," followed by a video of about 4 minutes. wolfyxbt posted an English translation underneath, and Yi He then thanked the version with subtitles. What the English translation adds is this. The part affecting more than $3 billion was only about 2% of user assets and public reserves. Withdrawals had been paused for nearly a day, and were expected to reopen within 42 hours. The gap would first be filled with the company's own funds, so user assets stayed covered 1:1. Online claims that more than $6 billion had to be bought on the market were not accurate. Only a small part needed to be bought. A Merkle tree would be updated later, and a technical security audit would be published. This site did not check the spoken words line by line. These sentences are recorded from the English translation.
User funds are SAFU.
CZ said the top-up had already started, and that these coins were already in the fees
Statement · CZ · @cz_binance
CZ reposted Binance's note about setting aside $6.34 billion. He said the token top-up looked as if it had already started. He added that users pay trading fees in the coins they are trading, so Binance naturally accumulates the tokens it lists. This explained why the company said most of the gap was already in the same tokens.
Another little detail in addition to the effort described, users pay trading fees on Binance in the coins they trade, so Binance's naturally accumulates all tokens they list.
More than $6.34 billion in company funds was set aside, which is not the same as already paid out
Reimbursement · Binance · @binance
Binance said it had already set aside more than $6.34 billion. Of that, $5 billion was already held in the same tokens as the affected assets. The rest was still being filled in through the market and over-the-counter purchases. This $6.34 billion does not include assets already frozen. The post also restated that about $3 billion was frozen at the time. User funds would in the end be checked in public through proof of reserves.
Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted.
Yi He said the 60 million USDT posted as AAVE collateral was not fully inside the freeze tally
Statement · Yi He · @heyibinance
Someone worried that frozen USDT used as AAVE collateral would pull on-chain liquidations. Yi He replied that the 60 million USDT posted as AAVE collateral was not entirely inside the freeze tally. She wrote that what the hacker actually took was 46M of ETH. After that portion is released through a law-enforcement process, another 14M can still be recovered. 46 plus 14 equals 60, which matches this 60 million. So this is recorded in dollar terms for that one piece of collateral. It is not recorded as 46 million ETH. It does not change the $6.3 billion total loss.
目前AAVE抵押的6000万U不在完全冻结范围内，黑客实际只拿走了46M的ETH，这部分通过执法系统解开后能追回的币还能多14M。
CZ said he had not been talking about selling SPCX
Revision · CZ · @cz_binance
CZ replied to Yi He and Elon Musk. The original post read "did say anything about selling SPCX shares," missing a negative. The second half made the point clear. He was only bringing out a sum of funds the other person might recognize, so that person would worry less.
did say anything about selling SPCX shares, was just saying/showing some funds that he might know, so that he can be less worried.
CZ roughly put the gap at about $2 billion
Statement · CZ · @cz_binance
Someone asked what use the SPCX holding was here. CZ wrote a rough account. The stolen amount was $6.x billion. $3 billion was frozen. The SAFU fund was $1.x billion. The gap was about $2 billion. SPCX alone was $1.x billion. The remaining gap still hurt, but it was manageable. The $6.x and $1.x labels are his own. They are not an official list.
Gap is about $2b, we have $1.x billion in SPCX alone. Remaining gap is (still painful, but) manageable.
Yi He said a full year of revenue could cover the loss, so the SpaceX shares need not be sold yet
Statement · Yi He · @heyibinance
Replying under CZ's post, Yi He told the major shareholder that the company's revenue for the year was enough to cover this loss. So it did not yet need to sell the SpaceX shares the other party was bullish on.
Our company’s revenue for the year is sufficient to cover the losses, so we do not yet need to sell the SpaceX shares you are bullish on.
CZ said the SPCX holding was worth more than $1 billion
Statement · CZ · @cz_binance
CZ asked Elon Musk not to joke at this moment. He wrote that Binance's SPCX shares came from a $500 million investment in the Twitter acquisition, and were now worth more than $1 billion. This was a way of saying the books also held positions outside crypto assets.
Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion.
Beyond the first account, more points of intrusion were found
Revision · Binance · @binance
Binance said it first thought the incident may have involved a compromised laptop. Later investigation found more points of intrusion. The time to restore withdrawals was changed to about 45 hours. The frozen amount was still written as about $3 billion. Binance did not name an attacker in this post.
Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
CZ said this was more complex than one compromised device
Statement · CZ · @cz_binance
CZ replied to Elon Musk. On October 28 he had written not to click links in email and not to download attachments. This time he said he hoped everyone had followed that advice, but this theft was more complex than that. He said this kind of incident generally runs into a compromised device or algorithm at some point. At the time, Binance's public account was still one DevOps engineer's laptop. A little more than twenty minutes later, the official account revised this and said more points of intrusion had been found.
The hack is more complex than that, but all hacks generally have a compromised device (or algorithm) at some point.
Two hours later it revised this. Deposits were unaffected, and withdrawals stayed paused
Revision · Binance · @binance
Binance changed its account. Deposits were still normal. Withdrawals stayed paused so the withdrawal service and related addresses could be rebuilt. Recovery was expected within 48 hours. The post called the compromised computer a possible entry point, and promised a root-cause report later.
Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses.
Binance confirmed unauthorized withdrawals, with an estimated impact of about $6.3 billion
Confirmation · Binance · @binance
Binance said a preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer. From there the attacker entered service containers and submitted unauthorized withdrawals. Binance said it had not found a leak of wallet private keys. About $3 billion had been frozen on-chain. Losses would be covered by SAFU and company funds. The same post also said deposits and withdrawals were temporarily stopped.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
Oct 292026 · Thu
Yi He said World Liberty froze $27 million in USD1
Freeze · Yi He · @heyibinance
Yi He thanked World Liberty Financial. It froze $27 million in USD1, and about 48 million WLFI, which she noted in parentheses as about $2 million. She wrote that withdrawals would stay closed until the environment was confirmed safe.
Thanks to @worldlibertyfi team for the $27m USD1 frozen and 48m (~$2m) WLFI frozen.
Yi He thanked Ripple for freezing about 200 million
Freeze · Yi He · @heyibinance
Binance's later statement about $6.3 billion had not been posted yet. Yi He thanked the Ripple team for promptly freezing about 200 million. The post did not give a unit. She also wrote that user funds were safe.
Thanks to the Ripple team for promptly freezing approximately 200 million.
Tether froze more than $1.567 billion in USDT
Freeze · Paolo Ardoino · @paoloardoino
Tether's chief executive described the freeze as aimed at a possible theft at the Binance exchange. At that time Binance had not yet posted the later statement about $6.3 billion.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Circle froze more than $800 million in USDC
Freeze · Jeremy Allaire · @jerallaire
Circle's chief executive said that, after coordinating with law enforcement, the company froze more than $800 million in USDC tied to this incident. This is a public lower bound, not a final list.
Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.