Binance hack (October 2026): what happened, how much was lost, and how Takame scores it

Late on 29 October 2026 (UTC), attackers moved funds out of Binance's hot wallets across several blockchains. The first reports put the outflow at $5.5 to $5.8 billion; TRM Labs and the DefiLlama hacks dataset list $6.36 billion. Binance says it set aside more than $6.34 billion of company funds and that users will not bear the loss. On Takame the hack counts in full: Binance's Incidents part is at 0 of 20.

What happened

CoinDesk reported a potential multi-billion-dollar hack at Binance at 21:12 UTC on 29 October. Within 40 minutes Cointelegraph, Decrypt and The Block followed with reports of large outflows that Binance was investigating, and CoinPost quoted Binance founder Changpeng Zhao as saying it appeared to be a hack. Binance paused withdrawals while keeping deposits open, according to CoinDesk. In Japan, CoinPost reported that Binance Japan temporarily paused crypto deposits and withdrawals, and that bitFlyer restricted transfers to Binance.

Binance first said a compromised laptop belonging to one of its DevOps engineers let attackers submit unauthorised withdrawal requests. On 30 October it said it had found additional points of breach, without giving details, and that it had seen no evidence that wallet private keys were stolen, as reported by CoinDesk and Decrypt. These are Binance's own statements, not the findings of a regulator or an auditor.

How much was lost

The figures differ because they were published at different hours, while funds were still moving, and because some count only what had left the wallets while others count everything Binance says was affected. Binance's own recovery updates give percentages rather than a total. Takame's score uses the DefiLlama figure, as our methodology says, and every other figure here links to its source.

Who was behind it, and where the funds went

• TRM Labs and Chainalysis linked the attack to North Korea's TraderTraitor group. On 31 October the FBI, in a statement with the US Secret Service and IRS Criminal Investigation, said TraderTraitor was responsible and published the Ethereum, Bitcoin and Solana addresses involved, according to CoinDesk.
• A Binance spokesperson told CoinDesk on 30 October that about $3 billion had been frozen with the help of industry partners. CoinDesk reported on 31 October that stablecoin issuers had frozen more than $2.4 billion of the stolen funds.
• CoinDesk reported that the attacker split about $1.4 billion of bitcoin into 19 wallets, and that the FBI expects the funds to keep moving through swap services and DeFi tools.

How Binance is covering the losses

• Binance says it set aside more than $6.34 billion of company funds, drawing on its corporate treasury, part of its Secure Asset Fund for Users (SAFU) and part of its futures insurance fund. Its 1 November update says Binance, not its users, will absorb the loss.
• Binance's recovery updates say the share of affected assets it has replaced rose from about 80% to 90% on 31 October and to about 95% on 1 November. The remainder is in less liquid tokens outside the top ten.
• Binance posted a proof-of-reserves snapshot taken at 00:00 UTC on 31 October. It says the full zero-knowledge proof takes 40 to 50 hours to generate and expects it by 3 November.
• On 1 November Binance said it was preparing to reopen the first phase of withdrawals, for a listed set of networks, between 06:00 and 09:00 UTC, with other networks to follow.

How Takame scores this hack

Takame's score has an Incidents part worth 20 points. Hacks and enforcement outcomes from the last three years reduce it: each record of $50 million or more removes 10 points, and a joint resolution by several authorities counts once. Binance had already lost 10 points for its November 2023 resolution with US authorities (a guilty plea in a $4 billion resolution, counted once). The October 2026 hack removes the other 10, so Binance's Incidents part is at 0 of 20; without it, it would be 10 of 20. Binance's May 2019 hack is more than three years old and no longer counts. On 1 November at 08:07 UTC Binance's overall Takame score was 5.8 out of 10; the other parts move with live data such as trading volume.

• Reported, not verified by us. When a major exchange is named in a hack report, Takame records it as reported. Since 1 November 2026, people who watch that exchange are notified within minutes of the first report. The score does not change, and the exchange page shows the report only once a second independent source carries it.
• Confirmed and counted. The report is confirmed when DefiLlama lists it, the exchange itself confirms it, or two independent major outlets report it. It then counts in the score. Until DefiLlama lists it, we use the smallest figure the reports give.
• Withdrawn. A report not confirmed within 72 hours is withdrawn, and the exchange page says so.

The reported stage was not live yet when this hack happened. The Binance hack entered the score through the DefiLlama entry, which was listed by 00:10 UTC on 30 October and has counted in Binance's score since 31 October, when we matched it to Binance. The record and its sources are on Binance's exchange page.

What you can check yourself

1. 1.Whether withdrawals are open for the network you use, from Binance's own announcements, not from social media posts.
2. 2.Which Binance legal entity serves you in your country, and whether that entity appears on your regulator's register. Our Binance page lists the registers we read and the regulator warnings that name Binance.
3. 3.Whether the proof of reserves Binance publishes covers the assets you hold (see our guide to reading proof of reserves).

The facts on this page were checked on 1 November 2026, around 08:00 UTC. Figures from an incident this recent can change; each source below carries its own date.