The Binance Hot Wallet Attack Explained: What Happened on 29 October 2026

On 29 October 2026, an attacker used unauthorised access to Binance’s internal wallet signing service to move about $6.34 billion in digital assets out of its hot wallets, dwarfing the $1.5 billion Bybit theft of February 2025. Binance suspended withdrawals as a precaution, then restored them in phases from 1 November 2026, and has said it will absorb the loss rather than pass it to users. About $2.85 billion of the affected funds had been frozen or intercepted as of 3 November 2026.

This page explains the incident, the recovery so far, and what to check in your own account. For Binance’s fees, features and licences, see our full Binance review, and for the wider question of holding crypto on any exchange, see our guide to exchange custody.

What happened to Binance on 29 October 2026?

On 29 October 2026, an attacker moved roughly $6.34 billion in digital assets out of Binance hot wallets, the always-online wallets used to settle customer withdrawals. It was not a private key leak. Binance says the attacker gained unauthorised access to an internal wallet signing service and issued transactions outside the normal withdrawal process.

Binance’s initial findings, published on 3 November 2026, say the attacker exploited Ethereum’s EIP-7702 authorisation mechanism to give an attacker-controlled smart contract partial execution rights over a hot wallet. The attacker submitted 50 signing transactions to manipulate the account nonce, then drained the wallet.

The affected hot wallet used multi-party computation (MPC), so there was no single private key Binance could revoke straight away. Suspending withdrawals alone could not stop on-chain movements, and Binance had to clear the delegation with a further transaction. You can read more on Ethereum mechanics in our Ethereum explainer.

How did the attackers get inside Binance?

The breach began with social engineering, not a key leak. In September 2026 a Binance engineer was contacted through a fake recruitment process and asked to download a “test assignment” containing malware onto a work computer. The attacker later used that access, plus a compromised internal developer tool, to reach the devices and container used to sign hot-wallet transactions.

Binance’s report and ForkLog’s account describe a multi-month operation. In June 2026 a different engineer downloaded a tampered Homebrew package while installing a coding tool; Binance spotted the anomaly, replaced the device and rotated credentials, but the attacker had already learned about staff working on wallet infrastructure.

In September 2026 the attacker posed as a “project director” on a legitimate employment platform, held two interview rounds, and after the second round asked the engineer to download a “test assignment” repository containing malicious code. On 20 October 2026 the attacker used a compromised device and an internal tool to take control of two more engineers and find a token that allowed container deployment. On 29 October 2026, using stolen credentials, they deployed a container and ran the script that interfered with transaction signing.

Security analysts point out that multi-signature and hardware security controls do not stop an attack launched from a compromised internal system. The weak point was people and processes, not cryptography.

How much was stolen, and how much has Binance recovered?

Binance puts the total affected at about $6.34 billion, with roughly $2.85 billion frozen or intercepted as of 3 November 2026. Binance said it set aside approximately $6.34 billion in company funds to cover the losses, and had replenished 98% of impacted token assets by 31 October 2026, absorbing the loss rather than deducting from customer balances.

Binance’s blog states clearly that it will “absorb the financial impact of the stolen funds, not our users.” The frozen figure is subject to reconciliation and price volatility, so it can change.

In its Recovery Update #4, Binance said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed at 100%, while the remaining small share consisted of less liquid tokens that take longer to source.

What happened minute by minute on 29 October 2026?

The unauthorised transfers ran in a tight window on the evening of 29 October 2026 UTC. Five hot wallets sent 233.46 million XRP between 20:05 and 20:09 UTC, separate Solana, Optimism and Bitcoin transfers followed, and the final 2,961.9 ETH confirmed on-chain at 23:56 UTC. Binance cleared the malicious delegation at 00:10 UTC on 30 October.

How does this compare with the Bybit and DMM Bitcoin hacks?

The Binance loss is far larger than earlier exchange hacks. Bybit lost about $1.5 billion on 21 February 2025, and Japan’s DMM Bitcoin lost about $308 million in 2024. The FBI named North Korea’s TraderTraitor group for the Bybit theft, and Binance says the FBI attributes the 2026 incident to North Korea too.

The Bybit theft is covered in detail in our Bybit hack explainer. The FBI’s February 2025 public service announcement put the Bybit figure at about $1.5 billion and asked exchanges and other firms to block addresses used to launder the funds.

Who was behind the Binance hack?

Binance’s blog says the FBI’s latest information points to North Korea as responsible, the same conclusion the FBI reached for the 2025 Bybit theft, where it named the TraderTraitor group. Binance says its team detected and blocked 57 suspected North Korea-linked cyber cases during 2026. No individual names have been made public.

This is official attribution, not speculation: Binance is relaying the FBI’s position in its own findings. Attribution can take weeks to finalise, and Binance says the investigation is ongoing and that some technical detail is being withheld to prevent copycat attacks.

What should users do now?

Binance says user funds are safe and it will absorb the loss, and withdrawals have resumed in phases, but a few checks are still worth making. Confirm your network is live again, review your account for activity you do not recognise, tighten login and API-key security, and treat any “refund” or “recovery” message as a likely phishing attempt. Never share a seed phrase or two-factor code.

Start with these steps:

• Check withdrawals. Confirm your asset and network have resumed on Binance’s withdrawal or network status page. Phase one on 1 November covered BTC, ETH, BSC, TRX, SOL, XRP, ZEC, DOGE, TON, Polygon, Avalanche, Arbitrum, Base, Optimism and SUI.
• Review account activity. Look at your login and device list, your withdrawal address whitelist and any API keys. Remove or revoke anything you do not recognise, then create fresh keys if you use them.
• Tighten sign-in. Enable or refresh two-factor authentication, and prefer an authenticator app or hardware security key over SMS.
• Ignore phishing. Scammers use big incidents to send fake “Binance security” emails asking you to “verify” your account or claim a refund. Binance will not ask for your seed phrase, password or two-factor code.

If you saw a transaction you did not make, revoke any API keys immediately and contact Binance support. On longer-term storage, decide whether self-custody suits you: our guide to moving crypto off an exchange and guide to storing a seed phrase walk through the steps and the risks.

For the broader question of exchange safety and how hot wallets differ from cold storage, see is it safe to keep crypto on an exchange and the wallet hub.