Binance begins recovering assets after suspected ~$3B hack
Binance said it has begun recovering affected assets for users after the suspected hack of its hot wallets late on October 29, 2026, and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover funds, publicly committing to cover all losses. The exchange confirmed its SAFU fund transfer is complete, clarifying that the large 7,499 BTC movement flagged on the Bitcoin blockchain was this transfer of its user insurance reserve.
- Verified frozen figure stands at around $3 billion, revising an earlier $2.54 billion confirmation, with estimated total impact reported at around $6.3 billion; Binance says it set aside $6.34B in company funds, with its latest update reporting 90% of stolen assets replenished and a Proof of Reserves snapshot provided
- Initial investigation suggested a compromised DevOps engineer's laptop; a later update described a complex attack with additional points of breach, but no evidence of wallet private key compromise
- Deposits operate normally; withdrawals remain paused while Binance completes a security revamp of its withdrawal service, expected to resume within 48 hours
- Binance Alpha trading remains suspended; a full post-mortem is promised
Sources
- Update: SAFU fund transfer is complete - this was the large 7,499 $BTC transfer visible here: https://t.co/WIUQHtGE7O https://t.co/WOHKdQLiSGx.com ↗
- Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through https://t.co/UqtBd37Fpjx.com ↗
- Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination https://t.co/FQQ3vKT6GUx.com ↗
- Service Update Deposits remain unaffected and continue to operate as normal. Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details. https://t.co/XIPgMvK7mAx.com ↗
- Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private https://t.co/5REncAI77y
