$6.36B left Binance in one night. Your wallet wasn't the target

About $6.36 billion left Binance hot wallets in a few hours on October 29, 2026. For most customers the key question is whether their own coins were exposed, and what, if anything, they should do this week.

Was your crypto at risk in the Binance hack, and what should you do now?

Your own private keys were not the target. On October 29, 2026, the attacker took about $6.36 billion from Binance-controlled hot wallets across ten blockchains, according to TRM Labs . Binance says it is covering the losses from its own funds . You don't need to do anything to be made whole. Your job right now is to avoid the scams that usually follow a hack like this.

Quick Answer: The Binance hack drained about $6.36B from the exchange's own hot wallets on Oct 29, 2026. No individual user keys were taken. Binance is covering the losses with its SAFU fund, its insurance fund and its treasury, so customers don't need to act. Ignore any message offering "hack compensation" or asking you to "verify" your wallet.

It is the largest crypto theft on record. The $6.36 billion total is roughly four times the size of the 2025 Bybit hack, which was about $1.5 billion . TRM Labs says the theft began at 20:05 UTC and a second wave followed at 23:05 UTC. The chains hit were Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon .

Figures are still changing as of November 4, 2026, and sources disagree on the details:

• Total stolen: estimates fall between about $6.3 billion and $6.4 billion. TRM Labs puts it at $6.36 billion .
• Frozen funds: TRM Labs says about $2.7 billion was frozen. Wikipedia says Tether and Circle froze roughly $3 billion .
• Coverage: on October 31, Binance said about 90% of affected assets were covered. It listed BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as 100% backed .

"Covered" means Binance is backing balances with its own money. It does not mean the stolen funds were recovered. TRM Labs estimates the attacker still controls about $2.4 billion .

That is why the headline says your wallet wasn't the target. The money came out of wallets Binance controls, through what TRM Labs calls a "compromise of Binance's hot wallet signing infrastructure." On Ethereum, the attacker used EIP-7702 delegation with 50 pre-signed authorizations . A customer's 2FA, password or withdrawal whitelist sits at the account level, so none of them could have stopped this. What protects you against a breach of the exchange itself is its reserves and how much money you keep on the platform.

Practical steps for this week:

• Do nothing to "claim" compensation. Binance says it is covering losses from its own funds.
• Treat every message about refunds, wallet checks or migration as phishing.
• Consider how much you keep on any one exchange. Later sections cover custody choices and the account settings that work.

What happened on Oct 29: how the largest crypto heist on record unfolded

On October 29, 2026, an attacker drained about USD 6.36 billion from Binance wallets on ten blockchains. That makes it the largest crypto theft on record. Blockchain analytics firm TRM Labs says the theft began at 20:05 UTC and a second wave followed at 23:05 UTC . The attacker reached the exchange's online "hot" wallets, which are the wallets an exchange keeps connected to the internet so it can process withdrawals quickly. They did not break into private keys held by individual users. The loss is about four times the roughly $1.5 billion taken from Bybit in 2025 .

Most of the money left in a short window. Wikipedia's account of the incident puts the bulk of the outflows between 8:05 and 8:20 p.m. UTC, which is about 15 minutes . The later wave at 23:05 UTC suggests the attacker still had access hours after the first drain began. TRM Labs lists ten affected networks :

• Ethereum
• Bitcoin
• Tron
• XRP Ledger
• Solana
• Arbitrum
• Avalanche
• Optimism
• Base
• Polygon

The attacker used different methods on different chains. On Ethereum, TRM Labs says they used EIP-7702 delegation with 50 pre-signed authorizations to take control of a hot wallet through a sweeper contract . EIP-7702 is an Ethereum upgrade that lets a regular wallet hand its execution logic to a smart contract. Once a wallet has signed that handoff, a sweeper contract can empty it automatically. On the other nine chains the stolen funds moved as ordinary signed transfers. TRM Labs says this points to a "compromise of Binance's hot wallet signing infrastructure," not a bug in any single blockchain. In other words, the attacker could sign transactions as Binance.

Binance's account of how the attacker got in has changed. At first the exchange blamed a software engineer's compromised laptop. On November 3 it said the attack vector was spear phishing, meaning a targeted message designed to trick a specific employee . Later coverage says the investigation found more than one point of breach, so the full picture may still change. In either version, the attack began with a person and a device, not a flaw in cryptography. That matters for your own security too, and later sections come back to it.

Investigators agree on who they think did it. TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a hacking unit backed by the North Korean state, and the FBI has also blamed North Korea . On November 3, North Korea officially denied any involvement . Attribution does not change what Binance customers need to do. It does explain the speed and scale of the attack and how the funds were laundered afterward, which the next section covers.

Where did the money go, and how much did Binance cover?

The stolen funds were split up and laundered within hours. Between about $2.7B and $3B was frozen, and the attacker still controls roughly $2.4B. According to TRM Labs, that remaining balance is mostly more than 420,000 ETH and 18,270 BTC . Separately, Binance says it has used its own money to back affected customer balances. That is not the same as getting the stolen coins back.

TRM Labs describes three laundering methods. First, the attacker sold stolen stablecoins for ETH through market makers at a discount of more than 10%. Second, the attacker supplied USDT to the lending protocol Aave. Third, the attacker split Bitcoin into smaller amounts using "peel chains," where a large balance is broken into many smaller transfers so it is harder to trace . Accepting a 10%+ loss to move quickly into ETH shows the attacker's priority: getting out of tokens an issuer can freeze before the issuer acts.

That rush makes sense, because freezes recovered a large share of the haul. TRM Labs puts the amount frozen by stablecoin issuers and Arbitrum's Security Council at about $2.7 billion. Wikipedia's account of the hack says Tether and Circle froze roughly $3 billion . The figures are still being revised, so the safest summary is a range of about $2.7–3B. Freezes only work on tokens whose issuer can block them. BTC and ETH have no central issuer, which is why most of the remaining $2.4B is held in those two assets.

Binance has said it will absorb the losses itself. On October 31 it said about 90% of affected assets were covered, with these assets at "100%" backing :

• BTC, ETH, BNB, SOL and XRP
• USDT, USDC, USD1 and RLUSD
• ZEC

According to CNBC, the money comes from three places: its SAFU (Secure Asset Fund for Users) reserve, part of its Futures insurance fund, and its corporate treasury. Binance has not said how many dollars came from each . "Covered" means Binance is backing your balance with its own funds. The stolen coins are still in the attacker's wallets or frozen by issuers.

Withdrawals restarted on November 1, beginning with Bitcoin . Customers moved quickly: Wikipedia reports $4.65 billion withdrawn in the first nine hours, while Bitcoin fell about 4–5% to below $80,000 . For traders, the takeaway is that an exchange making customers whole can still freeze withdrawals for days and coincide with a sharp price drop. Both affect open positions, even if no balance is lost.

Is this a pattern? Binance, Mercado Bitcoin and the $106M EU theft compared

Yes. These were three separate incidents in less than a week, and they share one pattern: attackers took money that sat in exchange-controlled hot wallets or exchange-held accounts. None of them took funds held in individuals' self-custodied keys. A hot wallet is an exchange wallet that stays connected to the internet so it can process withdrawals quickly. Brazil's Mercado Bitcoin lost hot-wallet funds on at least 10 blockchains on November 2. On November 1–2, a European entity was reported to have lost more than $106 million from accounts at several exchanges . The incidents differ in scale, in who carried them out, and in how well the losses have been confirmed.

Mercado Bitcoin (Brazil), November 2. An attacker drained the exchange's hot wallets across at least 10 chains. Mercado Bitcoin put the loss at about $38–40 million and said $11 million was frozen with help from Tether, Circle and Chainalysis, according to CoinDesk . On-chain analysts put the figure higher. Bitquery counts $48.6 million taken, mostly between 06:24 and 06:50 UTC, with $29.5 million of it from Ethereum . Arkham estimates about $46 million . The exchange suspended all services. It said no customer data leaked and promised that "no customer loses funds."

Bitquery found two details that should concern anyone with funds there. First, the exchange declared the attack contained at 12:56 UTC, yet a sweep of 36,042 Ethereum deposit addresses went on until about 16:56 UTC. Second, only $11.4 million (24%) was frozen. The remaining $37.2 million (76%) is still at risk, mostly in BTC, ETH and other tokens that no issuer can freeze . No one has been blamed for the attack, and no public evidence links it to the Binance breach.

The EU entity, November 1–2. Blockchain investigator ZachXBT reported that an unnamed EU entity, which could be a company, trading firm or fund, may have lost more than $106 million from accounts at several centralized exchanges . The attacker withdrew USDC, USDT and ETH, moved them through instant-swap services and the Wagyu conversion service, and converted part of the funds into Monero to break the trail. ZachXBT published 11 linked addresses and said "with a high degree of confidence it is NOT Lazarus Group," according to CoinDesk . Later reports say his estimate rose above $133 million, but that figure is not confirmed. The loss itself has not been independently verified, and neither the entity nor any exchange has commented. Ordinary retail customers do not appear to be affected.

For your own risk, the differences matter as much as the shared pattern. The Binance figure is confirmed on-chain and attributed to a state actor. Mercado Bitcoin's loss totals vary by about $10 million depending on the source, and no one has been blamed. The EU case is still a single investigator's report. In all three, the stablecoins were the easiest assets to freeze. Most of what was taken in native BTC and ETH is still in the attacker's hands.

Exchange custody or self-custody: which fits your holdings?

Keep the coins you actively trade on an exchange, and move the coins you plan to hold into self-custody, ideally on a hardware wallet. This is the main advice in coverage after the hack. Binance's Oct 29 breach took about USD 6.36 billion from the exchange's own hot wallets on ten blockchains , not from users' own keys (source: TRM Labs, 2026-10). Neither option removes risk. Each one puts the risk in a different place, so the right split depends on how you use your crypto.

Custody is a question of who holds the private keys that can move your coins. With exchange custody, the platform holds the keys and pools customer assets. With self-custody, you hold the keys yourself, usually in a wallet you control. The key question is which failure you can live with more easily: the exchange being breached, frozen or failing, or you losing your keys or signing a bad transaction.

"Once that system gets hacked, everybody's funds can be compromised," — Iman Shafiei, Keystone Research Group (source: CNN)

That is the case against leaving savings on any single platform. Binance covered the shortfall from its own reserves this time. Withdrawals were paused until Nov 1, when they restarted with Bitcoin first (source: CNBC, 2026-10). If you can't reach your money for days, that alone is a real cost for anyone who needs it.

Self-custody comes with its own duties. If you hold the keys, you also carry the signing risk. Coverage after the hack (source: Forbes, 2026-11) recommends two steps:

• Buy the hardware wallet directly from the manufacturer. Resold or second-hand devices may have been tampered with.
• Check the address and amount on the device's own screen before you approve. Your computer screen can be faked by malware. The device screen is the one to trust.

Five questions to decide your split

• Size of holdings: the bigger the balance, the more it costs you if one platform fails. A sum you couldn't afford to lose shouldn't sit on any one exchange.
• Trading frequency: if you trade every day, you need fast access, which favors keeping money on the exchange. If you rarely trade, there's little reason to.
• Technical comfort: self-custody only works if you can safely store a 12- or 24-word seed phrase offline and check each transaction on the device.
• Time horizon: coins held for months or years face exchange risk the whole time, for little benefit.
• Which failure you can tolerate: some people would rather trust a company with reserves than trust their own record-keeping. Others want no third party in the way.

Decision matrix: who should hold what, and where

• Active trader: keep working capital on the exchange and move profits to self-custody on a regular schedule. Trade-off: fast trading, but that balance stays exposed to platform breaches and withdrawal pauses.
• Long-term holder: keep most holdings on a hardware wallet bought from the manufacturer, and use the exchange only to buy and sell. Trade-off: little platform risk, but if you lose the seed phrase or approve a bad transaction, nobody can reverse it.
• Hybrid: split by purpose. Keep a small trading balance on one or two exchanges and put your savings in self-custody. Trade-off: more to manage, but no single failure can wipe out everything.
• Not yet comfortable with keys: stay on a large exchange with strong account protections while you practice self-custody with a small amount. Trade-off: you keep platform risk for now in exchange for not making beginner mistakes with keys.

Whichever profile fits you, how much you keep on the exchange is what decides your exposure to a breach like this one. How you protect the account itself is a separate question, and it matters for both groups.

Which account protections actually work? 2FA, whitelists, API keys and anti-phishing codes

The protections that work best are a FIDO2 hardware security key or passkey for login and a withdrawal address whitelist with a time delay. These two measures stop most attacks that rely on taking over a retail account. An anti-phishing code and API keys without withdrawal rights close the most common remaining gaps. None of these controls would have stopped the Oct 29 Binance theft, because the attacker compromised the exchange's own hot wallet signing systems, not customer logins . They protect you from the other risk: someone breaking into your own account.

Two-factor authentication (2FA) is a second proof of identity required on top of your password. The methods are not equally strong. According to post-hack guidance compiled by Forbes and CNN, they rank as follows :

1. FIDO2 hardware keys or passkeys: The key is tied to the real site's domain, so a lookalike phishing page cannot get a valid response from it.
2. Authenticator apps (TOTP): Much better than SMS. However, you can still be tricked into typing a six-digit code into a fake page in real time.
3. SMS codes: These are exposed to SIM-swap attacks, where someone moves your phone number to a device they control. Use SMS only if nothing else is offered.

A withdrawal address whitelist means funds can only leave your account to addresses you have approved in advance. Adding a new address should start a waiting period. If someone hijacks your session, they still cannot send coins to their own wallet right away, and the delay gives you time to notice the alert and lock the account. Treat any notice saying "new address added" that you didn't trigger as an emergency.

An anti-phishing code is a short phrase you choose in your exchange settings. The exchange then includes it in every genuine email it sends you. If an email claiming to be from your exchange doesn't show your phrase, it is fake. This matters right after a hack, when messages promising "hack compensation" or asking you to "verify" your wallet tend to appear. Binance has said it is covering losses from its own funds, and that users don't need to take any action .

API keys let trading bots and portfolio tools act on your account. Give every key only the permissions it needs, which is usually reading balances and placing trades. Never turn on withdrawal permission for a bot key. Restrict each key to your server's IP addresses where the exchange allows it. If a key with trading rights only is leaked, an attacker can place bad trades, but they cannot withdraw your funds.

These controls have one clear limit: they protect the door to your account, not the exchange's vault. TRM Labs traced the Binance theft across ten blockchains to a compromise of the exchange's hot wallet signing infrastructure. On Ethereum, this included 50 pre-signed EIP-7702 authorizations, which let the attacker control a hot wallet through a sweeper contract . Binance later said the entry point was spear phishing aimed at its staff, not at customers . In that kind of event, a perfectly secured account is still a claim on funds the platform has lost. What limits the damage then is how much you keep on the exchange and how deep its reserves are, not your 2FA settings.

What can't you control, and how do you limit exposure to an exchange breach?

You can't control whether an exchange's own hot wallets get breached. You can control how much of your money sits there when it happens. Binance said that on October 31, 2026 about 90% of affected assets were covered by its SAFU fund, part of its Futures insurance fund and its corporate treasury (source: CNBC, 2026-10). That backstop came from Binance's balance sheet. Your own settings played no part in it. A smaller platform with thinner reserves might not be able to do the same.

Recovery odds also depend on which asset was taken. A stablecoin freeze is when the issuer, such as Tether or Circle, blocks tokens at a specific address. That only works for tokens the issuer controls. Bitcoin and Ether have no issuer, so nobody can freeze them. The two recent hacks show the gap:

• Binance: about $2.7–3B was frozen, mostly in stablecoins . TRM Labs estimates the attacker still controls about $2.4B, mostly more than 420,000 ETH and 18,270 BTC .
• Mercado Bitcoin: Bitquery counts $11.4M (24%) frozen and $37.2M (76%) still at risk, mostly in BTC, ETH and other tokens no issuer can freeze .

In practice, money held on an exchange in USDT or USDC has a better chance of being recovered after a breach than the same value held in BTC or ETH. That holds only if the exchange can't cover the loss from its own funds.

You can't audit an exchange's signing systems, but you can limit how exposed you are to any one of them:

• Spread balances across venues. If you trade on two or three exchanges, a breach at one leaves only part of your trading float stuck.
• Withdraw profits on a schedule. A fixed routine, such as weekly or after every closed position, stops gains from piling up in a hot-wallet environment.
• Read reserve and coverage statements. Look for a named insurance fund, published proof-of-reserves and a stated policy on covering losses. Binance and Mercado Bitcoin both pledged to cover user losses (source: CoinDesk, 2026-11). Not every platform has the reserves to keep that kind of promise.

The same thing that got into Binance can get into you. The attack started with one compromised laptop and spear phishing aimed at staff, which is the same route attackers use against individual traders . Keep one clean device for crypto, with no pirated software, no browser extensions you don't need, and no opening of unsolicited files. Never approve a signing prompt you didn't start yourself. On Ethereum, a single authorization can hand over far more control than it seems to, which is how the EIP-7702 delegation trick worked on a much larger scale.

Attacks also tend to come in clusters. CoinDesk reported that the payment processor BTCPay was attacked after the Binance exploit . In the weeks after a major breach, treat every wallet connector, payment plugin and third-party integration you use as a higher-risk target.

Post-hack security checklist and scam watchlist

Most of what keeps your funds safe after a breach comes down to habits you can set up in one sitting. Start with your seed phrase, since it is the one credential that cannot be reset. Hackers don't need to break a hardware wallet if they can get the 12 or 24 recovery words. Keep those words offline, on paper or metal. Never type them into a website, a browser extension or a "support" form. Don't talk about how much you hold, online or in person. Post-hack coverage warns that physical "wrench" attacks on known holders are rising (source: Forbes, 2026-11).

The next risk is scams that follow the headlines. Ignore any message offering "hack compensation" or asking you to "verify your wallet" to qualify for a refund. Binance said it is covering affected assets from its SAFU fund, part of its Futures insurance fund and its corporate treasury, so users don't need to do anything to be made whole (source: CNBC, 2026-10). Any link, DM or email claiming otherwise is a phishing attempt. Binance has said the breach itself began with spear phishing .

The 10-minute checklist

1. Move long-term holdings off the exchange. Leave only your active trading balance on the platform. Send savings to a hardware wallet bought directly from the manufacturer, and check the address on the device's own screen before you approve.
2. Enable a hardware security key. Swap SMS or app-based 2FA for a FIDO2 key or passkey wherever your exchange supports it.
3. Turn on the withdrawal whitelist with a delay. That way, someone who takes over your account can't send funds to a new address right away.
4. Audit your API keys. Delete keys you don't use, and make sure no trading-bot key has withdrawal permission.
5. Set the anti-phishing code. Real exchange emails will then show your personal code. Treat any email without it as fake.
6. Review devices and sessions. Log out unknown sessions, remove old devices, and keep the machine you use for crypto free of unneeded extensions and software.

What to watch next

• Binance's final loss figure. TRM Labs puts the outflow at about USD 6.36 billion . Binance has not yet given a dollar breakdown of what each funding source is covering.
• More breach findings. Binance's explanation has already changed once, from a compromised laptop to spear phishing .
• The attacker's remaining funds. TRM estimates about USD 2.4 billion is still under the attacker's control, mostly in ETH and BTC, which no issuer can freeze (source: TRM Labs, 2026-10).
• Whether the EU theft is confirmed. As of November 4, 2026, neither the entity nor any exchange has publicly confirmed the more than $106M loss reported by ZachXBT (source: Decrypt, 2026-11).
• Who was behind Mercado Bitcoin. No one has been blamed yet. Bitquery estimates $37.2M of that loss is still at risk (source: Bitquery, 2026-11).

All three stories are still developing, and loss totals differ from source to source. Recheck the latest reporting before you act on any single figure. The main lesson stays the same whatever the final numbers: you can't stop an exchange from being breached. What you can control is how much you keep there and how hard your own account is to take over.

Frequently asked questions

Did I lose money in the Binance hack?

If your funds sat in a Binance account, Binance says it will take the loss itself. You don't need to do anything. On Oct 31, 2026, the exchange said about 90% of affected assets were covered. It said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were 100% backed. The money comes from its SAFU fund, part of its Futures insurance fund and its corporate treasury (source: CNBC, 2026-10). "Covered" means Binance backed the balances with its own money. It does not mean the stolen funds were recovered. Withdrawals restarted on Nov 1, 2026, starting with Bitcoin . Ignore any message that offers "hack compensation" or asks you to "verify" your wallet. Those are scams.

Would a hardware wallet have protected me from the Binance hack?

Yes. Coins held in your own hardware wallet were not in Binance's hot wallets, which the attacker drained on Oct 29, 2026. TRM Labs ties the theft to a "compromise of Binance's hot wallet signing infrastructure" across ten blockchains (source: TRM Labs, 2026-10). Self-custody doesn't remove risk. It moves the signing risk to you. Buy the device directly from the manufacturer, keep your seed phrase offline, and check every address and amount on the device's own screen before you approve (source: Forbes, 2026-11).

Is it safe to keep crypto on Binance now?

Binance says the assets it covered are backed. It reopened withdrawals on Nov 1, 2026, and Wikipedia reports $4.65 billion was withdrawn in the first nine hours (source: Wikipedia, 2026-11). Account security can't stop an exchange from being breached, so the practical rule is about how much you leave there. Keep only active trading balances on any exchange. Hold long-term savings in self-custody. Before you put more money on a platform, read its latest reserve and insurance-fund disclosures. Keystone Research Group's Iman Shafiei told CNN that with exchange custody, "once that system gets hacked, everybody's funds can be compromised" (source: CNN, 2026-10).

Can stolen BTC or ETH be frozen or recovered?

Not by an issuer. Only issuer-controlled tokens can be frozen. After the Binance hack, stablecoin issuers such as Tether and Circle froze their own tokens, with help from Arbitrum's Security Council. Estimates of the total range from about $2.7 billion (TRM Labs) to roughly $3 billion (Wikipedia) . No company can freeze BTC or ETH. That is why TRM Labs estimates the attacker still controls about $2.4 billion, mostly in more than 420,000 ETH and 18,270 BTC . The Mercado Bitcoin case shows the same split. Bitquery says $11.4 million was frozen and $37.2 million is still at risk, mostly in tokens no issuer can freeze (source: Bitquery, 2026-11).

What is the best way to secure my exchange account?

Layer your defenses so that one stolen password or one phishing link can't empty your account (source: Forbes, 2026-11):

• Strong 2FA: a FIDO2 hardware security key or a passkey is best. An authenticator app is next. SMS is the weakest option.
• Withdrawal address whitelist: turn it on, ideally with a time delay, so new addresses can't receive funds right away.
• Anti-phishing code: set one so you can tell genuine exchange emails from fakes.
• API keys: never give trading-bot keys withdrawal permission.
• Clean devices: use a dedicated, up-to-date device for crypto. The Binance breach began with one compromised laptop and spear phishing .

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe