Binance Hack 2026: $6.3 Billion Stolen, and the Scam Messages That Come Next
Binance says a compromised laptop led to $6.3 billion stolen. User funds are safe. Watch out for fake support and recovery scams.
Key takeaways
- Binance says a compromised DevOps engineer's laptop allowed an attacker to submit unauthorized withdrawals. Estimated impact: around $6.3 billion. About $3 billion has been frozen on-chain. Binance will cover all losses from the SAFU fund and company funds. User funds are safe.
- Blockchain analytics firms link the attack to North Korea's TraderTraitor group, but attribution has not been officially confirmed. The incident hit Binance.com. Binance.US was not affected.
- After any big hack, watch for fake 'your funds are at risk' messages, fake support accounts, and fake recovery services. Never share passwords, 2FA codes, or your recovery phrase. Check updates through the Binance app or a website address you already trust.
Last checked: Oct 30, 2026. Based on Binance's official announcement and reporting from BBC News, BleepingComputer, CNBC, Chainalysis, and Malwarebytes.
On October 29, 2026, Binance experienced what appears to be the largest cryptocurrency theft on record.
According to Binance's Security Incident Update posted October 30, 2026, the company's initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."
Binance says there is "no evidence of any wallet private key leak." The estimated total impact is around $6.3 billion. About $3 billion has been frozen on-chain so far. Binance says it "will cover all losses from the SAFU fund and the company's funds. User funds are safe."
Withdrawals were temporarily suspended while security checks were completed. Binance says it is working with law enforcement and blockchain intelligence partners.
How the attack happened
BBC News reported that Binance is the world's largest crypto exchange by trading volume, with hundreds of millions of registered users. The hack hit Binance.com. Binance.US said it was not affected.
Binance co-CEO Richard Teng later said the hack was "not carried out by one person" and was a "more complex attack process," according to BBC News. A subsequent investigation "uncovered additional points of breach."
BleepingComputer reported that TRM Labs tracked about $6.36 billion moving out of Binance wallets on ten blockchains, most of it within about 20 minutes starting at 20:05 UTC on October 29.
BleepingComputer notes this is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Attribution to North Korea
TRM Labs attributes the attack to TraderTraitor, a North Korea-linked group. Chainalysis confirms "with a high degree of confidence," according to BleepingComputer.
BBC News reports that this attribution is from analytics firms and has not been officially confirmed.
What funds can be recovered
CNBC reports that frozen stablecoins are most recoverable. Returning funds can take months or years, according to Chainalysis' Eric Jardine.
Scams that follow a big hack
After any major crypto incident, expect a wave of fake messages, support accounts, and recovery offers.
BBC News quoted NordVPN CTO Marijus Briedis warning to look out for:
- An email claiming your funds are at risk
- A fake support account offering help
- A message urging you to move your cryptocurrency to a "safe" wallet
Briedis said: "Check updates through the Binance app or a website address you already trust." And: "Avoid links in unsolicited messages, and never give anyone your password, verification codes or wallet recovery phrase."
Chainalysis and Malwarebytes both echo similar warnings: watch out for fake support or recovery offers, never give anyone your authentication codes, and be wary of anyone promising to recover crypto. The FBI has previously warned about fake recovery services that emerge after crypto thefts.
Common scam tactics
Here are the patterns to watch for:
- Fake "your funds are at risk" emails or texts that push you to act fast.
- Fake support accounts on X, Telegram, or WhatsApp offering to "help" or "secure" your account.
- "Move to a safe wallet" messages designed to trick you into transferring crypto to an attacker's address.
- Fake compensation, refund, or recovery services promising to get back stolen funds.
Practical steps
- Never share passwords, 2FA codes, or a recovery phrase. Real support will never ask for these.
- Never move crypto because a message says so. Open the app or type the site yourself.
- Set Binance's anti-phishing code if you use the exchange. This adds a personalized word or code to official Binance emails.
- Use app-based 2FA or passkeys instead of SMS where possible. They are harder to intercept.
- Check what personal details about you are listed online. Scammers personalize messages using emails, phone numbers, and addresses they find on people-search sites and data brokers. Removing those listings makes phishing attempts less convincing.
UndoLeak erases your data from data brokers and keeps it off. See where you're listed with a free scan.
Sources
All facts in this article come from the following sources:
- Binance Security Incident Update (2026-10-30)
- Who could be behind the Binance hack and what we know so far
- Binance links $6.3 billion crypto theft to compromised DevOps laptop
- Billions in crypto frozen in Binance hack: Here's what happens next
- Binance Exploit: Latest Findings and Response
- Binance Hit by Largest Ever Crypto Theft with $6.3 Billion Stolen
Related
- Coinbase Data Breach 2026: What the Amplitude Leak Exposed
- How Scammers Know Your Mom's Name (And Use Data Brokers to Target You)
Not affiliated with Binance.
Frequently asked questions
What happened in the Binance hack?
Binance's initial investigation suggests a compromised DevOps engineer's laptop allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. The estimated total impact is around $6.3 billion. About $3 billion has been frozen on-chain. Binance says it will cover all losses from the SAFU fund and company funds, and user funds are safe.
Were Binance user funds stolen?
Binance says user funds are safe and will cover all losses from the SAFU fund and company funds. Withdrawals were temporarily suspended while security checks were completed.
Who is behind the Binance hack?
Blockchain analytics firms TRM Labs and Chainalysis link the attack to TraderTraitor, a North Korea-linked group. This attribution has not been officially confirmed.
How much was stolen in the Binance hack?
According to TRM Labs, about $6.36 billion was moved out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC on October 29, 2026. Binance's initial investigation estimates the total impact at around $6.3 billion, with about $3 billion frozen on-chain.
Is this the largest crypto theft ever?
Yes. BleepingComputer reports this is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Was Binance.US affected?
No. BBC News reports Binance.US said it was not affected. The hack hit Binance.com.
What should I do if I get a message about my Binance account?
Check updates through the Binance app or a website address you already trust. Avoid links in unsolicited messages. Never give anyone your password, verification codes, or wallet recovery phrase. If you use Binance, set up an anti-phishing code and use app-based 2FA or passkeys.
Are fake Binance support messages a real risk?
Yes. NordVPN CTO Marijus Briedis warned to look out for emails claiming your funds are at risk, fake support accounts offering help, and messages urging you to move cryptocurrency to a 'safe' wallet. The FBI has also warned about fake recovery services after crypto thefts.
undoleak Team
