Binance may have been hacked. The popular crypto exchange announced a "potential security issue" on Thursday, freezing withdrawals after an apparent hacker drained hot wallets of several billion dollars in cryptocurrency. As of 10:25 p.m ET / 7:25 p.m. PT, Binance states that the breach has impacted approximately $6.3 billion in funds.
The official Binance X account first acknowledged the issue at 5:15 p.m. ET / 2:15 p.m. PT. This came within minutes of reports that digital finance companies Tether and Circle Group had frozen significant amounts of their respective stablecoins in response to a potential hack — specifically about $971 million in Tether and $823 million in USD Coin.
Binance subsequently stated that a total of $2.54 billion had been frozen, warning that this number would potentially grow as assets were traced. By 8:52 p.m. ET / 5:52 p.m. PT, Binance approximately $3 billion had been verified as frozen.
"Our teams are aware of reports of a potential security issue and are actively investigating," Binance wrote. "Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information."
This Tweet is currently unavailable. It might be loading or has been removed.
Few details about the hack were initially available. However, the ostensible hacker's wallet held $1.77 billion in Tether, $1.44 billion in Bitcoin, and $1.01 billion in Ethereum, as well as over a billion more spread across other currencies such as USD Coin, Tron, and Solana.
These assets were reportedly drained from hot wallets: cryptocurrency wallets that are connected to the internet. Compared to offline cold wallets, they are significantly more practical for conducting transactions on exchanges such as Binance. However, they are also less secure.
Binance co-founder and former CEO Changpeng Zhao has stated that it "does look like a hack," but maintained a positive outlook on the situation.
"I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered," Zhao wrote on X.
In an update at 6:33 p.m. ET / 3:33 p.m. PT., Binance stated that its team was conducting security checks, and attempted to reassure anxious users.
"Withdrawals will resume as soon as the security issue is fully resolved," it wrote. "User funds remain safe."
Binance later announced at 7:06 p.m. ET / 4:06 p.m. PT that it had suspended Binance Alpha trading, which would "resume once the security issue is resolved." Binance Alpha is a platform dedicated to highlighting early-stage crypto projects, which are not yet listed on the Binance exchange.
This freeze was extended to all transactions on Binance a little over an hour later, the exchange stating that it would "cover all losses."
"As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement," Binance posted at 8:13 p.m. ET / 5:13 p.m. PT. "This is an industry-wide effort, and we are grateful to partners across the ecosystem who have moved quickly to help freeze affected assets."
This Tweet is currently unavailable. It might be loading or has been removed.
This Tweet is currently unavailable. It might be loading or has been removed.
This Tweet is currently unavailable. It might be loading or has been removed.
Over five hours after Binance first acknowledged the incident, the exchange stated it may have found the source of the breach: a compromised laptop.
"Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance posted at 10:25 p.m ET / 7:25 p.m. PT. "We have found no evidence of any wallet private key leak."
It further stated that it had revoked the authorisation of the potential hacker's crypto address, and elaborated on its commitment to cover any losses.
"Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe," Binance wrote in a blog post. "We will also publish an updated Proof of Reserves once the remediation is complete."
The SAFU (aka Secure Asset Fund for Users) is Binance's emergency reserve fund specifically for compensating impacted individuals in the event of severe breaches such as this. Held entirely in Bitcoin, SAFU's assets were valued at $1 billion earlier this month — a sixth of the amount impacted by Thursday's hack. Binance previously stated that it would replenish SAFU if it dropped below $800 million, "helping maintain the fund at a level intended to cover potential extreme-case scenarios."
This Tweet is currently unavailable. It might be loading or has been removed.
Binance's operations continued to be disrupted through the night. On Friday, 12:36 a.m ET / Thursday, 9:36 p.m. PT, the exchange announced that users could now make deposits, but withdrawals remained paused while it conducted a "security revamp" of the service. Withdrawals are expected to resume within 48 hours of this update.
"The incident stems from multiple factors," wrote Binance, offering further information on the breach's origin. "Our security team is tracing the full attack path through the compromised computer which may be the entry point of the incident. A comprehensive report with the root cause will follow."
UPDATE: Oct. 30, 2026, 2:48 p.m. AEDT This article had been updated to add further developments.
UPDATE: Oct. 30, 2026, 4:08 p.m. AEDT This article had been updated to add further developments.