Binance Hack: What We Know, What We Don’t, and What It Means for Crypto Users

Crypto has a long history of bad days, but a breach at the largest exchange in the industry sits in a different category. On Thursday, October 29, 2026, Binance confirmed it was dealing with a security incident after users reported funds leaving its wallets. By Friday morning, the story had moved from a technical incident to a question the whole market cares about: how much was taken, who took it, and who ultimately bears the loss.

This article separates what has been reported by credible outlets from what is still speculation. That distinction matters here more than usual. In the first hours of any exchange breach, numbers are revised, attributions are tentative, and reassurances are tested. Anyone making decisions on the basis of a headline, whether a retail holder or a corporate treasurer, should know which parts of the picture are firm.

What happened: the confirmed timeline

According to TechCrunch, Binance confirmed the incident after users reported funds being drained from its wallets. The company’s initial statement said it was “aware of reports of a potential security issue and are actively investigating,” and added that user funds are safe, while urging customers to avoid unofficial links and any request for account information. That last warning is standard practice, and it is sensible: phishing campaigns reliably follow major breaches, because panicked users are easy targets.

Binance spokesperson Ross O’Leary said the exchange “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.” Pausing withdrawals is the standard containment move. It stops stolen funds from being moved further and gives security teams time to work out which keys, systems or integrations were compromised. It is also painful for customers, who cannot move their assets at the moment they most want to.

Changpeng Zhao, who no longer runs Binance but remains its largest shareholder, said on X that the company had likely been hacked. He said he expects users’ funds to be “fully covered,” but offered no explanation of how. That statement is a signal worth noting, but it is not a guarantee. It comes from a major shareholder, not from an audited statement of the exchange’s reserves or a formal commitment.

How big is the loss?

Crypto watchers cited by TechCrunch say at least $2 billion has been drained from Binance’s hot wallets, with some estimates reaching $5.7 billion. These figures are unconfirmed, and the reporting notes the theft may still be ongoing. Binance has not published a loss figure.

The comparison point is the February 2025 theft from Bybit, about $1.4 billion by TechCrunch’s figure and often rounded to $1.5 billion elsewhere, which the FBI attributed to North Korea’s TraderTraitor activity. If Binance’s losses are confirmed in the billions, this incident would likely rank among the largest crypto breaches on record, and at the low end of current estimates it would already exceed the Bybit theft.

Two details suggest the industry’s response machinery is working. Circle froze about $800 million in Tether as it moved through its networks, and Tether itself froze about $1.56 billion related to the hack. Stablecoin issuers can freeze tokens that sit in their contracts, which is a real advantage over native assets such as bitcoin or ether. Frozen funds may not all be recoverable, and some of the frozen amounts may overlap, so these figures should not be added to the loss estimate or subtracted from it without confirmation.

Who is behind it? The TraderTraitor attribution

The BBC reported that two analytics firms have attributed the incident to a North Korean hacking unit called TraderTraitor. Binance itself did not say whether it had received any contact from the attackers, and TechCrunch’s report said it was unclear who was responsible. Attribution in the first day should be read as a working hypothesis from blockchain forensics, not a legal finding.

The reasoning is pattern-based. TraderTraitor is the label the FBI used for the group behind the Bybit theft. In September 2026, Elliptic assessed that a $357 million hack of the exchange Bitget pointed toward the same group, calling the link highly likely rather than confirmed. When on-chain behaviour, laundering routes and tooling resemble a known actor’s earlier operations, analytics firms say so quickly, because speed helps exchanges and issuers decide what to freeze.

The strategic context is that state-linked groups have turned exchange theft into a revenue stream. Chainalysis has estimated that North Korea-linked hackers took $1.34 billion across 47 attacks in a single year. A breach of the largest exchange fits that profile, but the claim has not been proven in this case, and users should be wary of any account that states it as settled.

A second incident the same day: Polymarket

Earlier on Thursday, the prediction market Polymarket briefly halted trading and paused withdrawals after a third-party company was compromised. Security researchers said hackers stole about $2 million in user funds through software developed by DebugBear. TechCrunch reported it as a separate incident, and nothing in the reporting links it to the Binance breach.

It is nonetheless instructive. The Polymarket loss was small next to Binance’s, but the route was the same one that has produced several large incidents: not the platform’s own core code, but a supplier whose software the platform trusted. For finance and risk teams, the lesson is that your exposure includes the weakest vendor in the chain.

What this means if you hold funds on an exchange

If you have assets at Binance, the practical position today is uncertain but not hopeless. The company says user funds are safe, a major shareholder expects full coverage, and stablecoin issuers have frozen large sums. Against that, withdrawals are paused, the full extent of the loss is unknown, and the theft may be ongoing. A sensible approach for individuals is:

• Do not click links in emails, messages or social posts about the incident. Go to the exchange only through a bookmark or typed address. Binance itself warned against unofficial links.
• Do not hand over seed phrases, codes or credentials to anyone claiming to be support staff or a recovery service. Recovery scams spike after breaches.
• Check your account security settings, including two-factor authentication and withdrawal address allow-lists, once access is stable. The breach was reportedly at the exchange’s wallets, not individual accounts, but attackers often probe both.
• Keep records. Screenshots of balances and transaction histories will matter if claims, tax treatment or compensation processes follow.
• Avoid panic decisions. Selling into a halted market, or paying a premium to move funds through an intermediary, can lock in losses that a coverage announcement might have avoided.

What this means for companies and treasurers

Businesses that hold crypto for payments, treasury or customer settlements face a different set of questions. First, concentration: how much of your digital-asset balance sits with a single venue, and could you operate if withdrawals froze for days? Second, custody terms: whether your assets are held in your name, whether they are segregated, and what the agreement says about hacks. Many users have never read these clauses until a day like this.

Third, insurance. Policies for crypto custody are specialised and often limited, and general cyber policies commonly carry exclusions or sublimits that surprise buyers. We cover the broader cyber market in our companion piece on cyber risk insurance. The short version is that “insured” is not a single status: it depends on what is covered, who is the insured party, and what the cap is.

Fourth, accounting and disclosure. If you had assets on a venue that suspended withdrawals, you may need to consider whether those balances are impaired, how to classify them, and what to tell auditors, lenders and boards. Our guide to crypto exchange security and fees covers the questions to ask custodians before an incident rather than after.

The wider market questions

For the market, the key unknowns are these. Will Binance reopen withdrawals quickly and in full? If it does, and users see funds return, confidence may recover faster than the headline loss suggests. If reopening is staged or delayed, the pressure moves from the exchange to the assets traded on it and to competing venues that may see inflows or outflows. TechCrunch’s report did not cover price or trading effects, so we do not know yet how the market has responded.

There is also a policy dimension. Each large breach strengthens the case for tighter rules on custody, proof of reserves and incident reporting. Regulators in several jurisdictions have been building these frameworks, and a billion-dollar loss at the largest venue will be cited in every consultation that follows. Exchanges that already hold the strictest controls will argue the incident proves the case for regulation, while critics will argue it proves the opposite: that size alone does not buy security.

Lessons that outlast this week

Whatever the final numbers, several lessons are already visible. Hot wallets are the soft target: they must be connected to be useful, so they carry the highest risk, and exchanges are judged on how little they keep there. Recovery depends on speed, and stablecoin freezes show how much value is protected when issuers and analysts act within hours. Third-party risk is real, as the Polymarket incident shows. And communication matters: a clear, frequent, honest update schedule does more to protect customer trust than any single reassurance.

For individuals, the oldest rule still applies: an exchange balance is a claim on the exchange, not custody of your assets. For anything you cannot afford to have frozen, hardware wallets and self-custody remain the alternative, with their own responsibilities.

What to watch next

• An official loss figure and a statement on whether the theft has stopped.
• A timetable for reopening withdrawals across all affected networks.
• Any formal statement on how losses will be covered, and from what resources.
• Confirmation or rejection of the TraderTraitor attribution by law enforcement.
• Further stablecoin freezes and any recovery of stolen assets.
• Regulatory responses in the exchange’s major markets.

We will update our guidance as verified information emerges. Until then, the safest assumption is that the situation is still developing, that today’s numbers will change, and that the most valuable thing any user or company can do is avoid irreversible moves based on incomplete information.

Sources: TechCrunch, BBC News and analytics-firm reporting as of October 30, 2026. Figures are unconfirmed estimates unless stated. This article is general information, not financial or investment advice.