Binance hot wallet breach: what Binance and the FBI said

Binance, the world’s largest cryptocurrency exchange, announced that its hot wallet was breached around 20:05 UTC on Oct 29, 2026, and that tokens worth about $6.3 billion were withdrawn without authorization. Two days later, the FBI said North Korea was responsible for the theft. Plenty of reporting and analysis followed, but this article sticks to what Binance, the party involved, and the FBI, the investigating agency, said in their own statements, in date order. All times are UTC.

A hot wallet is a wallet kept online so it can answer user withdrawal requests right away. If the signing system that drives it is compromised, funds can leave even when the cryptography is sound, which makes it the part of an exchange that security teams worry about most. We do not include anything that could be used to reproduce the attack.

Oct 30: the cause stated in the first notice

Binance’s first notice described the initial findings this way: an attacker reached a service container through the compromised laptop of a DevOps engineer (a developer who runs the service) and used that path to submit unauthorized withdrawal transactions. It also said it found no evidence that the wallet’s private keys had leaked.

It estimated the total damage at about $6.3 billion, of which about $3 billion was frozen on-chain. It said the loss would be covered by Binance’s Secure Asset Fund for Users (SAFU) and company funds, not by users. Immediate steps it listed were pausing withdrawals, revoking permissions for the affected addresses, and bringing in law enforcement and blockchain analytics partners. Deposits were not affected, and it said a detailed technical post-mortem and an updated proof of reserves would follow once recovery was complete.

The second notice the same day: timing and additional compromise points

The second notice came from the co-CEOs and contains several new details.

• Timing: It said the hot wallet was breached around 20:05 UTC on Oct 29 and that unauthorized withdrawals took place.
• Cause revised: On top of the laptop first suspected, it said additional compromise points had been identified. The finding of no evidence of private key leakage still stood, and the investigation was ongoing.
• Containment: It said the compromised infrastructure was isolated and permissions revoked, and that services other than withdrawals were kept running.
• Coverage: It said it had secured more than $6.34 billion, covering about 80% of the impact, and was buying the remaining assets.
• Next steps: It targeted resuming withdrawals in stages about 34 hours after the notice, publishing proof-of-reserves snapshot results by Nov 2, and issuing further technical findings within about 48 hours.

What stands out in this notice is that the explanation of the cause widened within a day from “one laptop” to “multiple compromise points.” Binance has not said what exactly those points are, and this article does not speculate either.

Oct 31 and Nov 1: coverage ratio and resumed withdrawals

In the third notice (Oct 31), the coverage ratio rose to about 90%. Binance said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were 100% backed, and explained that the remaining 10% was in low-liquidity tokens outside the top 10 that would take longer to secure. The funding came from part of the SAFU fund, part of the futures insurance fund, and company funds, and Binance wrote that the company, not users, would absorb this financial hit. The proof-of-reserves snapshot was taken as of 00:00 UTC on Oct 31, and the full zero-knowledge proof was due by Nov 3. It promised to restore the SAFU fund to about $1 billion.

The fourth notice (Nov 1) covers resuming withdrawals. Phase 1 runs from 06:00 to 09:00 UTC on Nov 1 and opens the networks with the most recent user demand first. Phase 1 covers BTC, ETH, BSC, TRX, SOL, XRP, ZEC, DOGE, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, and SUI, with more to be added. It advised users to retry failed withdrawals after a short wait, since processing delays may occur. At that point the coverage ratio was about 95%, and Binance said deposits had stayed open from the start. It said the post-mortem would be published after the investigation ends.

The FBI statement: who is responsible and the request to block laundering

In its cyber alert, the FBI said North Korea (DPRK) was responsible for stealing more than $6 billion in virtual assets from Binance around Oct 29, 2026. The FBI calls this North Korean malicious activity TraderTraitor. Together with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), the FBI observed these actors converting the stolen assets mainly into Ether (ETH), and said further laundering through DeFi and instant exchange services is expected. To head this off, it urged the private sector to block the addresses used for laundering and the transactions to and from them, naming THORNode and RPC node operators, instant exchange services, DeFi services, and analytics firms.

Note that the attribution rests on the FBI’s statement. This article does not rely on any further details of the attack path or on analysis from other organizations.

Editorial commentary: what wallet operators should look at in this type of incident

What follows is not an official statement. It is commentary the editorial team drew up from general principles, and it does not evaluate Binance’s response. The path Binance described (operator device → service container → submitted withdrawal transactions) matches a structure often cited in exchange hot wallet incidents, so we turned it into questions you can apply to your own organization.

• Minimize the permissions that reach service containers and the withdrawal path from developer and operator devices, and split the stages so that one device cannot lead to the entire withdrawal flow.
• Separate the system that creates withdrawal requests from the system that approves signatures, and add an approval stage that independently verifies withdrawal limits and rate.
• Split signing systems and approval paths by chain and by wallet tier so that a breach in one place does not spread to every chain.
• Keep only what is needed in the hot wallet, move the rest to offline cold storage, and set up a procedure to top it up regularly.
• Rehearse in advance the procedure to revoke wallet address permissions in one step and halt withdrawals when a breach is suspected. Binance also mentioned pausing withdrawals and revoking permissions first in its first notice.
• Secure channels in advance to reach stablecoin issuers, chain analytics firms, and law enforcement the moment an incident happens. Binance listed the involvement of law enforcement and analytics partners in its first notice.
• Keep externally verifiable materials such as proof of reserves up to date in normal times, and be ready to publish the post-incident coverage status in numbers.

As a user, you can follow the guidance on the official channels, using as your yardsticks Binance’s statement that deposits were unaffected from the start and the fact that it updates the coverage ratio in each notice.