The $6.3 billion Binance hack: what happened, and the scams that come next

October 31, 2026 · 5 min read

Thieves took about $6.3 billion from Binance on Oct 29. Here is what happened, what Binance told customers, and the fake support calls and refund pages to watch for now.

What happened

On Wednesday, October 29, 2026, thieves took about $6.3 billion in crypto from Binance, the world's biggest crypto exchange. Most of it left in about 20 minutes, starting a little after 4 PM Eastern time, from Binance wallets on ten different blockchains. It is the largest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025.

Binance's first investigation points to one engineer's laptop. The attackers got into it and used it to start withdrawals that looked real. Binance says it found no sign that its wallet keys were leaked. The blockchain investigators at TRM Labs say, "with high confidence," that the attack came from TraderTraitor, a North Korean hacking unit the FBI also blamed for the Bybit theft. Binance has not named the attackers.

Where the money is now

About $2.7 to $3 billion was frozen within hours. Tether and Circle, the companies behind the USDT and USDC dollar coins, locked the stolen coins so they can't be used. Ripple, World Liberty Financial and Arbitrum froze smaller amounts.
About $2.4 billion is still with the attackers, mostly Ethereum and Bitcoin, and they are moving it through swaps, lending apps and many small hops to hide where it goes.
Bitcoin dropped about 5% after the news, to under $77,000.

What Binance told its customers

"User funds are safe." Binance says it will cover all losses with its user protection fund (SAFU) and its own money.
Deposits and withdrawals were paused while it runs security checks. Binance said withdrawals should come back this weekend, in steps.
It will publish a new proof of reserves and a full report on how the attack happened.

The real danger for regular people: the scams that come next

When a big hack hits the news, scammers move fast. They know millions of people are worried about their money, and worried people click. Security researchers warn about these tricks after every large exchange hack:

Fake "Binance support." A call, text, email, WhatsApp or Telegram message says your account "was affected by the breach" and must be "verified" or "unlocked." What they really want: your password, the 6-digit code from your phone, or remote access to your computer.
Fake refund or compensation pages. An ad or email says "claim your refund here." The page copies the Binance login, or asks you to "connect your wallet" and approve something. That approval lets them empty your wallet.
"Move your funds to a safe wallet." Someone sends you a new address to protect your coins. It's their wallet.
"Recovery experts." Strangers offer to trace and get back your crypto for a fee. Binance says it covers losses itself, so there is nothing to recover. You pay, they disappear.
Fake "withdrawals are open again" news with a link and a deadline, leading to a fake login page.

What to do right now

Don't trust any call or message about the hack that you didn't start. Hang up. Open the Binance app yourself, or type the website yourself.
Never share your password, the code from your phone, or your recovery words (seed phrase). No real company ever asks for them.
Never install AnyDesk, TeamViewer or any program a "support agent" asks you to install.
Never pay a fee to get a refund or "release" your money.
Turn on two-step login and use a password you don't use anywhere else.
Keep on an exchange only what you need for trading. Long-term savings are safer in a wallet you control.
If you already gave something away: change your password and two-step login from a device you trust, check your login history and withdrawal list, and move what's left to a new wallet. Then report it at ic3.gov (FBI) and reportfraud.ftc.gov (FTC).

How Danilli helps

This is exactly why we built Danilli Shield. Paste any message, link or phone number and ask "is this real?" Danilli tells you in plain words, before you click. If a scammer calls, the Security Agent can answer for you, and if you got scammed, Danilli writes your FBI and FTC report, ready to send. It's free to try.

One honest note: nobody can get back crypto that was already sent, and anyone who promises to "recover" it for a fee is the next scam. The best protection is stopping it before it happens.

This article is information, not financial advice. Numbers come from the sources below and may change as the investigation goes on.

Sources

Ask Danilli about it

Questions about this story? Danilli reads the news every day and answers in plain English or Spanish.

Try Danilli free

Written with Danilli's AI from the sources listed above, then published automatically. News changes fast: check the sources for the latest. This is information, not financial advice.