Binance Hack 2026: The Biggest Crypto Hack in History, Explained

Binance Hack 2026: The Biggest Crypto Hack in History, Explained

How hackers drained about $6.3 billion from Binance, who's behind it, what it means for your money and why it matters far beyond crypto. Every figure was checked on October 30, 2026.

Yes, Binance was hacked.

On October 29, 2026, attackers drained about $6.3 billion from its hot wallets in the biggest hack in history. Binance says user funds are safe and that it will cover every loss. Blockchain analysts blame North Korea's Lazarus Group.

We stand with everyone affected: the users waiting on their funds and the engineers and investigators working through the night. A theft by a state hacking unit is an attack on the whole industry, not just 1 exchange.

What We Know So Far

• What happened: about $6.3 billion in crypto left Binance's hot wallets across 10 blockchains, starting at 20:05 UTC on October 29 (TRM Labs).
• How big: roughly 4 times the $1.5 billion Bybit hack of February 2025, the previous record. TRM Labs calls it the largest hack in history.
• Who did it: TRM Labs and Chainalysis blame North Korea's Lazarus Group, specifically its TraderTraitor unit, with "high confidence" (CNN).
• How they got in: Binance first pointed to a compromised engineer's laptop. On October 30 it said its investigation had found additional points of breach. It says no private keys leaked (CoinDesk).
• What's frozen: about $3 billion, mostly stablecoins locked by Tether and Circle.
• Your funds: Binance says user funds are safe and that its SAFU fund and company money will cover all losses.
• Withdrawals: paused on all networks. Binance says it's on track to reopen them in about 45 hours from its October 30 update, so around November 1. Deposits work as normal.
• Markets: Bitcoin fell 4.8% to below $77,000, Ether 5.7% and BNB up to 10% (CoinDesk).

Binance hack timeline hour by hour, from the first outflow to all withdrawals paused

New to Crypto? 7 Terms to Know

• Exchange: a company, like Binance, that holds your crypto and lets you trade it.
• Hot wallet: an exchange wallet kept online so withdrawals go through fast. That speed is what makes it a target.
• Private key: the secret code that controls a wallet. Whoever holds it controls the money.
• Self-custody: holding your own keys, usually on a hardware wallet, instead of trusting an exchange.
• Stablecoin: a token built to stay at $1, like USDT or USDC. The company behind it can freeze it.
• SAFU: Binance's emergency fund, named after crypto slang for "safe".
• Lazarus Group: North Korea's state hacking operation, blamed for the biggest crypto thefts on record.

What Happened: The Night Binance Was Drained

At 20:05 UTC on Thursday, October 29, block explorers started showing something nobody had seen before: Binance's hot wallets emptying across 10 blockchains at once. Most of the money was gone within about 20 minutes. A second wave hit Binance's Avalanche and Polygon wallets about 3 hours later (TRM Labs).

When the outflows stopped, trackers put the damage at $5.9 billion to $6.4 billion. Binance's own estimate was "around $6.3B" (Bitcoin.com). It was instantly the biggest hack in history, crypto or otherwise.

The first public reactions came fast, and they didn't all match:

• Binance: "user funds are completely safe" (TechCrunch).
• Co-CEO Yi He: Binance will cover "all hacking losses" (CoinDesk).
• Founder Changpeng Zhao (CZ): "It does look like a hack on Binance" and "as a shareholder, I expect all user funds will be fully covered" (Al Jazeera).

AFP described Binance's posts as "sometimes contradictory" (AFP). But the message users heard was the slogan Binance has repeated for 8 years: funds are SAFU.

New to crypto? "SAFU" is crypto slang for "safe" that started as a 2018 meme. It's also the name of Binance's emergency fund, the Secure Asset Fund for Users.

Behind the scenes, CZ said Yi He, Binance's co-founder, co-CEO and his partner, worked through the night with hundreds of staff (CZ on X):

"User funds are SAFU! Yet, this pregnant lady pulled an all nighter, along side hundreds of Binancians."

He also credited the rest of the industry:

"Many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help."

His summary of the night:

"It hurts, but we will survive." CZ, on 𝕏.

How Did Hackers Get Into Binance?

Not by breaking Binance's encryption.

Binance's early finding is that the attackers went through a person: a DevOps engineer whose laptop was compromised (Bitcoin.com). Binance says it found no evidence that any wallet private key leaked.

Update, October 30: the laptop was only part of it.

• Binance's latest update says its investigation "has uncovered additional points of breach" beyond the laptop and calls it "a complex attack" (Binance on X).
• Co-CEO Richard Teng says the attacker "did not simply use one engineer's permissions" and that it "was not a single 'one-click' action" (Richard Teng on X).
• Binance hasn't blamed any individual. It still says it has found no evidence of a wallet private key leak.

On 𝕏, Matthew Madera asked what many traders were thinking:

"After years of repeated CEX hacks, I still don't understand how outgoing transfers of this size can happen without independent human review and signing. Where are the circuit breakers? Why aren't unusually large withdrawals automatically delayed, queued for review and subject to additional approval, especially when funds are moving to a new address?"

"Withdrawing $5,000 from a bank can involve questions and a manager's approval. Yet somehow, $100 million++++ can flow out of an exchange to an unfamiliar address in seconds. Make it make sense. Please." (Matthew Madera on X)

Here's the first path Binance described, before it found more points of breach:

1. The laptop: attackers compromised the laptop of a Binance DevOps engineer. DevOps staff keep an exchange's servers and deployments running, so their machines can reach places customers never see.
2. The container: from that laptop, the attackers reached a service container, a piece of Binance's internal infrastructure.
3. The withdrawals: through it, they submitted withdrawal transactions that Binance's systems processed as if they were real. The money left the hot wallets directly.

Binance hack attack path from a compromised laptop and other breach points to hot wallets on 10 blockchains

In plain English: the vault door held. The attackers stole a staff member's badge, found other ways in that Binance hasn't detailed yet and asked the vault to open itself.

For the technical crowd, TRM Labs' on-chain analysis shows how it played out (TRM Labs):

• EIP-7702 on Ethereum: the attacker used this Ethereum feature, which lets a wallet hand its powers to a smart contract, to point a Binance hot wallet at a "sweeper" contract.
• Pre-signed and ready: they prepared 50 signed authorisations in advance. 1 matched the wallet's transaction count and went through.
• 1 transfer, 167,464 ETH: about 3 minutes later, a single transfer moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT.
• The other 9 chains: money left through ordinary signed transfers. TRM says that points to a compromise of Binance's hot wallet signing infrastructure, not of the blockchains themselves.
• Planned in advance: preparation started at least 36 hours earlier, with small Tornado Cash withdrawals that funded the attackers' wallets.

The 50-ticket trick, in plain English: every Ethereum wallet numbers its transactions in order, like tickets in a queue. The attacker didn't know which number Binance's wallet would be on next, so they prepared 50 signed tickets in a row and sent them all at once. 1 matched, and that was enough to hand the wallet's controls to the attacker's contract.

How Could This Happen?

Ask a bank for a large cash withdrawal and someone will want to know why. On October 29, billions left Binance in about 20 minutes. Binance's post-mortem will have to explain that gap. Until then, these are the questions every exchange should be asking:

• Where were the circuit breakers? Unusually large withdrawals, especially to brand-new addresses, can be delayed, queued for review or held for extra approval. Whatever limits Binance had didn't stop this.
• Was 1 laptop really enough? Binance now says no: it has found additional points of breach. Big transfers normally need several independent people or machines to sign off, so the real question is how many of those checks failed.
• Why was so much money online? Hot wallets need enough for everyday withdrawals, not billions. The rest belongs in cold storage or in MPC wallets with qualified custodians, which split signing power so no single machine can move funds.
• Is SAFU a plan or a backstop? Emergency funds help after the damage is done. At this scale, prevention is the only plan that works.
• Why does every exchange defend alone? Exchanges compete hard on listings and marketing but share no common security standard. A cross-exchange security council would be a start.
• Is AI really to blame? AI makes attacks faster, but this one began with a compromised laptop. That's basic operational security, not science fiction.

*None of this is unique to Binance. Every exchange should be asking the same questions this week.

What Binance has done since:

• Paused withdrawals on all networks while it revamps the withdrawal service. Deposits kept working.
• Revoked the affected address authorisations.
• Brought in law enforcement and blockchain intelligence firms to trace the money.
• Promised a full technical post-mortem once the investigation ends and an updated Proof of Reserves once the fix is complete.

Binance's root-cause findings are preliminary. Binance hadn't published its full post-mortem at the time of writing.

Who Hacked Binance? Inside North Korea's Lazarus Group

Every major blockchain investigator points the same way: North Korea's Lazarus Group, through its crypto unit known as TraderTraitor. TRM Labs and Chainalysis both say they have "high confidence" (TRM Labs, CNN). On-chain investigator ZachXBT named Lazarus as the "likely attacker" (CoinDesk).

No government has formally attributed the attack yet, and the FBI hasn't commented.

New on October 30: ZachXBT traced stolen Binance funds to the same address as funds from Bitget's $388 million hack in September, both arriving via THORChain. He says that indicates the same actor is likely behind both. Bitget's hack had already been attributed to TraderTraitor (ZachXBT on X).

Who Is the Lazarus Group?

• A state operation, not a gang. When the US Treasury sanctioned Lazarus in 2019, it said the group is controlled by North Korea's Reconnaissance General Bureau, the country's primary intelligence agency (Al Jazeera).
• TraderTraitor is its crypto team. The FBI blamed the same unit for the $1.5 billion Bybit hack in February 2025 (NBC News).
• A long record. Treasury tied Lazarus to the 2014 Sony Pictures hack and WannaCry in 2017. A sister group worked with it to steal about $80 million from Bangladesh's central bank.
• The same fingerprints. TRM matched this attack to the Bybit and April 2026 KelpDAO hacks: small Tornado Cash withdrawals to fund wallets, quiet staging, then pre-signed approvals fired in 1 burst.

Why North Korea “Steals” Crypto

• It pays for the regime. US and South Korean officials say hacking is a key revenue source for the nuclear-armed, sanctions-hit state (CNN).
• Including its weapons. About 40% of the proceeds fund North Korea's nuclear and other weapons programmes, UPI reported alongside Chainalysis' data (UPI).
• The haul keeps growing. Chainalysis says North Korea stole a record $2.02 billion in crypto in 2025, about 60% of all crypto stolen worldwide that year.
• 1 night, years of loot. Chainalysis put North Korea's crypto thefts in recent years at $6.75 billion. The Binance hack alone nearly matches that.

How North Korea's Lazarus Group turns crypto thefts like the Binance hack into regime funding

Why Nobody Can Hold Them Accountable

It's no secret who's behind these hacks. The problem is reach.

• The hackers can't be arrested. In 2021 the US charged 3 North Korean military intelligence hackers over more than $1.3 billion in thefts. Al Jazeera noted the charges were "unlikely to reach adjudication in any US court" because the men are in North Korea (Al Jazeera).
• There's little left to sanction. North Korea's intelligence bureau was already under US and UN sanctions before Treasury added Lazarus in 2019.
• The UN's watchdog is gone. The UN panel that monitored North Korea's sanctions breaches, including 58 suspected attacks on crypto companies, shut down in April 2024 after Russia vetoed its renewal. China abstained (CSIS).
• The money moves faster than courts. Stolen crypto runs through Chinese-language laundering networks, bridges and mixers, typically over about 45 days (UPI).
• The launderers work in the open. In September, ZachXBT showed Chinese laundering groups moving Bitget's stolen funds for the alleged North Korean attackers, openly asking for help with orders in public Discord servers and Telegram channels (ZachXBT on X).
• Pyongyang denies it. North Korea has always rejected hacking accusations.

The only lever that reliably works is freezing what can be frozen. That's why about $3 billion, mostly stablecoins, was locked within hours, while the stolen Bitcoin and Ether keep moving. More on that below.

How Did the Crypto Market React?

Almost every major coin fell within hours. Bitcoin dropped 4.8% to below $77,000, Ether 5.7% and Binance's own BNB 8% to 10% (CoinDesk, AFP). The only coins that held were stablecoins, which are pegged to the dollar.

Crypto prices after the Binance hack: Bitcoin, Ether, BNB and AAVE fell while stablecoins held

What moved and why:

• Bitcoin (BTC), down 4.8%: the market's first reflex when the biggest exchange gets hit is to sell first and ask questions later.
• Ether (ETH), down 5.7%: the attacker was holding hundreds of thousands of stolen ETH that could be dumped at any time.
• BNB, down 8% to 10%: Binance's own token took the hardest hit among the majors. Glassnode said Binance's BNB balance was "left untouched" by the hack (Investing.com).
• AAVE, down 11%: the attacker used the Aave lending protocol to swap stolen USDT, which can be frozen, for borrowed ETH, which can't (TRM Labs).
• Stablecoins, flat: USDT and USDC held their $1 pegs, even with billions of them frozen.

Why the whole market sold off:

• Size: Binance held about $144 billion in assets before the hack, according to DefiLlama data cited by CoinDesk. Any doubt about the biggest exchange hits every coin.
• Dump risk: as of 00:30 UTC on October 30, the attacker still held more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion (TRM Labs). Traders priced in a sale.
• Bad timing: crypto was already falling earlier in the week, so the hack hit a nervous market.

For scale: when Binance lost $40 million to hackers in May 2019, Bitcoin fell just 1.19% (Yahoo Finance). This hack was about 150 times bigger, and the market reacted like it.

How Did Elon Musk, CZ and Crypto Leaders React?

Elon Musk summed it up as "Everyday is Zeroday", CZ admitted "it hurts" and the leaders of Tether and Circle went straight to freezing funds. Here's who said what.

Elon Musk

"Everyday is Zeroday."

A "zero-day" is a security hole nobody knew about until attackers used it.

Musk then replied to a post explaining how the hacker deposited stolen USDT on Aave and borrowed ETH against it (Bloomingbit):

"A superintelligent agent will someday do this to secure money for itself, not humans."

His point: Tether can freeze USDT, but it can't freeze the ETH already borrowed against it. This time a state hacking unit used that gap. Musk thinks AI could be next.

Changpeng Zhao (CZ), Binance Founder

• First: "It does look like a hack on Binance."
• As Binance's largest shareholder: "I expect all user funds will be fully covered" (Al Jazeera).
• After the all-nighter: "User funds are SAFU!" and "It hurts, but we will survive" (CZ on X).
• On the help: "Many industry friends and even competitors (including some previously-not-so-friendly ones) provided very much needed help."

Yi He, Binance Co-CEO

• Binance will cover "all hacking losses" (CoinDesk).
• She thanked the community for its "collective support" and wrote: "We are currently conducting a security scan to ensure the safety of funds within the platform" (Yi He on X).
• Withdrawals reopen once that scan is complete. Binance later put the reopening at about 45 hours from its October 30 update.

The Stablecoin Leaders

• Paolo Ardoino, Tether CEO: froze about $1.6 billion in USDT "related to a potential Binance exchange hack" (AFP).
• Jeremy Allaire, Circle CEO: froze more than $800 million in USDC.

Traders and Investigators

• Aravind Srinivasan, GSR: "It's the biggest hack in history" (CNN).
• Ido Ben-Natan, Blockaid CEO: The tactics were consistent with North Korean operations (CoinDesk).
• An analyst at Pangolin Intelligence: "I think the cat-and-mouse game has barely begun yet" (CNN).

Where Did the Stolen $6.3B Go?

About $3 billion is frozen and going nowhere.

The rest, mostly Bitcoin and Ether, is being laundered in plain sight. It all comes down to 1 question: is there a company behind the coin that can freeze it?

Where the stolen $6.3 billion from the Binance hack went: frozen, held or moved

What Was Stolen

TRM Labs' breakdown by blockchain (TRM Labs):

• Ethereum, about $3.79 billion: 200,630 ETH plus 185 other tokens, including 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
• Bitcoin, about $1.47 billion: 18,270 BTC.
• Tron, about $628 million: mostly USDT.
• XRP Ledger, about $296 million: 233.46 million XRP.
• Solana, about $96 million: 970,500 SOL.
• Arbitrum, Optimism, Base, Avalanche and Polygon: about $77 million combined.

The Freeze Alliance

Partners and rivals moved within hours. TRM's timeline, in UTC:

• 21:01, Tether: froze 971 million USDT in the attacker's main wallet, then more across 4 chains. About $1.77 billion in total.
• 21:04, Circle: froze 823 million USDC in the same wallet, about $825 million in total.
• 22:01, Ripple: froze 40.5 million RLUSD, its dollar stablecoin.
• 22:10, World Liberty Financial: froze 27.8 million USD1, the stablecoin of the Trump family-linked crypto company.
• 23:35, Binance: confirmed $2.54 billion frozen, a figure that later rose to about $3 billion.
• 00:08, Arbitrum Security Council: froze 8,426 ETH and 74.6 million ARB, about $30 million.

CZ thanked the industry players who helped, competitors included. The frozen money now sits in zombie wallets: visible on-chain, impossible to spend.

Notice what's missing: Ripple froze its stablecoin, not the 233 million stolen XRP. Nobody can freeze XRP, just as nobody can freeze Bitcoin.

The Coins Nobody Can Freeze

• Bitcoin and Ether have no issuer. There's no company with a blacklist button.
• That's where the attacker's money is now. As of 00:30 UTC on October 30, it still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion.
• 1 exception: Arbitrum's Security Council, which holds emergency powers over that network, froze ETH sitting on Arbitrum. On Ethereum itself, nobody can.

The live picture: Arkham Intelligence labels the attacker's wallets binance-hacker-1029. On the morning of October 30, they held about $5.84 billion on paper. That's less than the $6.3 billion stolen because prices have fallen since and some funds have already moved out. About $2.59 billion of what's left is USDT and USDC that Tether and Circle have already frozen.

What the Binance hacker's wallets still hold: $5.84 billion of the $6.3 billion stolen, $2.59 billion of it frozen

TRM Labs summed up what's left (TRM Labs):

"The attacker still controls about USD 2.4 billion in assets beyond any issuer's reach, and is racing to convert and move them."

TRM's $2.4 billion covers the BTC and ETH. Add the TRX and SOL and it's about $2.7 billion, as the chart shows.

TRM says it's working with Binance and the Beacon Network to track the funds and alert partners in real time.

How the Laundering Works

• The Bitcoin peel chain: 18,270 BTC split into chunks of 1,000 and 100 BTC to blur the trail.
• Dumping USDT before it's frozen: about 325 million USDT sold through UniswapX for about 122,300 ETH, at a discount of more than 10%. Losing 10% beats losing it all.
• The Aave trick: 60 million USDT deposited on Aave, about 19,760 ETH borrowed against it. Freezable money in, unfreezable money out. This is the move Musk reacted to.
• Tron detours: 300 million USDT moved into the JustLend protocol. Another 200 million was swapped through hop wallets, and 30 million of that was frozen.
• THORChain, then a shared wallet: on October 30, ZachXBT spotted stolen Binance funds arriving via THORChain, a cross-chain swap network, at an address that also holds funds from Bitget's $388 million hack (0x1510…feb7). He says the same actor is likely behind both.
• What comes next: TRM expects cross-chain bridges, swap services and OTC brokers, the usual exits for North Korean money.

The irony: centralisation, the thing crypto was built to avoid, saved about $3 billion overnight. What that means for your own wallet is covered in the protection section below.

Are Binance Users' Funds Safe?

Binance says yes: user funds are safe, and it will cover every loss from its SAFU emergency fund and company money. It has kept that promise before. This time the bill is far bigger, so here's the honest math.

Co-CEO Richard Teng put it plainly on October 30: "your money is safe, and we're covering every loss" (Richard Teng on X).

Binance's Record of Paying Users Back

• 2018: Shortly after its launch, Binance set up SAFU, an emergency fund to protect customers during breaches (CoinDesk).
• May 2019: hackers took more than 7,000 BTC, about $40 million. "Binance covered the bitcoins lost with its own funds," TechCrunch reported (TechCrunch).
• December 2025: a hacked Trust Wallet browser extension drained about $7 million. Binance bought Trust Wallet in 2018. CZ posted: "So far, $7m affected by this hack. TrustWallet will cover" (The Block).
• October 2026: Binance has promised to cover all losses again. This time the bill is around $6.3 billion.

The principle hasn't changed: Binance pays users back. The size of the bill has.

The SAFU Math

• The fund: in February 2026, Binance finished converting SAFU into 15,000 BTC, then worth about $1 billion. It tops the fund back up if its value falls below $800 million (The Block).
• Its value now: with Bitcoin under $77,000, about $1.15 billion.
• The loss: about $6.3 billion, so SAFU covers roughly 18% of it.
• After the freezes: about $3 billion is frozen. Even if all of it comes back, that leaves a gap of about $3.3 billion. SAFU covers about a third of that.
• Frozen isn't returned: frozen money is locked on-chain, not yet back in Binance's wallets (Bitcoin.com).

Binance SAFU fund covers about 18% of the $6.3 billion hack loss

So why does Binance keep saying funds are SAFU?

Not because the SAFU fund can fill a $6.3 billion hole. It can't. It's because Binance says it will pay the rest from company money and because stablecoin issuers froze about $3 billion in time. Binance hasn't said how much company money it will draw on. The proof-of-reserves update it has promised after the fix is the number to watch.

When Will Binance Withdrawals Reopen?

• About 48 hours. Binance's October 30 update says it's "still on track" to resume withdrawals "in 45\8 hours", which points to around November 1 (Binance on X).
• Why the wait: withdrawals stay shut "while we complete a security revamp of the withdrawal service and its related addresses", co-CEO Richard Teng says (Richard Teng on X).
• Deposits: unaffected and working as normal, per both.
• Yi He's version: withdrawals reopen once the security scan is complete.
• The precedent: after the 2019 hack, Binance reopened deposits and withdrawals after about a week (The Block).

Watch Out for Follow-Up Scams

Hacks attract a second wave of thieves. Binance has already warned users not to trust unofficial links or requests for account details (Al Jazeera).

• No real refund needs your password, seed phrase or 2FA code.
• Ignore DMs offering "compensation". After the Trust Wallet hack, users were warned about fake compensation forms and impersonators.
• Use only Binance's official app, website and verified accounts.
• Never send crypto to "release" a frozen balance. That's always a scam.

The Biggest Crypto Hacks in History

At about $6.3 billion, the Binance hack is more than 4 times the size of the previous record, Bybit's $1.46 billion in February 2025.

TRM Labs calls it the largest hack in history, full stop.

Here are the 10 biggest crypto thefts on record, valued at the time of each hack.

Sources: Comparitech's hack tracker, Decrypt, CoinDesk, TRM Labs and ZachXBT.

What the list tells you:

• North Korea is linked to the top 3 and to Bitget (#9). Binance, Bybit and Ronin alone add up to about $8.4 billion.
• The record keeps breaking. Mt. Gox ($470M, 2014), then Coincheck ($547M, 2018), Poly Network ($610M, 2021), Ronin ($620M, 2022), Bybit ($1.46B, 2025) and now Binance ($6.3B, 2026).
• Binance has been here before. It lost about $41 million in May 2019. The BNB Chain bridge on its own blockchain lost $570 million in 2022, and Binance-owned Trust Wallet lost about $7 million in December 2025.
• 2026 is a brutal year. Before Binance came Bitget ($388M, per ZachXBT), Drift ($295M) and KelpDAO ($293M, per CoinDesk).

How Did Binance Handle the Crisis?

Binance moved fast and froze billions within hours, but its early messages didn't line up. For any crypto team, it's a live case study in crisis communications.

What Binance Got Right

• Speed: it confirmed a security incident and paused withdrawals within hours (TechCrunch).
• The freeze alliance: with Tether, Circle, Ripple, World Liberty and Arbitrum, $2.54 billion was frozen within about 3.5 hours of the first outflow.
• A clear promise: losses covered from SAFU and company funds.
• An early scam warning: users were told not to trust unofficial links (Al Jazeera).
• A cause on day 1: a preliminary root cause the same night, plus a promised post-mortem and proof-of-reserves update (Bitcoin.com).

What Went Wrong

• Mixed messages: "user funds are completely safe" and "we'll cover all losses" landed side by side. AFP called the posts "sometimes contradictory" (AFP).
• Moving numbers: Early on, CZ said total losses could be "a bit higher" than $1 billion, while trackers were counting $5.9 billion to $6.4 billion.
• A root cause that moved: day 1 pointed to a compromised laptop. By October 30, Binance had found "additional points of breach". Early explanations are best guesses until the post-mortem lands.
• Too many voices: the founder, a co-CEO, the official account and a spokesperson all spoke, and CZ says he no longer runs the business.
• Soft first words: Binance's first comment mentioned "reports of a potential security issue" while watchers said at least $2 billion had already left (TechCrunch).

5 Crisis Lessons for Every Crypto Team

1. Keep 1 source of truth. A status page with timestamps that every channel links to.
2. Time-stamp every number. "$2.54B frozen as of 23:35 UTC" beats a round figure that changes by morning.
3. Separate "safe" from "covered". Say what happened first, then what you'll do about it.
4. Warn about scams in your first post. Fake support accounts arrive with the news.
5. Know your freeze contacts before you need them. The fastest freezes come from partners you already talk to.

Who Runs Binance Now?

On paper, co-CEOs Richard Teng and Yi He run Binance.

But founder Changpeng Zhao (CZ) still owns about 90% of it, according to legal filings cited in Forbes' coverage (VnExpress). Ownership and management sit in different hands, and that split explains a lot about how the hack was handled.

Who owns and runs Binance: CZ's 90% stake, the 7-seat board and co-CEOs

The Owner: Changpeng Zhao (CZ)

• Stepped down as CEO in 2023 as part of his US plea deal. He says he no longer manages Binance's operations (Al Jazeera).
• Still the largest shareholder, with about 90% of the company.
• Net worth: Forbes put it at $110 billion in March 2026 and valued Binance at about $100 billion. CZ called that "definitely not accurate": "Crypto prices dropped by more than 50% in 2026 already. And my net worth went up?" (Yellow)
• Why it matters: in most companies, an owner with 90% of the shares decides who sits on the board. CZ doesn't run Binance day to day, but owning it is its own kind of power.

The Co-CEOs

• Richard Teng: CEO since November 2023, after running Binance's regional markets (Cointelegraph).
• Yi He: Binance co-founder and CZ's partner, named co-CEO in December 2025 (PR Newswire). She has been the most visible executive during the hack.

The Board

Binance named its first board in April 2024: 7 directors, 3 of them independent (Cointelegraph).

• Gabriel Abed, chair: former ambassador of Barbados to the UAE.
• Richard Teng: CEO.
• Heina Chen: Binance co-founder.
• Xin Wang: CEO of Bayview Acquisition Corp.
• Arnaud Ventura: managing partner at Gojo & Company.
• Roger Wang and Rock He.

That's the board as announced in 2024. Binance hasn't published changes since in the sources we checked.

The Quiet Power: Heina Chen

• Who: a Binance co-founder and, per Reuters, "a close associate" of CZ.
• The money trail: in 2019 and 2020, Silvergate Bank authorised her to operate 5 bank accounts belonging to Binance.US, Reuters reported in 2023 (Daily Maverick).
• The other side: Binance.US denied that Binance ever operated its bank accounts.
• Guangying "Heina" Chen is considered the person CZ trusts the most because she has been his financial gatekeeper since before Binance even existed.

What Are Trump's Ties to Binance?

Through a pardon, a stablecoin and a $2 billion deal. President Trump pardoned CZ in October 2025, and his family's crypto company, World Liberty Financial, has business ties to Binance. During the hack, World Liberty also helped freeze the stolen money.

The Timeline

• November 2023: Binance agreed to pay $4.3 billion in fines and forfeiture. CZ stepped down as CEO and pleaded guilty to failing to maintain an effective anti-money laundering programme, as the US Bank Secrecy Act requires (CNBC).
• April 2024: CZ was sentenced to 4 months in prison. Prosecutors had asked for 36.
• March 2025: Abu Dhabi investment firm MGX announced a $2 billion investment in Binance.
• May 2025: World Liberty co-founder Zach Witkoff said its stablecoin, USD1, would be "the official" stablecoin used to close the MGX deal (The Block).
• May 29, 2025: the SEC dropped its civil case against Binance and CZ, with prejudice (SEC).
• October 23, 2025: Trump pardoned CZ. The White House said Zhao "was prosecuted by the Biden Administration in their war on cryptocurrency" (CNN).
• November 2025: Senators Elizabeth Warren and Jack Reed asked the DOJ and Treasury about reports that World Liberty sold tokens to buyers linked to North Korea and Russia (Senate Banking Committee).
• February 2026: 11 Senate Democrats, led by Chris Van Hollen, asked for a review of sanctions compliance at Binance after reports of trades with Iranian entities (The Block).
• October 29, 2026: World Liberty froze 27.8 million USD1 tied to the Binance hack (TRM Labs).

What Each Side Says

• Critics: Democrats called the pardon corrupt. CNN reported that Binance helped popularise World Liberty's tokens and was lobbying for the pardon when MGX chose USD1.
• The White House: Zhao was "overly prosecuted", and every pardon request gets "a very thorough examination." Trump said he acted "at the request of a lot of very good people."
• World Liberty: it denied selling tokens to illicit actors and said it ran "rigorous AML/KYC checks". Blockchain researcher Nick Bax later found the flagged "Lazarus" buyer was a false positive created by a joke token (Cointelegraph).
• Binance: on the Iran reports, "Binance detected and reported suspicious activity, and this is evidence that our controls are working."

What the Hack Adds to the Story

• More scrutiny is likely. A record theft by a sanctioned state, at an exchange with close political ties, lands in a debate where Democrats have already asked for probes twice.
• Stablecoin companies became sanctions enforcers overnight. Tether, Circle, Ripple and the Trump family-linked World Liberty froze North Korea's loot within hours. No government moved that fast.
• The freeze debate gets louder. The same power that stopped about $3 billion of stolen money can freeze anyone's stablecoins. Expect regulators and crypto purists to argue about it.

Was the Binance Hack Predicted?

Nothing we found suggests anyone outside the attackers knew it was coming. But the theories spread faster than the facts, so here they are, checked 1 by 1.

The Theories Going Around

• "There's no bottom until Binance is hacked." A line that has circulated among bearish traders, casting a Binance hack as the event that would mark the market's low.
• "It was planned for years." 1 post circulating on X claimed the hack was part of a long-planned agenda to force global centralisation, promising to explain more "when the time is right".
• "Binance is behind every crash." Not new. It has been the market's favourite suspect for years.

What the Evidence Says

• The setup was short and traceable. TRM traced the attackers' preparation to about 36 hours before the theft.
• The fingerprints point to North Korea, according to TRM Labs and Chainalysis, not to anyone inside the market.
• The freezes cut against the plot theory. Rivals and stablecoin issuers froze about $3 billion within hours. That doesn't fit a plan to make money disappear.
• Binance has been blamed before. After the October 10, 2025 crash wiped out about $19 billion in positions, critics pointed at Binance, where the USDe stablecoin briefly fell to about $0.65. CZ called the claims "far-fetched", and Binance compensated affected users about $283 million (Cointelegraph).
• None of the theories has offered evidence. Treat them as sentiment, not intelligence.

What It Does to Crypto's Image

• For most people, a hack is their first crypto headline.
  • Outside the industry, nobody hears "compromised DevOps laptop". They hear "$6 billion stolen".
• Trust was already low.
  • In Pew Research surveys, 63% of Americans said they weren't confident crypto is reliable and safe, and just 5% were very confident (NGPF, citing Pew).
• The stakes are huge.
  • Binance said it was nearing 300 million users in December 2025 (PR Newswire) and held about $144 billion in assets before the hack.
• There's a better story too, if the industry tells it.
  • Billions were frozen in hours, users were promised full cover and markets bent without breaking.

Will Binance Be Hacked Again?

No exchange can promise it won't be. The record says the attempts don't stop:

• March 2018: a suspected hack. Binance halted withdrawals and said the hackers didn't profit (Yicai Global).
• May 2019: about $41 million stolen.
• October 2022: $570 million from the BNB Chain bridge.
• December 2025: about $7 million from Binance-owned Trust Wallet.
• October 2026: about $6.3 billion.

Why it will keep happening:

• North Korea and other cybercrime networks aren’t stopping.
  • It took about 60% of all crypto stolen in 2025.
• Hot wallets are the weak spot.
  • As long as exchanges keep billions online for fast withdrawals, they stay targets.
• The fixes are known.
  • Circuit breakers on huge withdrawals, independent sign-off and far smaller hot wallets.

CEX vs DEX: Which Is Safer After the Binance Hack?

Neither is risk-free.
A centralised exchange (CEX) like Binance is a bigger target but can freeze, trace and refund.
A decentralised exchange (DEX) or your own wallet is harder to hit at scale, but if you're drained, the money is usually gone for good.

CEX vs DEX after the Binance hack: 1 big target with a safety net vs many small targets with no undo button

CEX: Bigger Target, Bigger Safety Net

• Why hackers go for it: billions sit in a handful of hot wallets. 1 night at Binance cost about $6.3 billion.
• What it can do after a hack: pause withdrawals, get partners to freeze stolen coins and pay users back from its own reserves, as Binance has promised.
• The catch: until you withdraw, your coins are an IOU. You're trusting the company's security, honesty and balance sheet.

DEX and Self-Custody: Smaller Target, No Undo Button

• Why it's harder to hit at scale: a DEX doesn't hold your coins between trades, so there's no single pot with everyone's money in it. Attackers have to go after users 1 by 1.
• What happens if you're hacked: nothing can be reversed. There's no support desk, no SAFU and no freeze on BTC or ETH. A phished seed phrase or a bad token approval can empty a wallet in seconds.
• Code can break too: DEX and DeFi smart contracts get exploited, and those losses are often never paid back.

The Binance Hack Showed Both Sides

• Frozen: about $3 billion, mostly USDT and USDC, because their issuers can lock any address.
• Gone: about $2.4 billion in BTC and ETH that no issuer can freeze (TRM Labs).
• The paradox: the same design that stops anyone freezing your coins stops anyone freezing a thief's.

The Big Debate: Exchanges vs Self-Custody

• The case for exchanges: freezes, emergency funds and support teams only exist where there's a company.
• The case for self-custody: the same power that froze the hacker can freeze anyone. Hence the oldest rule in crypto: not your keys, not your crypto.
• The catch nobody mentions: self-custody won't protect you from a stablecoin freeze. If you hold USDT or USDC in your own wallet, Tether or Circle can still freeze that address.

How to Protect Your Crypto From Exchange Hacks

Treat exchanges as places to trade, not places to store, and keep what you can't afford to lose in a wallet only you control. Self-custody has its own risks, though, so here's the balanced version.

5 layers that protect your crypto from hacks, from exchanges for trading only to a hardware wallet and locked-down accounts

1. Use Exchanges as Trading Venues

• Buy, sell or convert there, then move long-term holdings out.
• Keep on exchanges only what you're actively trading.
• Spread large balances across more than 1 platform.
• Right now: if Binance withdrawals are paused, wait for the official reopening announcement. Ignore anyone offering a "workaround".

2. Move Savings to a Hardware Wallet

• A hardware wallet keeps your private keys offline, away from hacked laptops. Popular options include Ledger, Trezor and BitBox.
• Buy it only from the maker or an authorised seller.
• Write your 12 or 24-word recovery phrase on paper or steel. Never photograph it, type it or store it in the cloud.

3. On DEXs, Check Before You Sign

• Verify a token's contract address on a block explorer such as Etherscan or BscScan.
• Bookmark the real site. Copies of popular DEX front ends are a common phishing trick.
• Revoke old token approvals regularly with a tool like Revoke.cash, so a hacked protocol can't drain your wallet later.

4. Lock Down Your Accounts

• Use an authenticator app or a security key for 2FA, not SMS.
• Turn on withdrawal address whitelisting where your exchange offers it.
• Use a unique password for every exchange and email account.

5. Know What Self-Custody Costs You

• Lose the recovery phrase and nobody can restore your funds.
• You become the target for phishing and fake support accounts.
• There's no SAFU fund for your own mistakes.

Not your keys, not your crypto. Just remember the half nobody says out loud: your keys, your responsibility.

Where We Stand

This is a hard week for everyone in crypto, and the people who matter most are the users waiting on their money.

• With the users. Anyone with funds on Binance deserves clear, timely answers through official channels.
• With the responders. Tether, Circle, Ripple, World Liberty, the Arbitrum Security Council and investigators at TRM Labs, Chainalysis and beyond froze and traced billions within hours. Rivals helped too. That's the industry at its best.
• Against the attackers, not the victims. The blame belongs with the people who stole the money. A hacked exchange and its users are victims first.
• For the long run. Every hack is a lesson. The faster the industry shares what went wrong, the harder the next attack gets.

Binance Hack FAQs

Helpful Resources

• FBI guidance for crypto scam victims: how to report theft or fraud and what details to include.
• FBI warning on fake exchange staff: how scammers pose as exchange support and what to do instead.
• Binance on X: official updates. Never trust links sent to you by DM.
• Revoke.cash: check and remove old token approvals from your wallet.

A Note on This Guide

This is a news report from October 30, 2026, not financial or legal advice.

• The data: figures come from blockchain analytics firms, news reports and Binance's preliminary findings, checked on October 30, 2026. They will change as the investigation goes on.
• Attribution: the North Korea link comes from private analytics firms. No government has formally confirmed it yet.
• Names: companies and people are named only to identify them. None has reviewed or endorsed this guide.
• Why we wrote it: to help users make sense of the hack. It doesn't promote any service.

Sources

• The hack: TRM Labs, CoinDesk, Bitcoin.com on Binance's findings, Binance's October 30 update on X, Richard Teng on X, TechCrunch, AFP via Yahoo Finance, Al Jazeera, CNN via KRDO, Investing.com via Yahoo Finance
• Reactions: Bloomingbit on Elon Musk, CZ on X, Yi He on X, ZachXBT on X, Matthew Madera on X
• North Korea: NBC News on the FBI's Bybit finding, Al Jazeera on the 2019 Lazarus sanctions, Al Jazeera on the 2021 indictment, UPI on Chainalysis' 2025 data, CSIS on Russia's UN veto
• SAFU and past hacks: The Block on SAFU's 15,000 BTC, The Block on Trust Wallet, TechCrunch on the 2019 hack, The Block on the 2019 reopening, Yahoo Finance on 2019 prices, Yicai Global on 2018, Comparitech's hack tracker, Decrypt's biggest hacks
• Binance's leadership: Cointelegraph on the board, PR Newswire on Yi He, VnExpress on Forbes' estimate, Yellow on CZ's response, Daily Maverick, via Reuters
• Politics: CNBC on the sentencing, SEC dismissal, CNN via KVIA on the pardon, The Block on USD1 and MGX, Senate Banking Committee, The Block on the 2026 Senate letter, Cointelegraph on World Liberty's response
• Sentiment: Cointelegraph on the October 2025 crash, NGPF, citing Pew Research

About the Author

David is the Head of Operations at AP Collective. Harvard Business School-certified in Leadership, he has 5+ years of experience in project management and business operations and has led the delivery of over 600 campaigns for 100+ crypto brands since joining AP Collective in 2023. See all our authors here.

A news report from October 30, 2026. Spotted an error? Write to info@apcollective.io.

Disclaimer