Ayu A Suryabudhi

Fellow Binancians,
Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals of funds. At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.
We recognize the seriousness of this incident and the concern it has caused across our community. We are treating this as our highest priority. We have been working non-stop on security investigation, infrastructure system upgrading, fund loss prevention and recovery. In this update, we want to give a clear summary of what has been done in the last 24 hours and what we are working towards.
We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.
Protecting Our Users
Our first priority is to ensure that users are protected. Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.
We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount. We are actively buying the remaining relevant token assets through market and OTC channels. We will continue to provide updates on the progress on our official channels.
What We Have Done
Since identifying the incident, we have taken immediate action to contain the threat and strengthen our security posture. We have:
Contained the compromised infrastructure, revoked affected authorizations and implemented additional controls to prevent further unauthorized activity.Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date. Further recovery efforts to follow. Strengthened security checks across affected infrastructure.Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures and validating the integrity of affected systems. Deposits and other unaffected platform services remain operational.Continued working to restore withdrawal services safely.
What We Have Learned So Far
Our tech and security teams are still deep in the investigations of this complex hack.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
At this stage, we have found no evidence that wallet private keys were leaked.
The investigation remains ongoing. We are working with internal and external security experts to establish the full attack sequence, identify all contributing factors and determine the appropriate measures to prevent similar incidents.
We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.
What’s Next
We are focused on four immediate priorities over the next few days:
Restoring Withdrawals: The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach. We will provide updates as each phase becomes available.Strengthening Transparency and Verification through the Proof of Reserves: We are buying the remaining 20% of the lost token assets. We plan to run an initial Proof Of Reserves snapshot in 12 hours and have the result ready by Monday 2026-11-02. These reports will provide users with an updated view of platform asset holdings and the corresponding backing of user balances. So you can verify for yourself of the latest account balances on our platform. Recovering the frozen stolen funds: We are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds. We will pursue all available avenues to identify those responsible and hold them accountable.Publishing an incident post mortem report: We are conducting a full security review and we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.
Our Commitment
We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected.
For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.
Thank you for your patience and continued trust as we work through this.
Yi and Richard
Co-CEOs of Binance
2026-10-30