Dear Binancers,
Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals of funds. At approximately 20:05 (UTC) on October 29, 2026, our hot wallets were compromised, resulting in a loss of approximately $6.3 billion in tokenized assets.
We recognize the seriousness of this incident and the concern it has caused throughout our community. We are treating this case as our highest priority. We have been working around the clock on the security investigation, upgrading our systems infrastructure, preventing losses, and recovering funds. In this update, we want to provide a clear summary of what has been done over the past 24 hours and what we are working to achieve.
We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.
Protecting our users
Our first priority is to ensure that users are protected. Binance will cover all funds stolen in connection with this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.
We have already set aside more than $6.34 billion in company funds, including $5 billion held in the exact impacted tokenized assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, and others. This means we have already covered approximately 80% of the impacted amount. We are actively purchasing the remaining tokenized assets through market and OTC channels. We will continue to provide updates on our progress through our official channels.
What we have done so far
Since identifying the incident, we have taken immediate steps to contain the threat and strengthen our security posture.
The compromised infrastructure has been contained, the affected authorizations have been revoked, and additional controls have been implemented to prevent further unauthorized activity.
We are working with law enforcement, blockchain intelligence firms, asset issuers, and industry partners to trace and freeze the affected assets. Approximately $3 billion has been frozen on-chain to date. Further recovery efforts will continue, and we are strengthening security checks across all affected infrastructure.
Withdrawals have been temporarily suspended while we conduct additional security checks, implement remediation measures, and validate the integrity of affected systems. Deposits and other unaffected platform services remain operational.
We continue to work toward safely restoring withdrawal services.
What we have learned so far
Our technical and security teams are continuing to investigate this complex attack in depth.
Our initial investigation suggests that the incident may have involved a compromised laptop; however, subsequent investigations have revealed additional points of compromise.
At this time, we have found no evidence that wallet private keys were leaked.
The investigation is ongoing, and we are working with internal and external security experts to establish the full sequence of the attack, identify all contributing factors, and determine appropriate measures to prevent similar incidents.
We intend to share further technical findings in approximately 48 hours, once they have been verified and provided that disclosure does not compromise ongoing investigative efforts.
Next steps
We are focused on four immediate priorities over the coming days:
Restoring withdrawals: The technical team aims to begin restoring withdrawal services in approximately 34 hours, subject to the completion of security checks. The process will be phased, and we will provide updates as each phase becomes available.
Strengthening transparency and verification through Proof of Reserves: We are purchasing the remaining 20% of the lost tokenized assets and plan to take an initial Proof of Reserves snapshot in 12 hours, with the results ready by Monday, November 2, 2026. These reports will give users an up-to-date view of the platform's asset positions and the corresponding coverage of user balances, so you can independently verify the latest balances on our platform.
Recovering stolen and frozen funds: We are working with law enforcement, blockchain intelligence firms, token issuers, and other exchanges to trace and recover the stolen funds. We will exhaust all available avenues to identify those responsible and hold them accountable.
Publishing a post-mortem report on the incident: We are conducting a comprehensive security review and will provide a detailed technical report describing what happened, the lessons learned, and the additional safeguards being implemented.
Our commitment
We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected.
For verified updates, follow only Binance's official channels or contact us directly through the Support Center.
We appreciate your patience and continued trust as we work on this.
Yi and Richard
Co-CEOs of Binance
2026-10-30