Dear Binance Community,
Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals. At approximately 03:05 on October 30, 2026 (Vietnam Time), our hot wallets were compromised, resulting in losses of approximately $6.3 billion in token assets.
We recognize the seriousness of this incident and the concerns it has caused in the community. We are treating this as our highest priority. We have been working around the clock to investigate, secure, upgrade our infrastructure, prevent further losses, and recover funds. In this update, we want to provide a clear summary of what has been done over the past 24 hours and what we are working toward.
We want to make our commitment clear: Binance will bear the full financial impact of these stolen funds, not our users.
Protecting our users
Our top priority is ensuring our users are protected. Binance will reimburse the full amount stolen in connection with this incident through the Secure Asset Fund for Users (SAFU) and our corporate treasury.
We have allocated more than $6.34 billion from company funds, including $5 billion held in the very token assets that were affected and stolen, such as USDC, USDT, BTC, ETH, BNB, and others. This means we have covered approximately 80% of the affected amount. We are actively purchasing the remaining shortfall in the relevant token assets through market channels and over-the-counter (OTC) transactions. We will continue to share progress updates on our official channels.
What we’ve done
As soon as we identified the incident, we acted immediately to contain the threat and strengthen security. We have:
Contained the compromised infrastructure, revoked the affected permissions, and implemented additional controls to prevent further unauthorized activity.
Coordinated with law enforcement, blockchain intelligence firms, asset issuers, and industry partners to trace and freeze the affected assets. To date, approximately $3 billion has been frozen on-chain. Further recovery efforts are underway.
Enhanced security checks across all affected infrastructure.
Temporarily suspended withdrawals while conducting additional security reviews, implementing remediation measures, and validating the integrity of the affected systems. Deposits and unaffected platform services have continued to operate as usual.
Continued working to safely restore withdrawal services.
What we’ve learned
Our technology and security teams are continuing to conduct an in-depth investigation into this sophisticated attack.
Initial findings suggested the incident may have involved a compromised laptop; however, subsequent investigation uncovered additional points of compromise.
At this stage, we have found no evidence that wallet private keys were leaked.
The investigation is ongoing. We are working with internal and external security experts to determine the full attack chain, identify all contributing factors, and establish appropriate measures to prevent similar incidents.
We expect to share further technical findings over the next 48 hours, once they have been verified and their disclosure will not interfere with ongoing investigative efforts.
What’s next
Over the next few days, we will focus on four immediate priorities:
Restore withdrawals: Our technology team aims to begin restoring withdrawal services within the next 34 hours, subject to the completion of security checks. This process will take place in phases. We will provide updates as each phase is ready.
Increase transparency and verification through Proof of Reserves: We are purchasing the remaining 20% of the lost token assets. We expect to take an initial Proof of Reserves snapshot within the next 12 hours and complete the results by Monday, November 2, 2026. These reports will provide users with updates on the assets held by the platform and the corresponding assets backing user balances. This will allow you to independently verify your latest account balance on our platform.
Recover frozen stolen funds: We are coordinating with law enforcement, blockchain intelligence firms, token issuers, and other exchanges to trace and recover the stolen funds. We will use every available option to identify those responsible and hold them accountable.
Publish a post-incident investigation report: We are conducting a comprehensive security review and will provide a detailed technical report outlining what happened, lessons learned, and additional safeguards being implemented.
Our commitment
We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected.
To receive verified updates, please follow only Binance’s official channels or contact us directly through our official Customer Support.
Thank you for your patience and continued trust as we work through this incident.
Yi and Richard
Binance Co-CEOs
October 30, 2026
Please note: There may be differences between the original English content and any translated versions (which may be generated by AI). In the event of any discrepancy, please refer to the original English version for the most accurate information.