Dear Binance Community,
Over the past 24 hours, our teams have been working around the clock to respond to a serious security incident involving unauthorized withdrawals of funds. At approximately 20:05 (UTC) on 2026-10-29, our hot wallets were compromised, resulting in the loss of digital token assets estimated at approximately US$6.3 billion.
We recognize the severity of this incident and the concern it has caused in our community. We are treating it as our highest priority. We are working around the clock on the security investigation, infrastructure systems, and preventing and recovering the loss of funds. In this update, we would like to provide a clear summary of what has been accomplished over the past 24 hours and what we are working to achieve.
We want to make our commitment clear: Binance will bear the financial impact of these stolen funds, not our users.
Protecting our users
Our first priority is ensuring user protection. Binance will cover all stolen funds related to this incident through the Secure Asset Fund for Users (SAFU) and the company treasury.
We have already allocated more than $6.34B in company funds, including $5B held in the same affected tokens that were stolen, such as USDC, USDT, BTC, ETH, BNB, and others. This means we have already covered about 80% of the affected amount. We are actively working to purchase the remaining relevant tokens through market channels and over-the-counter (OTC) trading. We will continue to provide updates on our progress through our official channels.
What we have done
Since discovering the incident, we have taken immediate action to contain the threat and strengthen our security posture. We have:
Contained the compromised infrastructure, revoked the affected authorizations, and implemented additional controls to prevent any future unauthorized activity.
Worked with law enforcement, blockchain intelligence firms, asset issuers, and industry partners to trace and freeze the affected assets. About $3 billion has been frozen on-chain so far. Recovery efforts will continue.
Strengthened security checks across the affected infrastructure.
Temporarily suspended withdrawals to conduct additional security reviews, implement remediation measures, and verify the integrity of the affected systems. Deposits and other unaffected platform services remain operational.
Continued working to safely restore withdrawal services.
What we have learned so far
Our technology and security teams are continuing to investigate this complex breach in depth.
Our initial investigation indicated that a compromised laptop may have been involved in the incident, but our subsequent investigation uncovered additional points of compromise.
At this stage, we have found no evidence that wallet private keys were leaked.
The investigation is ongoing. We are working with internal and external security experts to determine the full sequence of the attack, identify all contributing factors, and establish appropriate measures to prevent similar incidents.
We expect to share additional technical findings in about 48 hours, after they have been verified and we have confirmed that disclosing them will not hinder ongoing investigative efforts.
What comes next
We are focused on four immediate priorities over the next few days:
Resuming withdrawals: The technical team aims to begin restoring the withdrawal service in about 34 hours, subject to the completion of security checks. This will be done in stages. We will provide updates as each stage becomes available.
Enhancing transparency and verification through Proof of Reserves: We are working to purchase the remaining 20% of the lost tokens. We plan to take an initial Proof of Reserves snapshot within 12 hours, with results expected to be ready by Monday, 2026-11-02. These reports will allow users to see the latest overview of the platform’s asset holdings and the corresponding coverage of user balances, so you can independently verify the latest balances in your accounts on our platform.
Recovering stolen and frozen funds: We are working with law enforcement, blockchain intelligence firms, token issuers, and other trading platforms to trace and recover the stolen funds. We will pursue every available avenue to identify those responsible and hold them accountable.
Publishing a post-incident review report: We are conducting a comprehensive security review and will provide a detailed technical report explaining what happened, the lessons learned, and the additional safeguards being implemented.
Our commitment
We take full responsibility for addressing this security incident, strengthening our security infrastructure, and ensuring our users are protected.
For reliable updates, please follow only Binance’s official channels or contact us directly through official customer support.
Thank you for your patience and continued trust as we work to address this matter.
Yi and Richard
Binance Co-CEOs
2026-10-30