Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.
An independent record of the October 2026 Binance hack
Statements from Binance-published sources, and from people whose recorded role mentions Binance, in date order, oldest first. These are official statements: the party said it, which is not the same as it being true.
Official statements that quote a page exactly can publish automatically. Other items are approved by an editor using AI assistance.
122 approved statements.
Binance is aiming to resume withdrawals within 40 hours and publish a full proof-of-reserves report by Monday, co-CEO Richard Teng [said]
Teng also disclosed that the attacker used a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
Binance initially linked the breach to a compromised DevOps engineer's laptop, but now says it has uncovered additional points of breach in a complex attack that "was not carried out by one person".
Binance has said it will cover all losses using its SAFU fund and company funds, and that it has reserved more than $6.34 billion of company funds to do so. Around $5 billion of this is already held in the same tokens that were stolen, and Binance is buying the rest through the market and OTC trades. It plans to publish a full Proof of Reserves report by Monday.
Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.
The cryptocurrency exchange said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.
It said it will cover all losses.
The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."
Asked about the potential ties to North Korea, a Binance spokesperson said only that the company is "working closely with our law enforcement partners to confirm the identity of the criminals and bring them to justice."
He added that while he doesn't manage Binance anymore, "as a shareholder, I expect all user funds will be fully covered."
Teng said the hack hit Binance's own hot wallet, not customer funds. "We never use any customer funds, so they are not impacted," he said, adding that most user assets are held in cold wallets and only moved into a hot wallet when a user withdraws.
Binance co-founder Changpeng Zhao said the activity appeared to be a hack, adding that Tether and Circle had frozen approximately $971 million and $823 million, respectively. Zhao said he expected all user funds to be fully covered.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.
At this stage, we have found no evidence that wallet private keys were leaked.
Binance will cover all stolen funds related to this incident through our Secure Asset Fund for Users (SAFU) and our corporate treasury.
We expect to share further technical findings within about 48 hours once they have been verified and their disclosure will not compromise ongoing investigative efforts.
we will provide a detailed technical report outlining what happened, the lessons learned and the additional safeguards being implemented.
For verified updates, please follow Binance's official channels only, or contact us directly through the official Customer Support.
Approximately $3 billion has been frozen on-chain to date.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks.
We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.
We have already set aside more than $6.34B in company funds, with $5B held in the exact impacted token assets that were stolen, such as USDC, USDT, BTC, ETH, BNB, etc. This means that we have already covered approximately 80% of the impacted amount.
Worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach. At this stage, we have found no evidence that wallet private keys were leaked.
The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.
Tracked Binance pages are captured again on a schedule. This list shows a page only when its text differs between two captures in a way a reader would notice (link fragments, cookie banners and layout are ignored). Binance's numbered update notes, such as Security Incident Update #2 or Recovery Update #3, are separate pages: each appears under Statements above, and appears here only if the text of one of them was edited. Edits are shown line by line on Changes.
No edit to a tracked Binance page has been detected in the captures stored so far.
Copies of Binance pages kept by the Internet Archive's Wayback Machine, captured before 29 October 2026, of selected pages: proof of reserves, about, security-related help articles and terms of use. They show what a page said when the Wayback Machine's crawler saw it, which can be later than when the words were written, and they say nothing about what is true. A quote appears below only after an editor has checked it against the Wayback Machine copy and approved it.
No quote from an archived page has been approved yet.
No Wayback Machine copy of a Binance page has been collected yet.