Binance's $6.3 billion breach, explained: what was taken, what happens to user funds, and what it means in India

What happened on 29 October

The breach came to light on Thursday 29 October 2026, when unusually large transfers were detected leaving Binance-linked online wallets. Binance, the world's largest cryptocurrency exchange, subsequently acknowledged a security breach and estimated that approximately $6.3 billion worth of cryptocurrency had been affected, describing it as an initial assessment that could change as its investigation continues. Blockchain analytics firm Chainalysis estimated that at least $5.912 billion was stolen across several networks, including Bitcoin, Ethereum, Tron and Ripple. The gap between the two figures is a reminder that early totals in a fast-moving incident are estimates made with different methods, not final audited losses.

If confirmed, the incident would be the largest cryptocurrency theft ever reported, surpassing the February 2025 attack on the Bybit exchange, in which approximately $1.5 billion was stolen. Binance first said it had suspended withdrawals and deposits, then later clarified that deposits were unaffected while withdrawal services remained suspended. The exchange said it had worked with partners to freeze around $3 billion in affected on-chain assets so far, and that it could freeze more as it works with law enforcement agencies, token issuers, blockchain intelligence firms and other industry partners to trace the funds.

The breach shook crypto markets. Bitcoin fell more than 3 per cent to about $76,368, its lowest level in around six weeks, Ether dropped over 3 per cent to about $2,178, a two-month low, and Binance's own BNB token fell about 5 per cent to around $709.70. Shares of the US exchange Coinbase reportedly fell about 4.8 per cent, while Strategy, known for its large Bitcoin holdings, fell nearly 6 per cent in extended trading. Binance has maintained throughout that user funds are safe and that it will cover the losses, a promise that is now being tested in public.

How the attackers got in, as far as investigators know

Binance's preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer, a role responsible for managing the company's technical infrastructure. Attackers allegedly used that access to reach a service container, a piece of internal infrastructure used to process transactions, and to submit unauthorised withdrawals. Binance said it found no evidence that the private keys used to secure cryptocurrency wallets had been exposed, and that it revoked the affected authorisation. That first explanation, however, turned out to be incomplete.

Co-chief executive Richard Teng later said the investigation had found more points of breach than the single laptop first suspected. He said the attackers used a self-destruct tool to wipe their traces, which has hampered the investigation, and that they used a recent Ethereum feature called EIP-7702, which lets a wallet temporarily hand control to other code, to take over one of Binance's hot wallets without going through the usual approval steps. The leadership of the security firm Blockaid has likewise suggested that the attackers compromised a system responsible for authorising transactions. Binance is now reviewing its cloud systems, staff devices, key management and the way it signs transactions, and investigators still do not know the full order of events.

One detail from TRM Labs underlines how planned the operation appears to have been: the firm indicated that preparations may have begun at least 36 hours before the transfers were executed. The picture that emerges is not a single broken lock but a chain of trusted systems, each of which assumed the previous one was legitimate. That is why Binance's later updates matter more than its first one: the company itself has moved from a single-cause story to a wider breach, and the full technical post-mortem it has promised has not yet been published.

Hot wallets, frozen tokens, and why frozen is not recovered

To understand the theft, it helps to understand how an exchange holds coins. A hot wallet is connected to the internet so the exchange can process withdrawals quickly; a cold wallet is kept offline and is much harder to reach. Binance says the attack hit its own hot wallet, not customer funds directly, which is why the exchange argues that customer balances were not themselves stolen. But while withdrawals are suspended, that distinction offers limited comfort: users cannot move their coins, so their balances are effectively claims on Binance until services resume.

A large part of the stolen value was in stablecoins, tokens designed to hold a steady value against the US dollar, and several stablecoin issuers were able to freeze tokens linked to the attack. Tether froze approximately $1.57 billion, Circle blocked more than $800 million, Ripple froze around $200 million, and World Liberty Financial froze about $29 million in tokens. Together with other partners, Binance says roughly $3 billion has been frozen. Freezing matters because it stops stolen tokens from being deposited, cashed out or spent, but it is not the same as recovery: frozen tokens still have to be traced, legally claimed and returned, a process that can take a long time.

The attackers also showed they could use the stolen funds inside decentralised finance. Lending platform Aave restricted deposits and borrowing in several markets after the attacker used $60 million in USDT as collateral to borrow approximately $44.6 million in wrapped Ether. That single move shows why exchanges and platforms reacted so fast: stolen crypto does not sit still, and every hour it remains usable is an hour it can be swapped, borrowed against or hidden. The remaining roughly $3.3 billion that has not been frozen is still being traced with law enforcement and blockchain intelligence firms, and Binance has said further freezes are possible.

Are user funds safe? What Binance has promised, and what would prove it

Binance's promise to users has three parts. First, it says user funds are safe and the breach hit its own operational wallets. Second, it says it will cover all losses from its Secure Asset Fund for Users, known as SAFU, and company funds. Third, it says it will publish a technical report and an updated proof of reserves, a public check designed to show that the exchange holds enough crypto to cover every customer balance. Co-chief executive Richard Teng has said Binance set aside more than $6.34 billion of its own money for the roughly $6.3 billion stolen, with about $5 billion already held in the same tokens that were taken and the rest being bought on the market.

The numbers deserve a careful read. SAFU, the emergency reserve, is maintained in Bitcoin and is estimated by various reports to be worth approximately $1 billion to $1.2 billion, which on its own would not cover a $6.3 billion loss. Binance must therefore rely heavily on its own corporate resources to meet the rest, which is exactly what its $6.34 billion commitment describes. There is also a precedent: in 2019, hackers stole approximately 7,000 Bitcoin, then valued at around $40 million, and Binance used SAFU to compensate affected customers, while trading and other services were disrupted for approximately a week. The scale this time is vastly larger, but the mechanism being described is the same.

The proof-of-reserves report due on Monday 2 November is the key test, because a review of Binance's earlier reserve data found that the drained wallets had been listed among the assets backing customer balances. In other words, the report must show not just that Binance holds a large pile of crypto, but that customer balances specifically are fully backed after the theft. Binance's separate US operation, Binance.US, has said it has not been affected by the incident. Until withdrawals reopen and the reserves report is published, the fair summary is this: Binance has made a large, specific financial commitment, but the independent proof is still pending.

Why withdrawals are still shut, and what reopening will test

Withdrawals have been suspended since the attack on 29 October, while deposits, after an initial period of confusion, were confirmed by Binance to be unaffected and open. Co-chief executive Richard Teng said on Friday that Binance aims to reopen withdrawals within about 40 hours, which points to Sunday 1 November, but only once the rebuilt systems pass strict testing. The date is therefore a target, not a promise, and Binance will not switch withdrawals back on until the rebuilt systems pass rigorous testing. Users should treat any message claiming otherwise with suspicion.

Reopening is the real test of Binance's promise that customer assets are safe. Millions of people keep crypto on the exchange, and many will want to move some of it out as soon as they can. If withdrawals restart smoothly on Sunday and Monday's reserves report shows every balance fully backed, the damage may stay limited to Binance itself. A delay to either date would likely weigh on crypto prices again, as analysts warned after the initial sell-off, and would raise fresh questions about how deep the damage runs.

While waiting, users can take practical steps that do not depend on rumours. Follow only Binance's official announcements rather than social media claims, keep screenshots of balances and transaction histories in case discrepancies emerge, and never share passwords, one-time codes, private keys or wallet recovery phrases with anyone offering help. Fraudsters routinely exploit major incidents with fake support messages promising early withdrawals or account verification. A temporary suspension does not automatically mean an individual account was compromised, but it does mean access depends entirely on Binance restoring its systems.

How exchange breaches usually work, and why they keep happening

Centralised exchanges are attractive targets for a simple reason: they hold the keys. When you keep crypto on an exchange, you do not hold the coins yourself; the exchange does, and your account balance is its promise to give them back. Attackers therefore do not need to break the underlying cryptography of Bitcoin or Ethereum. They need to find a trusted path into the exchange's own systems, whether that is a compromised employee device, a misconfigured internal service, or a flaw in how transactions are approved. The Binance case, as described so far, fits that pattern: a human entry point, then movement through internal systems that were trusted to authorise withdrawals.

The question of who did it is where attribution matters. TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor, a North Korea-linked hacking group, citing links between the stolen Binance funds and assets from the September 2026 Bitget hack. No official government attribution has been made in the Binance case, so that identification should be read as the assessment of private analytics firms, not as a confirmed state finding. North Korean hackers were also blamed for the Bybit theft earlier in 2025, and state-linked groups are widely reported to target crypto because stolen funds can be moved across borders without a bank.

The pattern of large thefts has continued despite years of security investment. Hackers stole approximately $2.9 billion across nearly 150 attacks in 2025, according to TRM Labs, and the Bitget exchange reported a theft of around $350 million in September 2026. The chair of the US Commodity Futures Trading Commission, Michael Selig, said after the Binance hack that offshore exchanges serving Americans should register with his agency and meet US cybersecurity standards. Binance's main exchange is based outside the US and is not overseen by the CFTC. The broader lesson is uncomfortable: even the largest exchange, with the deepest resources, can be breached through a chain of trusted systems, and size alone is not a safety guarantee.

The India angle: legal to use, taxed heavily, and not protected like a bank deposit

For Indian users, the first question is whether Binance is even legal to use. The answer, as of 2026, is yes, but the history explains why many users were unsure. In December 2023, India's Financial Intelligence Unit (FIU-IND) sent show-cause notices to Binance and eight other offshore exchanges for serving Indians without registering under the anti-money-laundering law. In January 2024 their websites and apps were blocked in India. Binance registered as a reporting entity in May 2024, and on 19 June 2024 the FIU director ordered a penalty of Rs 18.82 crore for past violations of record-keeping and reporting rules. Binance then announced on 15 August 2024 that its site and app were fully available to Indian users again.

Registration, however, is a money-laundering filing, not a safety rating. It means Binance must keep know-your-customer records and report suspicious transactions to FIU-IND. It does not mean an Indian regulator protects your funds, and it is not comparable to deposit insurance for a bank account. The July 2024 cyberattack on the Indian exchange WazirX, in which approximately $230 million was stolen and customers struggled to access funds for months, is a reminder from closer to home that exchange risk is real even on domestic platforms.

Tax is the second, and often more expensive, part of the India story. Profits from transferring virtual digital assets are taxed at a flat 30 per cent plus surcharge and cess, which works out to about 31.2 per cent for most investors before surcharge, and gains must be reported in Schedule VDA of the income tax return. Losses from crypto transactions generally cannot be set off against income from other sources, so a loss elsewhere does not reduce the tax bill on a crypto gain. A 1 per cent tax deducted at source (TDS) applies to specified transactions, but on Binance spot trades the 1 per cent is usually not deducted, according to the Indian tax firm KoinX, which means the duty to compute and pay falls on the user, and on peer-to-peer trades the duty to deduct sits with the Indian buyer. Reports of tax notices sent mainly to Binance peer-to-peer users, taxing the full amount received in a bank account without allowing the purchase cost, show why keeping purchase records matters. KoinX also notes that offshore exchanges will share Indian users' data through the OECD's CARF framework from April 2027.

None of this is a reason to panic. This article is general educational information only, not investment advice, and not a recommendation to buy, sell, hold or move any cryptocurrency, and it is not tax advice for any individual case. What Indian users can reasonably do is keep full transaction histories and purchase records, check their own tax position with a professional, follow only Binance's official announcements about withdrawals, and remember that an exchange account, however large the exchange, is not a bank deposit.

Editorial disclosure

This article was researched with AI assistance and reviewed by the publisher before publication. Report factual errors through our contact page.