On Thursday 29 October 2026, Binance, the world's largest crypto exchange, disclosed that about $6.3 billion had been stolen in a security incident. It is the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.
This page explains what is confirmed, what isn't, and, most importantly, how to protect yourself in the days ahead. Large hacks are almost always followed by a second wave of scams aimed at worried customers, and that second wave is where most ordinary people actually lose money.
The one rule for the next few weeks: no real exchange will ask you to claim a refund on an outside page, connect your wallet, pay a fee to release funds, install remote-access software, or share your password, 2FA (two-factor authentication) code or seed phrase. Anyone who does is a scammer, however official the message looks.
A cybersecurity specialist quoted by Yahoo Finance summed up the attack in one line: "Criminals no longer break in, they log in." The weak point was not the blockchain or the cryptography, but a single trusted device inside the company.
According to Binance:
These are the company's own statements. They are encouraging, but until the full report and new proof of reserves are published, they haven't been independently confirmed. The practical takeaway: there is nothing you need to "do" to be covered, and no form to fill in anywhere outside your Binance account.
These are the patterns that followed earlier exchange hacks such as Bybit's, and security researchers are warning Binance users to expect the same. Learn to recognise them before they reach you.
An email, SMS, Telegram or WhatsApp message, or even a phone call using your name, says your account was "affected by the breach" and must be verified, unlocked or moved.
How to spot it: support never contacts you first about the hack, and never asks for your password, 2FA code or seed phrase. A caller asking you to read out a code that just arrived on your phone is trying to take over your account.
Ads, social posts and emails link to a "refund portal" or "claim form". Some steal your login; others ask you to connect a wallet and sign a request, which gives a wallet drainer permission to empty it.
How to spot it: nothing is claimed on outside pages. Any page asking for a wallet signature, a fee or your seed phrase to "release" a refund is fake.
Strangers in comments, private messages or search ads offer to trace and return lost funds for an upfront fee.
How to spot it: Binance has said it will cover the losses itself. Real tracing and freezing is done by blockchain analysts, stablecoin issuers and police, not by people who message you. Paying them means losing money twice.
A message with a deadline and a link to what looks like the Binance login page.
How to spot it: when withdrawals reopen, you'll see it in the official app without clicking anything. Urgency plus a login link is the classic sign of phishing (a fake site built to steal your login).
Someone sends you a "secure" address, or asks you to install remote-access software such as AnyDesk so they can "help".
How to spot it: no exchange ever asks for either. Only send crypto to wallet addresses you created yourself.
For the full picture of how crypto scams work, see our guide to spotting crypto scams.
This hack was at Binance, but the same habits protect you everywhere. Ten minutes in your account's security settings is worth it:
Binance had an emergency fund and says customers will be covered. Many exchanges that were hacked in the past did not, and their customers waited years or lost everything. The safest approach doesn't depend on any one company getting its security right:
Don't rush. When withdrawals reopen, networks and exchange systems may be busy. If you decide to move funds, send a small test amount first, double-check the address, and only use the official app. Panic is exactly what scammers count on.
Binance says the stolen funds came from its own hot wallet and that it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds. It states that user funds are safe. Until it publishes its full report and an updated proof of reserves, treat that as the company's statement rather than an independently confirmed fact.
Binance has described covering the losses itself. There is no outside claim form, refund portal or recovery service. Any message asking you to claim compensation, connect a wallet, pay a fee or confirm your login is a scam.
On 30 October Binance said withdrawals would resume in phases within about 34 hours, subject to security checks. Check the official Binance app or the website you type in yourself, not links sent to you.
There is no need to panic. If you want to reduce your exposure, wait until withdrawals reopen in the official app, send a small test amount first, and move only what you don't need for trading to a wallet you control. Rushing through links in messages is how people lose money in the days after a hack.
Blockchain analytics firms TRM Labs and Chainalysis assess with high confidence that North Korea's TraderTraitor group, linked to the Lazarus Group, was responsible. Binance has not confirmed who the attackers are.
This is a developing story. Details may change as Binance publishes its full report. We'll update this page with confirmed information only. This is general security information, not financial advice. CoinHawk is independent and is not affiliated with Binance.
