If you have a Binance account, you probably went to bed last night with a knot in your stomach. On October 29, 2026 the world's largest crypto exchange suffered what everything suggests was a hack, with billions of dollars flowing out of its wallets, withdrawals frozen and social media full of conflicting numbers. The good news is that quite a lot is already known, and there are a few simple things you can do today to feel more in control.
Here's what happened in the Binance hack, what the company has said about your funds, what to check in your account and, most importantly, how to avoid the scams that always follow news like this: fake Binance support, "fund recovery" outfits and "compensation" messages that only want more of your money.
Quick answer
Updated October 30, 2026, 00:30 UTC. Binance confirms a security incident, says user funds are safe and that it will cover all losses, and has temporarily suspended deposits and withdrawals. Don't rush to move anything, only log in through the official app or website, change your password and check your two-factor authentication. One thing to be clear on: nobody from Binance will message you on WhatsApp or Telegram asking for money, passwords or your seed phrase. If that happens, it's a scam.
In this article
What happened at Binance
On the evening of Thursday, October 29, huge outflows from Binance wallets started showing up on the blockchain. A researcher flagged on X that funds from a Binance-linked Ethereum wallet were being sent to a brand-new address through a contract call funded via Tornado Cash, a service used to hide where crypto comes from. Things moved fast from there. Here's the timeline, in UTC:
- 21:15. Binance founder Changpeng Zhao (CZ) posts on X that "it does look like a hack on Binance", that user funds are safe and that he expects them to be fully covered. He no longer runs the company but remains its largest shareholder.
- 21:18 to 21:30. Circle freezes more than 800 million USDC and Tether more than 1.567 billion USDT linked to the incident. They issue those two stablecoins and can block them even after they've landed in the attacker's wallets.
- Around 21:25. Binance's first statement: it's investigating a "potential security issue", says user funds are completely safe and warns users not to trust unofficial links, messages or requests for account information.
- 22:08. Binance co-founder Yi He thanks Ripple for freezing around 200 million. Other issuers follow, including World Liberty Financial with 27 million in USD1.
- 22:15 and 22:33. Binance says it's running security checks and that withdrawals will resume once the issue is fully resolved. Binance.US, a separate company, says it isn't affected.
- Around 22:30. Lending platform Aave freezes its markets as a precaution.
- 23:06. Binance also suspends Binance Alpha, its section for newly launched tokens.
- 23:22. Binance clarifies that, despite other figures circulating, the verified total frozen is $2.54 billion, and that it may rise.
- 00:13 on October 30. Binance's clearest message so far: "Binance will cover all losses." All deposits and withdrawals are temporarily suspended while it runs security checks, freezes funds and works with law enforcement, and it will publish a full post-mortem when the investigation is complete.
Shortly afterwards, Yi He said the Arbitrum Security Council had frozen roughly another $30.5 million.
What's confirmed and what's still an estimate
With so many numbers flying around, it helps to keep them apart.
Confirmed by Binance: there is a security incident, Binance says it will cover all losses, deposits and withdrawals are temporarily suspended, and the verified total frozen was $2.54 billion as of 23:22 UTC.
Estimates, not official figures: analytics firm Arkham labeled a group of wallets "binance-hacker-1029" that, according to Cointelegraph, held around $5.84 billion. That's what was sitting in those wallets, not a confirmed loss. TechCrunch reports that at least $2 billion was drained from Binance's hot wallets, the internet-connected wallets an exchange uses to process everyday withdrawals. The final amount stolen, who's behind it and how they got in are still unknown.
It's a lot of money, but it's also a good sign that such a large share was frozen within hours. That ability to lock funds down is what makes it possible to give them back later.
Are my funds at risk?
What Binance has said, in writing and more than once, is that user funds are safe and that it will cover all hacking losses. From what has been published so far, the attack hit the platform's own wallets rather than customer accounts one by one, and there's no official word that anyone's balance was touched.
What does affect you right now is access: while the checks last, you can't deposit or withdraw. Binance hasn't given a date to reopen. It also hasn't explained how the attack happened or whether there will be any process for users; it has promised to cover that in a full post-mortem.
So, according to the company, your money is still there even if you can't move it for now. It's uncomfortable, but there's no need for hasty decisions, and no reason to listen to anyone promising to get it out sooner.
What to do if you have a Binance account
You don't need to do anything drastic. It is worth spending ten minutes locking your account down properly, because scammers will try to slip in right here over the coming days:
- Only log in through the official app or by typing the address yourself. No links from emails, texts, ads or DMs, however official they look. Reliable updates are in the app, on the website and on the official @binance account on X.
- Change your password and make sure you don't use it anywhere else. If it's the same as your email password, change that too, because whoever controls your email can try to take over your account.
- Check your two-factor authentication (2FA). That's the second code the app asks for after your password. An authenticator app or a security key is better than SMS.
- Review devices and active sessions in the security settings and log out anything you don't recognize.
- Check your API keys. These are permissions you give to trading bots or apps so they can use your account. Delete any you don't use, and make sure the ones you keep can't withdraw.
- Turn on or review the withdrawal whitelist. It's a list of addresses your account is allowed to send funds to, so even if someone got in they couldn't send them anywhere else. Make sure only your own addresses are on it.
- Set an anti-phishing code in your security settings. It's a word you choose that appears in genuine Binance emails; if an email doesn't show it, it isn't from Binance.
- Screenshot your balance and transaction history with the date visible. If you ever need to claim anything, you'll have a snapshot of how things stood.
And one piece of advice worth its weight in gold these days: don't rush to move funds the moment withdrawals reopen. If you decide to take them out, do it from the app, one step at a time, check that your wallet supports the network you pick and send a small test amount first. Urgency is the scammers' favourite tool.
Binance scams that use the hack as bait
After a big hack it's always the same story: thousands of worried people looking for answers, and scammers ready to "help". Binance said it in its very first message: don't trust unofficial links, messages or requests for account information. These are the Binance scams you're most likely to see right now and how to spot each one.
Fake Binance support on WhatsApp, Telegram or social media
Someone claiming to be "Binance Support" messages you, often right after you've mentioned your problem on X or in a group. They're very friendly, tell you your account is at risk or that they can "prioritize" your withdrawal, and ask you to share a code, install a remote-access app or move your funds to a "safe wallet".
How to spot it: real Binance support works from inside the app or website, doesn't DM you asking for money and never needs your passwords, verification codes or seed phrase. If you're unsure about a number, handle or link, check it in Binance Verify, Binance's official tool for confirming whether a channel is really theirs.
"Fund recovery" services
They pop up in comment sections, groups and ads: companies or self-styled experts promising to recover 100% of what you had on Binance, or to get it out before everyone else, for an upfront fee.
How to spot it: nobody can get your money out of Binance while withdrawals are suspended, and the company has already said it will cover the losses. Anyone guaranteeing 100% and asking you to pay first is usually a scam. The FTC and the FBI warn about these recovery scams, and we explain how to tell them apart in how to spot crypto recovery scams.
"Verify your account" emails and texts
"Due to the security incident, verify your account within 24 hours or it will be locked." The link leads to a copy of the Binance website that captures your username, password and code.
How to spot it: look for your anti-phishing code in the email, don't tap links, and if you want to check something, open the app yourself. We explain how these messages work in smishing and fake bank texts, and the same applies to calls in vishing and spoofed calls.
Fake compensation or refunds
You get a message saying you're owed "compensation" or a "refund" for the hack, and that to claim it you need to pay a small fee, connect your wallet to a website or hand over your seed phrase.
How to spot it: if Binance sets up anything for users, you'll see it in the app and on its official channels. Nobody genuinely paying you back asks you to pay first or to give them your seed phrase, the 12 or 24 words that give full control of your wallet.
Cloned websites and fake apps
Sponsored search ads, links on social media or apps with the Binance logo that aren't Binance. They look identical, but everything you type goes straight to the scammers.
How to spot it: only download the app from your phone's official store, type the website address yourself and bookmark it. If a link reaches you by message, check it in Binance Verify before opening it.
If any of this sounds familiar, stop for a moment and don't pay anything. Asking someone you trust before you act costs nothing and can save you a lot of heartache.
If you've already been scammed using the hack
If it happened to you, don't blame yourself. These scams are well rehearsed and arrive at the very moment you're most worried about your money. What matters now is moving quickly, because the first hours really count:
- Cut contact and don't make any further payment, even if they say it's to "release" or "return" your funds.
- If you shared passwords, codes or your seed phrase, change your Binance and email passwords from a device you trust. If you gave away the seed phrase of your own wallet, move whatever is left to a new wallet as soon as possible.
- Save the evidence: screenshots of the chat and profile, the scammer's number or handle, the wallet address you sent funds to and the ID of each transaction (the hash or TXID).
- Tell Binance through its official support in the app, with those addresses and IDs, and ask them to log it as fraud.
- Report it to the police, and in the US also to the FBI at IC3.
We go through it step by step in what to do in the first 24 hours after a scam and, for crypto specifically, in can stolen crypto be recovered?. Crypto leaves a trail on the blockchain and, as we've just seen with billions frozen in a single night, it can be traced and frozen when it reaches a company that verifies its customers.
We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We trace where your money went, prepare the evidence and ask exchanges and courts for whatever is needed to try to freeze it. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.
