Binance says customer funds are protected and that it will absorb losses following the security incident that emerged on October 29, 2026. The preliminary estimate puts affected assets at approximately $6.3 billion. Around $3 billion has reportedly been frozen on-chain. Neither figure establishes the final loss, because immobilizing assets does not necessarily return them to the exchange.

As of October 30, 2026, the investigation remains ongoing. Frozen totals, recovery results and service availability may change. Assessing the situation requires separate checks of the compensation commitment, the assets backing customer balances and users’ ability to withdraw.

What Is Known About the Incident

Suspicious transfers prompted an investigation into unauthorized withdrawals. Binance’s preliminary October 30 update described those transactions and emergency measures to contain the damage. Calling the event merely an unsuccessful hacking attempt would therefore understate what was reported. Treating the entire preliminary estimate as an irreversible customer loss would also be premature.

The exchange has identified its SAFU protection fund and company resources as sources of loss coverage. A detailed technical report and refreshed Proof of Reserves are still needed to establish the incident’s scope and the results of remediation. Until those are available, asset recovery and any remaining shortfall remain unresolved questions.

How to Interpret the $6.3 Billion and $3 Billion Estimates

The approximately $6.3 billion figure describes the estimated scale of the incident, rather than a final calculation of net losses. The roughly $3 billion figure describes the reported value of frozen assets. These measures concern different stages of the response and should not be used interchangeably.

Subtracting the rounded figures leaves approximately $3.3 billion. That difference does not show how much remains accessible to an attacker, how much investigators can recover or how much Binance will ultimately need to replace. Those conclusions require transaction reconciliation and investigation results.

Dividing $3 billion by $6.3 billion produces approximately 47.6%. This is an arithmetic comparison between two provisional estimates, rather than a verified recovery rate. Final customer losses cannot be inferred from these figures alone: actual recoveries and implementation of the coverage commitment must also be considered.

How the Attack May Have Happened

Binance’s initial explanation pointed to a potentially compromised DevOps engineer’s laptop, access to a service container and subsequent unauthorized withdrawals. At the time of the preliminary update, investigators had found no evidence that wallet private keys had leaked.

The absence of a confirmed key leak does not rule out abuse of infrastructure authorized to initiate transactions. However, a suspected entry point does not explain the entire attack. The malware involved, the original infection route and the specific protection failures should be described as established findings only after the technical investigation supports them.

What the Customer Protection Commitment Means

An account balance, the exchange’s asset holdings and withdrawal access are three different measures. The amount displayed in an application records the platform’s obligation to a user. It does not independently verify the corresponding wallets in real time.

Binance’s loss-coverage statement concerns customer protection. It does not establish that every affected asset has already been recovered or replaced. Discussion of earlier reserve figures also raised questions about the backing of individual assets following the outflows. A fresh report with asset-specific data and remediation results is needed to address those questions.

Access to transactions requires a separate check. Temporary restrictions may remain even when compensation has been promised. Account security, balance backing and functioning withdrawals each need their own evidence.

Why Freezing Assets Does Not Mean Recovering Them

Blocking tokens can prevent further movement and give investigators time to act. Circle’s description of blocklisting explains that a restricted address can be prevented from sending or receiving USDC or EURC. That measure does not reverse a transaction that has already been completed.

A frozen balance may remain inaccessible while restrictions are in place. Immobilized tokens should therefore not be described as funds already returned to the exchange’s treasury. Reporting needs separate totals for assets frozen, assets actually recovered and amounts replaced using other resources.

What Role SAFU Can Play

SAFU, the Secure Asset Fund for Users, is Binance’s emergency user protection fund. A February 2026 FAQ described approximately $1 billion in crypto assets, while noting that their value could fluctuate.

Using that historical estimate only to compare scale, $6.3 billion is 6.3 times $1 billion. The February figure does not establish the fund’s value on October 30. Binance’s incident statement refers to both SAFU and company funds, so SAFU alone should not be presented as a verified source of the entire $6.3 billion.

The FAQ also gives Binance discretion over eligible claims. A general explanation of the fund should not be read as an unconditional insurance policy. A commitment to absorb incident losses does not automatically extend to market declines, losing trades or every subsequent scam exploiting the news.

How to Check Deposits and Withdrawals

Binance’s preliminary update announced a temporary suspension of deposits and withdrawals as a precaution. That describes the announced response, rather than a permanent status for every token, network and account. Before making a transfer, open the official application or a previously verified bookmark and check the exact asset on the intended network.

Read notices about maintenance, suspended operations and account restrictions. Then check the minimum amount, transaction fee and any requirement for a memo or other recipient identifier. If a transaction has been broadcast to the blockchain, preserve its hash and the request status.

Submitting requests repeatedly will not reopen a suspended network and can make your own records harder to follow. A functioning trading interface also does not establish that withdrawals are available.

Which Account Settings to Review

Review login history, recognized devices, withdrawals and any API keys you have created. Remove unfamiliar devices, revoke unnecessary keys and limit active keys to the permissions they actually need. Preserve records of suspicious activity before contacting support.

A strong unique password and two-factor authentication, including an authenticator application or a passkey, help protect the account. The linked email account needs protection too, because access to it may be used for account recovery. Passwords, one-time codes and recovery information should remain private.

These measures reduce the risk of personal account compromise; they cannot repair the exchange’s internal systems. The incident itself also does not establish that a particular user’s login information was exposed. Reach support through the official application or website.

A withdrawal address whitelist adds a restriction that allows transfers only to destinations approved in advance. Restrictions on recently added addresses can provide another safeguard. However, Binance’s guidance states that certain whitelist changes can trigger withdrawal suspensions of 24, 48 or 72 hours. Read the account warning before making changes so that any additional waiting period is understood.

How to Recognize Fake Compensation Offers

Reports of an attack can be followed by fraudulent reimbursement pages, requests to move assets to a “safe wallet” and urgent verification demands. An offer of a guaranteed payout after a small deposit deserves particular scrutiny, even when it accurately copies Binance’s branding.

A personal anti-phishing code can help check messages. Binance’s setup instructions specify a length of 6 to 8 characters. However, the code is only one check: verify the request by opening the service independently and reviewing notices inside the account.

Avoid unexpected links about compensation or emergency asset migration. Do not send money to an address supplied by an unfamiliar person claiming to represent support, or install remote-access software at their request. Receiving a reimbursement should not require disclosing a seed phrase, private key or one-time login code.

What a New Reserve Report Needs to Show

A useful Proof of Reserves compares specific assets with customer liabilities at a defined point in time. Binance’s system uses Merkle-tree records and cryptographic proofs that allow users to check whether their balances are included in its published data. A snapshot taken before the incident cannot establish the reserve position afterward.

For example, a platform owing customers 100 units of an asset while holding 94 units has 94% backing for that asset. Large holdings of unrelated currencies do not change that calculation. This is a hypothetical example, rather than an estimate of Binance’s current reserves.

Methodology also matters when comparing reports. In a January 7, 2026 announcement, Binance described a change to the scope of balances used in reserve reporting. The company said the previous exclusion of the platform’s own assets had produced inflated displayed ratios. A lower percentage across reports using different methods therefore does not, by itself, prove a new loss. Compare snapshot dates, included balances and calculation rules first.

Personal Wallets and Records for Support

Decisions about self-custody should follow a check of transfer availability. Under self-custody, users control their private keys; cold storage keeps those keys offline. This reduces dependence on an exchange’s authorization of withdrawals, while making the owner responsible for backups, address accuracy and recovery.

A small test transfer can help verify the network and destination before sending a larger amount. Fees and minimum limits still need to be considered. There is no universal allocation suitable for every user, and no storage method eliminates risk entirely.

If a suspicious transaction requires investigation, retain the asset name, amount, network, transaction hash, sending and receiving addresses, time and timezone. An internal exchange record may have no public hash. In that case, save the order or withdrawal request identifier and the displayed status. Never include passwords, authentication codes or seed phrases in a support case.

Which Updates Will Clarify the Situation

Assess progress through verifiable results: a reconciled list of affected assets and amounts, a technical explanation of the attack, and dated totals for frozen, recovered and replaced funds. The report should distinguish confirmed findings from working hypotheses and explain the protective measures taken.

Users also need clear deposit and withdrawal status by network, fresh reserve data following remediation and an explanation of any remaining shortfall. Those details will allow the coverage promise to be compared with its implementation. Until then, account security, exchange custody exposure and the risks of trading positions should be assessed separately.

Binance says customer funds are protected and that it will absorb losses following the security incident that emerged on October 29, 2026. The preliminary estimate puts affected assets at approximately $6.3 billion. Around $3 billion has reportedly been frozen on-chain. Neither figure establishes the final loss, because immobilizing assets does not necessarily return them to the exchange.

As of October 30, 2026, the investigation remains ongoing. Frozen totals, recovery results and service availability may change. Assessing the situation requires separate checks of the compensation commitment, the assets backing customer balances and users’ ability to withdraw.

What Is Known About the Incident

Suspicious transfers prompted an investigation into unauthorized withdrawals. Binance’s preliminary October 30 update described those transactions and emergency measures to contain the damage. Calling the event merely an unsuccessful hacking attempt would therefore understate what was reported. Treating the entire preliminary estimate as an irreversible customer loss would also be premature.

The exchange has identified its SAFU protection fund and company resources as sources of loss coverage. A detailed technical report and refreshed Proof of Reserves are still needed to establish the incident’s scope and the results of remediation. Until those are available, asset recovery and any remaining shortfall remain unresolved questions.

How to Interpret the $6.3 Billion and $3 Billion Estimates

The approximately $6.3 billion figure describes the estimated scale of the incident, rather than a final calculation of net losses. The roughly $3 billion figure describes the reported value of frozen assets. These measures concern different stages of the response and should not be used interchangeably.

Subtracting the rounded figures leaves approximately $3.3 billion. That difference does not show how much remains accessible to an attacker, how much investigators can recover or how much Binance will ultimately need to replace. Those conclusions require transaction reconciliation and investigation results.

Dividing $3 billion by $6.3 billion produces approximately 47.6%. This is an arithmetic comparison between two provisional estimates, rather than a verified recovery rate. Final customer losses cannot be inferred from these figures alone: actual recoveries and implementation of the coverage commitment must also be considered.

How the Attack May Have Happened

Binance’s initial explanation pointed to a potentially compromised DevOps engineer’s laptop, access to a service container and subsequent unauthorized withdrawals. At the time of the preliminary update, investigators had found no evidence that wallet private keys had leaked.

The absence of a confirmed key leak does not rule out abuse of infrastructure authorized to initiate transactions. However, a suspected entry point does not explain the entire attack. The malware involved, the original infection route and the specific protection failures should be described as established findings only after the technical investigation supports them.

What the Customer Protection Commitment Means

An account balance, the exchange’s asset holdings and withdrawal access are three different measures. The amount displayed in an application records the platform’s obligation to a user. It does not independently verify the corresponding wallets in real time.

Binance’s loss-coverage statement concerns customer protection. It does not establish that every affected asset has already been recovered or replaced. Discussion of earlier reserve figures also raised questions about the backing of individual assets following the outflows. A fresh report with asset-specific data and remediation results is needed to address those questions.

Access to transactions requires a separate check. Temporary restrictions may remain even when compensation has been promised. Account security, balance backing and functioning withdrawals each need their own evidence.

Why Freezing Assets Does Not Mean Recovering Them

Blocking tokens can prevent further movement and give investigators time to act. Circle’s description of blocklisting explains that a restricted address can be prevented from sending or receiving USDC or EURC. That measure does not reverse a transaction that has already been completed.

A frozen balance may remain inaccessible while restrictions are in place. Immobilized tokens should therefore not be described as funds already returned to the exchange’s treasury. Reporting needs separate totals for assets frozen, assets actually recovered and amounts replaced using other resources.

What Role SAFU Can Play

SAFU, the Secure Asset Fund for Users, is Binance’s emergency user protection fund. A February 2026 FAQ described approximately $1 billion in crypto assets, while noting that their value could fluctuate.

Using that historical estimate only to compare scale, $6.3 billion is 6.3 times $1 billion. The February figure does not establish the fund’s value on October 30. Binance’s incident statement refers to both SAFU and company funds, so SAFU alone should not be presented as a verified source of the entire $6.3 billion.

The FAQ also gives Binance discretion over eligible claims. A general explanation of the fund should not be read as an unconditional insurance policy. A commitment to absorb incident losses does not automatically extend to market declines, losing trades or every subsequent scam exploiting the news.

How to Check Deposits and Withdrawals

Binance’s preliminary update announced a temporary suspension of deposits and withdrawals as a precaution. That describes the announced response, rather than a permanent status for every token, network and account. Before making a transfer, open the official application or a previously verified bookmark and check the exact asset on the intended network.

Read notices about maintenance, suspended operations and account restrictions. Then check the minimum amount, transaction fee and any requirement for a memo or other recipient identifier. If a transaction has been broadcast to the blockchain, preserve its hash and the request status.

Submitting requests repeatedly will not reopen a suspended network and can make your own records harder to follow. A functioning trading interface also does not establish that withdrawals are available.

Which Account Settings to Review

Review login history, recognized devices, withdrawals and any API keys you have created. Remove unfamiliar devices, revoke unnecessary keys and limit active keys to the permissions they actually need. Preserve records of suspicious activity before contacting support.

A strong unique password and two-factor authentication, including an authenticator application or a passkey, help protect the account. The linked email account needs protection too, because access to it may be used for account recovery. Passwords, one-time codes and recovery information should remain private.

These measures reduce the risk of personal account compromise; they cannot repair the exchange’s internal systems. The incident itself also does not establish that a particular user’s login information was exposed. Reach support through the official application or website.

A withdrawal address whitelist adds a restriction that allows transfers only to destinations approved in advance. Restrictions on recently added addresses can provide another safeguard. However, Binance’s guidance states that certain whitelist changes can trigger withdrawal suspensions of 24, 48 or 72 hours. Read the account warning before making changes so that any additional waiting period is understood.

How to Recognize Fake Compensation Offers

Reports of an attack can be followed by fraudulent reimbursement pages, requests to move assets to a “safe wallet” and urgent verification demands. An offer of a guaranteed payout after a small deposit deserves particular scrutiny, even when it accurately copies Binance’s branding.

A personal anti-phishing code can help check messages. Binance’s setup instructions specify a length of 6 to 8 characters. However, the code is only one check: verify the request by opening the service independently and reviewing notices inside the account.

Avoid unexpected links about compensation or emergency asset migration. Do not send money to an address supplied by an unfamiliar person claiming to represent support, or install remote-access software at their request. Receiving a reimbursement should not require disclosing a seed phrase, private key or one-time login code.

What a New Reserve Report Needs to Show

A useful Proof of Reserves compares specific assets with customer liabilities at a defined point in time. Binance’s system uses Merkle-tree records and cryptographic proofs that allow users to check whether their balances are included in its published data. A snapshot taken before the incident cannot establish the reserve position afterward.

For example, a platform owing customers 100 units of an asset while holding 94 units has 94% backing for that asset. Large holdings of unrelated currencies do not change that calculation. This is a hypothetical example, rather than an estimate of Binance’s current reserves.

Methodology also matters when comparing reports. In a January 7, 2026 announcement, Binance described a change to the scope of balances used in reserve reporting. The company said the previous exclusion of the platform’s own assets had produced inflated displayed ratios. A lower percentage across reports using different methods therefore does not, by itself, prove a new loss. Compare snapshot dates, included balances and calculation rules first.

Personal Wallets and Records for Support

Decisions about self-custody should follow a check of transfer availability. Under self-custody, users control their private keys; cold storage keeps those keys offline. This reduces dependence on an exchange’s authorization of withdrawals, while making the owner responsible for backups, address accuracy and recovery.

A small test transfer can help verify the network and destination before sending a larger amount. Fees and minimum limits still need to be considered. There is no universal allocation suitable for every user, and no storage method eliminates risk entirely.

If a suspicious transaction requires investigation, retain the asset name, amount, network, transaction hash, sending and receiving addresses, time and timezone. An internal exchange record may have no public hash. In that case, save the order or withdrawal request identifier and the displayed status. Never include passwords, authentication codes or seed phrases in a support case.

Which Updates Will Clarify the Situation

Assess progress through verifiable results: a reconciled list of affected assets and amounts, a technical explanation of the attack, and dated totals for frozen, recovered and replaced funds. The report should distinguish confirmed findings from working hypotheses and explain the protective measures taken.

Users also need clear deposit and withdrawal status by network, fresh reserve data following remediation and an explanation of any remaining shortfall. Those details will allow the coverage promise to be compared with its implementation. Until then, account security, exchange custody exposure and the risks of trading positions should be assessed separately.

Binance says customer funds are protected and that it will absorb losses following the security incident that emerged on October 29, 2026. The preliminary estimate puts affected assets at approximately $6.3 billion. Around $3 billion has reportedly been frozen on-chain. Neither figure establishes the final loss, because immobilizing assets does not necessarily return them to the exchange.

As of October 30, 2026, the investigation remains ongoing. Frozen totals, recovery results and service availability may change. Assessing the situation requires separate checks of the compensation commitment, the assets backing customer balances and users’ ability to withdraw.

What Is Known About the Incident

Suspicious transfers prompted an investigation into unauthorized withdrawals. Binance’s preliminary October 30 update described those transactions and emergency measures to contain the damage. Calling the event merely an unsuccessful hacking attempt would therefore understate what was reported. Treating the entire preliminary estimate as an irreversible customer loss would also be premature.

The exchange has identified its SAFU protection fund and company resources as sources of loss coverage. A detailed technical report and refreshed Proof of Reserves are still needed to establish the incident’s scope and the results of remediation. Until those are available, asset recovery and any remaining shortfall remain unresolved questions.

How to Interpret the $6.3 Billion and $3 Billion Estimates

The approximately $6.3 billion figure describes the estimated scale of the incident, rather than a final calculation of net losses. The roughly $3 billion figure describes the reported value of frozen assets. These measures concern different stages of the response and should not be used interchangeably.

Subtracting the rounded figures leaves approximately $3.3 billion. That difference does not show how much remains accessible to an attacker, how much investigators can recover or how much Binance will ultimately need to replace. Those conclusions require transaction reconciliation and investigation results.

Dividing $3 billion by $6.3 billion produces approximately 47.6%. This is an arithmetic comparison between two provisional estimates, rather than a verified recovery rate. Final customer losses cannot be inferred from these figures alone: actual recoveries and implementation of the coverage commitment must also be considered.

How the Attack May Have Happened

Binance’s initial explanation pointed to a potentially compromised DevOps engineer’s laptop, access to a service container and subsequent unauthorized withdrawals. At the time of the preliminary update, investigators had found no evidence that wallet private keys had leaked.

The absence of a confirmed key leak does not rule out abuse of infrastructure authorized to initiate transactions. However, a suspected entry point does not explain the entire attack. The malware involved, the original infection route and the specific protection failures should be described as established findings only after the technical investigation supports them.

What the Customer Protection Commitment Means

An account balance, the exchange’s asset holdings and withdrawal access are three different measures. The amount displayed in an application records the platform’s obligation to a user. It does not independently verify the corresponding wallets in real time.

Binance’s loss-coverage statement concerns customer protection. It does not establish that every affected asset has already been recovered or replaced. Discussion of earlier reserve figures also raised questions about the backing of individual assets following the outflows. A fresh report with asset-specific data and remediation results is needed to address those questions.

Access to transactions requires a separate check. Temporary restrictions may remain even when compensation has been promised. Account security, balance backing and functioning withdrawals each need their own evidence.

Why Freezing Assets Does Not Mean Recovering Them

Blocking tokens can prevent further movement and give investigators time to act. Circle’s description of blocklisting explains that a restricted address can be prevented from sending or receiving USDC or EURC. That measure does not reverse a transaction that has already been completed.

A frozen balance may remain inaccessible while restrictions are in place. Immobilized tokens should therefore not be described as funds already returned to the exchange’s treasury. Reporting needs separate totals for assets frozen, assets actually recovered and amounts replaced using other resources.

What Role SAFU Can Play

SAFU, the Secure Asset Fund for Users, is Binance’s emergency user protection fund. A February 2026 FAQ described approximately $1 billion in crypto assets, while noting that their value could fluctuate.

Using that historical estimate only to compare scale, $6.3 billion is 6.3 times $1 billion. The February figure does not establish the fund’s value on October 30. Binance’s incident statement refers to both SAFU and company funds, so SAFU alone should not be presented as a verified source of the entire $6.3 billion.

The FAQ also gives Binance discretion over eligible claims. A general explanation of the fund should not be read as an unconditional insurance policy. A commitment to absorb incident losses does not automatically extend to market declines, losing trades or every subsequent scam exploiting the news.

How to Check Deposits and Withdrawals

Binance’s preliminary update announced a temporary suspension of deposits and withdrawals as a precaution. That describes the announced response, rather than a permanent status for every token, network and account. Before making a transfer, open the official application or a previously verified bookmark and check the exact asset on the intended network.

Read notices about maintenance, suspended operations and account restrictions. Then check the minimum amount, transaction fee and any requirement for a memo or other recipient identifier. If a transaction has been broadcast to the blockchain, preserve its hash and the request status.

Submitting requests repeatedly will not reopen a suspended network and can make your own records harder to follow. A functioning trading interface also does not establish that withdrawals are available.

Which Account Settings to Review

Review login history, recognized devices, withdrawals and any API keys you have created. Remove unfamiliar devices, revoke unnecessary keys and limit active keys to the permissions they actually need. Preserve records of suspicious activity before contacting support.

A strong unique password and two-factor authentication, including an authenticator application or a passkey, help protect the account. The linked email account needs protection too, because access to it may be used for account recovery. Passwords, one-time codes and recovery information should remain private.

These measures reduce the risk of personal account compromise; they cannot repair the exchange’s internal systems. The incident itself also does not establish that a particular user’s login information was exposed. Reach support through the official application or website.

A withdrawal address whitelist adds a restriction that allows transfers only to destinations approved in advance. Restrictions on recently added addresses can provide another safeguard. However, Binance’s guidance states that certain whitelist changes can trigger withdrawal suspensions of 24, 48 or 72 hours. Read the account warning before making changes so that any additional waiting period is understood.

How to Recognize Fake Compensation Offers

Reports of an attack can be followed by fraudulent reimbursement pages, requests to move assets to a “safe wallet” and urgent verification demands. An offer of a guaranteed payout after a small deposit deserves particular scrutiny, even when it accurately copies Binance’s branding.

A personal anti-phishing code can help check messages. Binance’s setup instructions specify a length of 6 to 8 characters. However, the code is only one check: verify the request by opening the service independently and reviewing notices inside the account.

Avoid unexpected links about compensation or emergency asset migration. Do not send money to an address supplied by an unfamiliar person claiming to represent support, or install remote-access software at their request. Receiving a reimbursement should not require disclosing a seed phrase, private key or one-time login code.

What a New Reserve Report Needs to Show

A useful Proof of Reserves compares specific assets with customer liabilities at a defined point in time. Binance’s system uses Merkle-tree records and cryptographic proofs that allow users to check whether their balances are included in its published data. A snapshot taken before the incident cannot establish the reserve position afterward.

For example, a platform owing customers 100 units of an asset while holding 94 units has 94% backing for that asset. Large holdings of unrelated currencies do not change that calculation. This is a hypothetical example, rather than an estimate of Binance’s current reserves.

Methodology also matters when comparing reports. In a January 7, 2026 announcement, Binance described a change to the scope of balances used in reserve reporting. The company said the previous exclusion of the platform’s own assets had produced inflated displayed ratios. A lower percentage across reports using different methods therefore does not, by itself, prove a new loss. Compare snapshot dates, included balances and calculation rules first.

Personal Wallets and Records for Support

Decisions about self-custody should follow a check of transfer availability. Under self-custody, users control their private keys; cold storage keeps those keys offline. This reduces dependence on an exchange’s authorization of withdrawals, while making the owner responsible for backups, address accuracy and recovery.

A small test transfer can help verify the network and destination before sending a larger amount. Fees and minimum limits still need to be considered. There is no universal allocation suitable for every user, and no storage method eliminates risk entirely.

If a suspicious transaction requires investigation, retain the asset name, amount, network, transaction hash, sending and receiving addresses, time and timezone. An internal exchange record may have no public hash. In that case, save the order or withdrawal request identifier and the displayed status. Never include passwords, authentication codes or seed phrases in a support case.

Which Updates Will Clarify the Situation

Assess progress through verifiable results: a reconciled list of affected assets and amounts, a technical explanation of the attack, and dated totals for frozen, recovered and replaced funds. The report should distinguish confirmed findings from working hypotheses and explain the protective measures taken.

Users also need clear deposit and withdrawal status by network, fresh reserve data following remediation and an explanation of any remaining shortfall. Those details will allow the coverage promise to be compared with its implementation. Until then, account security, exchange custody exposure and the risks of trading positions should be assessed separately.

Binance says customer funds are protected and that it will absorb losses following the security incident that emerged on October 29, 2026. The preliminary estimate puts affected assets at approximately $6.3 billion. Around $3 billion has reportedly been frozen on-chain. Neither figure establishes the final loss, because immobilizing assets does not necessarily return them to the exchange.

As of October 30, 2026, the investigation remains ongoing. Frozen totals, recovery results and service availability may change. Assessing the situation requires separate checks of the compensation commitment, the assets backing customer balances and users’ ability to withdraw.

What Is Known About the Incident

Suspicious transfers prompted an investigation into unauthorized withdrawals. Binance’s preliminary October 30 update described those transactions and emergency measures to contain the damage. Calling the event merely an unsuccessful hacking attempt would therefore understate what was reported. Treating the entire preliminary estimate as an irreversible customer loss would also be premature.

The exchange has identified its SAFU protection fund and company resources as sources of loss coverage. A detailed technical report and refreshed Proof of Reserves are still needed to establish the incident’s scope and the results of remediation. Until those are available, asset recovery and any remaining shortfall remain unresolved questions.

How to Interpret the $6.3 Billion and $3 Billion Estimates

The approximately $6.3 billion figure describes the estimated scale of the incident, rather than a final calculation of net losses. The roughly $3 billion figure describes the reported value of frozen assets. These measures concern different stages of the response and should not be used interchangeably.

Subtracting the rounded figures leaves approximately $3.3 billion. That difference does not show how much remains accessible to an attacker, how much investigators can recover or how much Binance will ultimately need to replace. Those conclusions require transaction reconciliation and investigation results.

Dividing $3 billion by $6.3 billion produces approximately 47.6%. This is an arithmetic comparison between two provisional estimates, rather than a verified recovery rate. Final customer losses cannot be inferred from these figures alone: actual recoveries and implementation of the coverage commitment must also be considered.

How the Attack May Have Happened

Binance’s initial explanation pointed to a potentially compromised DevOps engineer’s laptop, access to a service container and subsequent unauthorized withdrawals. At the time of the preliminary update, investigators had found no evidence that wallet private keys had leaked.

The absence of a confirmed key leak does not rule out abuse of infrastructure authorized to initiate transactions. However, a suspected entry point does not explain the entire attack. The malware involved, the original infection route and the specific protection failures should be described as established findings only after the technical investigation supports them.

What the Customer Protection Commitment Means

An account balance, the exchange’s asset holdings and withdrawal access are three different measures. The amount displayed in an application records the platform’s obligation to a user. It does not independently verify the corresponding wallets in real time.

Binance’s loss-coverage statement concerns customer protection. It does not establish that every affected asset has already been recovered or replaced. Discussion of earlier reserve figures also raised questions about the backing of individual assets following the outflows. A fresh report with asset-specific data and remediation results is needed to address those questions.

Access to transactions requires a separate check. Temporary restrictions may remain even when compensation has been promised. Account security, balance backing and functioning withdrawals each need their own evidence.

Why Freezing Assets Does Not Mean Recovering Them

Blocking tokens can prevent further movement and give investigators time to act. Circle’s description of blocklisting explains that a restricted address can be prevented from sending or receiving USDC or EURC. That measure does not reverse a transaction that has already been completed.

A frozen balance may remain inaccessible while restrictions are in place. Immobilized tokens should therefore not be described as funds already returned to the exchange’s treasury. Reporting needs separate totals for assets frozen, assets actually recovered and amounts replaced using other resources.

What Role SAFU Can Play

SAFU, the Secure Asset Fund for Users, is Binance’s emergency user protection fund. A February 2026 FAQ described approximately $1 billion in crypto assets, while noting that their value could fluctuate.

Using that historical estimate only to compare scale, $6.3 billion is 6.3 times $1 billion. The February figure does not establish the fund’s value on October 30. Binance’s incident statement refers to both SAFU and company funds, so SAFU alone should not be presented as a verified source of the entire $6.3 billion.

The FAQ also gives Binance discretion over eligible claims. A general explanation of the fund should not be read as an unconditional insurance policy. A commitment to absorb incident losses does not automatically extend to market declines, losing trades or every subsequent scam exploiting the news.

How to Check Deposits and Withdrawals

Binance’s preliminary update announced a temporary suspension of deposits and withdrawals as a precaution. That describes the announced response, rather than a permanent status for every token, network and account. Before making a transfer, open the official application or a previously verified bookmark and check the exact asset on the intended network.

Read notices about maintenance, suspended operations and account restrictions. Then check the minimum amount, transaction fee and any requirement for a memo or other recipient identifier. If a transaction has been broadcast to the blockchain, preserve its hash and the request status.

Submitting requests repeatedly will not reopen a suspended network and can make your own records harder to follow. A functioning trading interface also does not establish that withdrawals are available.

Which Account Settings to Review

Review login history, recognized devices, withdrawals and any API keys you have created. Remove unfamiliar devices, revoke unnecessary keys and limit active keys to the permissions they actually need. Preserve records of suspicious activity before contacting support.

A strong unique password and two-factor authentication, including an authenticator application or a passkey, help protect the account. The linked email account needs protection too, because access to it may be used for account recovery. Passwords, one-time codes and recovery information should remain private.

These measures reduce the risk of personal account compromise; they cannot repair the exchange’s internal systems. The incident itself also does not establish that a particular user’s login information was exposed. Reach support through the official application or website.

A withdrawal address whitelist adds a restriction that allows transfers only to destinations approved in advance. Restrictions on recently added addresses can provide another safeguard. However, Binance’s guidance states that certain whitelist changes can trigger withdrawal suspensions of 24, 48 or 72 hours. Read the account warning before making changes so that any additional waiting period is understood.

How to Recognize Fake Compensation Offers

Reports of an attack can be followed by fraudulent reimbursement pages, requests to move assets to a “safe wallet” and urgent verification demands. An offer of a guaranteed payout after a small deposit deserves particular scrutiny, even when it accurately copies Binance’s branding.

A personal anti-phishing code can help check messages. Binance’s setup instructions specify a length of 6 to 8 characters. However, the code is only one check: verify the request by opening the service independently and reviewing notices inside the account.

Avoid unexpected links about compensation or emergency asset migration. Do not send money to an address supplied by an unfamiliar person claiming to represent support, or install remote-access software at their request. Receiving a reimbursement should not require disclosing a seed phrase, private key or one-time login code.

What a New Reserve Report Needs to Show

A useful Proof of Reserves compares specific assets with customer liabilities at a defined point in time. Binance’s system uses Merkle-tree records and cryptographic proofs that allow users to check whether their balances are included in its published data. A snapshot taken before the incident cannot establish the reserve position afterward.

For example, a platform owing customers 100 units of an asset while holding 94 units has 94% backing for that asset. Large holdings of unrelated currencies do not change that calculation. This is a hypothetical example, rather than an estimate of Binance’s current reserves.

Methodology also matters when comparing reports. In a January 7, 2026 announcement, Binance described a change to the scope of balances used in reserve reporting. The company said the previous exclusion of the platform’s own assets had produced inflated displayed ratios. A lower percentage across reports using different methods therefore does not, by itself, prove a new loss. Compare snapshot dates, included balances and calculation rules first.

Personal Wallets and Records for Support

Decisions about self-custody should follow a check of transfer availability. Under self-custody, users control their private keys; cold storage keeps those keys offline. This reduces dependence on an exchange’s authorization of withdrawals, while making the owner responsible for backups, address accuracy and recovery.

A small test transfer can help verify the network and destination before sending a larger amount. Fees and minimum limits still need to be considered. There is no universal allocation suitable for every user, and no storage method eliminates risk entirely.

If a suspicious transaction requires investigation, retain the asset name, amount, network, transaction hash, sending and receiving addresses, time and timezone. An internal exchange record may have no public hash. In that case, save the order or withdrawal request identifier and the displayed status. Never include passwords, authentication codes or seed phrases in a support case.

Which Updates Will Clarify the Situation

Assess progress through verifiable results: a reconciled list of affected assets and amounts, a technical explanation of the attack, and dated totals for frozen, recovered and replaced funds. The report should distinguish confirmed findings from working hypotheses and explain the protective measures taken.

Users also need clear deposit and withdrawal status by network, fresh reserve data following remediation and an explanation of any remaining shortfall. Those details will allow the coverage promise to be compared with its implementation. Until then, account security, exchange custody exposure and the risks of trading positions should be assessed separately.