Binance Just Lost US$6.3 Billion to Hackers and Froze Every Withdrawal. Is Your Crypto Safe, and What Does “Suspended” Really Mean?

At five past four this morning Malaysian time, money started leaving Binance’s wallets. Twenty minutes later about US$6.3 billion was gone, across ten blockchains, in what is now the largest theft in the history of cryptocurrency. The world’s biggest exchange paused withdrawals two hours later, briefly listed deposits as suspended too, and its chief executive posted a message that began: “Bottom line – your money is safe, and we’re covering every loss.”

If you hold crypto on Binance, or on any exchange, you have three questions this morning: what happened, whether your coins are really safe, and what “all deposits and withdrawals temporarily suspended” means for you. This article answers them with what is confirmed as of 5pm Malaysian time, what is still being investigated, and what a Malaysian user should do now.

📌 Key points

• About US$6.3 billion left Binance’s hot wallets from 20:05 UTC on 29 October, most of it in 20 minutes. The previous record was Bybit’s US$1.5 billion in 2025.
• Blockchain investigators have frozen roughly US$3 billion of it, mainly Tether and Circle stablecoins. About US$2.4 billion in bitcoin and ether is beyond anyone’s reach.
• Binance says it will cover every loss from its emergency fund and its own money, and expects withdrawals to restart within 48 hours. No user has lost a balance; the risk is time, not money, if the promise holds.
• Investigators TRM Labs attribute the attack with high confidence to North Korea’s TraderTraitor unit, the group behind the Bybit theft. Binance says it began with a compromised engineer’s laptop.
• Bitcoin fell as much as 5% to about US$76,500 and US$1.5 billion of leveraged positions were liquidated. For Malaysians, Binance is not licensed here, so none of this falls under the Securities Commission’s protection.

What happened, in order

Time (Malaysia)	Event
Wed 28 Oct	Attacker funds a wallet through Tornado Cash and rehearses the attack code on test wallets (TRM Labs).
Thu 29 Oct, late	The same code is installed on a Binance Ethereum hot wallet.
Fri 30 Oct, 04:05	XRP wallets drained; Solana, Optimism, then Bitcoin (18,270 BTC) and Tron follow within 15 minutes.
04:20	One transaction carrying 50 pre-signed authorisations hands the Ethereum hot wallet to a “sweeper” contract; 167,464 ETH and 63 tokens leave three minutes later.
05:01	Tether freezes US$971 million of stolen USDT; Circle freezes US$823 million of USDC minutes later.
06:15	Binance pauses withdrawals.
08:13	Binance: “all deposits and withdrawals temporarily suspended… Binance will cover all losses.”
08:52	Binance: verified frozen total “around $3 billion”.
12:17	Co-CEO Yi He: “We expect to begin resume withdrawal services in the next 48 hours.” Deposits “remain unaffected and continue to operate as normal.”
17:00	Withdrawals still paused. Bitcoin about US$77,500, down 3% on the day.

Binance’s own estimate of the damage is “around 6.3B”. TRM Labs counts US$6.36 billion at the time of theft; Chainalysis about US$5.9 billion. On any count it is roughly four times the Bybit theft of February 2025, which until yesterday was the record.

How a US$155 billion exchange got robbed

Exchanges keep most customer coins in “cold” storage, offline, and a working float in “hot” wallets connected to the internet to process withdrawals. Hot wallets are the target, and the attacker went after the system that signs transactions for them.

Binance’s account, from Richard Teng, is that the incident “may have started with a compromised DevOps engineer’s laptop”, which gave the attacker access to an internal service and the ability to submit withdrawal transactions that looked authorised. He later stressed it was “a complex process”, not one person’s permissions being misused. TRM’s reading of the blockchain evidence is that the attacker gained the ability to make Binance’s hot-wallet signing system sign whatever it wanted, on every chain. On Ethereum it used a feature introduced in 2025 that lets a wallet delegate its behaviour to a smart contract: 50 authorisations were pre-signed so that at least one would be valid, and the wallet was handed to a contract that only the attacker controlled.

The rehearsals the day before, the funding through a mixer and the single burst of execution are the signature of TraderTraitor, the North Korean unit the FBI blamed for Bybit. TRM assesses the attribution “with high confidence”; Binance has not named anyone and has promised a full technical post-mortem.

“Suspended” is a precaution, not a bankruptcy

This is the part that matters most to a user. When an exchange halts withdrawals after a theft, it is doing two things: stopping the attacker from using any remaining access to drain more, and giving itself time to rebuild the signing system before reopening the door. Binance paused withdrawals first. Its 8am notice listed deposits as suspended too, but by midday co-CEO Yi He said deposits “remain unaffected and continue to operate as normal”, so the pause is on money leaving, not money arriving. That is the correct sequence for a security incident. It is not what an insolvent exchange looks like; FTX in 2022 halted withdrawals because the money was not there.

Whether Binance’s money is there is the question the market is asking. The exchange holds roughly US$155 billion of customer assets and says it will cover losses from two sources: its SAFU emergency fund, which it converted into about US$1 billion of bitcoin earlier this year, and its corporate funds. The arithmetic: about US$3 billion of the stolen stablecoins are frozen and should return to Binance over the coming weeks once issuers and courts confirm ownership, which leaves roughly US$3 billion uncovered, of which the attacker still holds US$2.4 billion in bitcoin and ether that no issuer can freeze. SAFU covers a third of that gap. The rest comes from Binance’s balance sheet, which is private. Binance has done this before, covering a 7,000 BTC theft in 2019, and Bybit made its users whole within days in 2025. The test is the next 48 hours: if withdrawals reopen on schedule and stay open, the promise held.

What it did to prices

Bitcoin’s 24-hour range tells the story: a high near US$81,900 before the news, a low near US$76,500 as it spread, and about US$77,500 by Friday evening Malaysian time, down 3% on the day after being down 5%. Binance’s own token, BNB, fell 6% to 9%. The damage was concentrated in leverage: about US$1.54 billion of positions were force-closed, US$1.3 billion of them bets on prices rising, across roughly 239,000 traders. Spot bitcoin ETFs still took in a small net inflow on 29 October, and US$10.8 billion of bitcoin options expire today with US$78,000 the key level.

Sean Foley of Macquarie University put the lasting risk in one sentence: “Any assets held at a centralised exchange are only as safe as the exchange itself.”

What a Malaysian user should do

• Know your legal position. Binance is not licensed or registered with the Securities Commission Malaysia. Its website and app are blocked here, as the Finance Ministry told Parliament in July. Malaysians who use it through other means are outside the SC’s investor protection, and the Securities Industry Dispute Resolution Center cannot help. The SC publishes its list of licensed digital asset exchanges, where accounts come with Malaysian regulatory oversight.
• Do not panic-withdraw into a queue. Withdrawals are paused anyway; deposits are working, but there is no reason to add money to an exchange mid-incident. When withdrawals reopen, expect heavy outflows and slow processing for a day or two. If your plan is to move coins to self-custody, do it calmly once the queue clears; your balance is not going anywhere in the meantime if Binance’s guarantee holds.
• Watch for the scams that follow every hack. Binance warned users to ignore messages, links or “support” offering to help recover or secure funds. Nothing legitimate will ask for your seed phrase or login.
• Decide what belongs on an exchange. Coins you trade belong on an exchange; coins you hold belong in a wallet whose keys you control. Yesterday was the clearest argument for that split since FTX.
• For traders. Hack headlines produce the fastest moves in crypto and the worst fills. The first hour of the news took bitcoin down 5% and liquidated US$1.3 billion of longs. If you were leveraged long without a stop, you were part of that number. Size for the headline you cannot predict.

FAQ

Was Binance hacked?

Yes. On 29 October 2026 (early 30 October in Malaysia) about US$6.3 billion in crypto was taken from Binance hot wallets across ten blockchains. Binance has confirmed a security incident and says it will cover all losses.

Is my money on Binance safe?

Binance says every loss will be covered from its SAFU fund and company funds, and no user balance has been reduced. Withdrawals are paused and expected to resume within 48 hours of the 30 October announcement. The remaining risk is whether that promise holds, which the reopening will show.

Why did Binance suspend deposits and withdrawals?

To stop the attacker using any remaining access and to rebuild its withdrawal signing system before reopening. It is a standard precaution after a theft, not a sign the exchange is insolvent.

Who was behind the Binance hack?

TRM Labs attributes it with high confidence to TraderTraitor, a North Korean state hacking unit linked to the Lazarus Group and blamed for the 2025 Bybit theft. Binance has not confirmed attribution and has promised a post-mortem.

Is Binance legal in Malaysia?

No. Binance is not licensed by the Securities Commission Malaysia, and its website and app are blocked in Malaysia. Malaysians who use it do so without local regulatory protection. The SC lists the exchanges that are licensed.

Summary

Hackers took about US$6.3 billion from Binance’s hot wallets in roughly 20 minutes on 29 October 2026, the largest crypto theft ever and four times the Bybit record. About US$3 billion in stablecoins has been frozen; US$2.4 billion in bitcoin and ether has not. Binance paused withdrawals as a security precaution (deposits were briefly listed as suspended, then confirmed working), pledged to cover every loss from its US$1 billion SAFU fund and its own money, and expects withdrawals to resume within 48 hours. Bitcoin fell 5% at worst and US$1.5 billion of leveraged bets were wiped out. For Malaysians the lesson is twofold: Binance sits outside the Securities Commission’s protection, and coins you are not trading belong in a wallet you control.

Disclaimer

This article is for education only and is not investment advice. It describes a developing incident using figures from Binance, TRM Labs, Chainalysis and news reports as of 5pm Malaysian time on 30 October 2026; amounts, timelines and attribution may be revised. Check Binance’s official channels and the Securities Commission Malaysia’s website before acting.

Related reading

• Cryptocurrency vs SWIFT: why “decentralised” is the whole argument
• Why AI surged and crypto became a payment asset
• Investing vs trading: what’s the difference?
• Complex strategy vs stable mindset: which matters more?