Binance hot-wallet exploit: SAFU coverage and withdrawal pause
On October 29, 2026, around 20:05 UTC, Binance hot wallets were compromised, with a loss of about $6.3 billion in token assets. In Security Incident Update #2 (2026-10-30) (opens in new tab), Binance said it will cover users through the Secure Asset Fund for Users (SAFU) and the corporate treasury. Withdrawals remain paused as of October 31, 2026. Deposits remain operational.
Background
Hot wallets are the exchange's own online wallets used to process withdrawals. Unauthorized withdrawals in this incident went out through those wallets.
SAFU is Binance's Secure Asset Fund for Users, a fund meant to cover user losses. For this incident, Binance named SAFU and the corporate treasury to cover the stolen funds.
What happened
Incident (October 29, 2026)
At 21:15 UTC on October 29, 2026, Binance posted (opens in new tab) that it was aware of reports of a potential security issue, was investigating, and that "User funds are completely safe."
Containment
At 22:33 UTC on October 29, 2026, Binance posted (opens in new tab) that withdrawals were paused for security checks.
Security Incident Update #2 says Binance contained the compromised infrastructure and revoked affected authorizations. Binance worked with law enforcement, blockchain intelligence firms, asset issuers, and industry partners to trace and freeze affected assets. Approximately $3 billion has been frozen on-chain to date.
What Binance says it knows
The Security Incident Update (2026-10-30) (opens in new tab) said the incident may involve the compromised laptop of a DevOps engineer that gave access to a service container used to submit unauthorized withdrawal transactions. A note on that page, dated October 30, 2026, clarifies that deposits remain unaffected.
Yi He and Richard Teng, who signed as co-CEOs of Binance, wrote in Security Incident Update #2 that subsequent investigation uncovered additional points of breach. At this stage there is no evidence that wallet private keys were leaked. Further technical findings were expected within about 48 hours of that October 30 update, once verified and if disclosure would not compromise the investigation. Those findings have not been published. A detailed technical post-mortem is promised and has not been published.
Coverage (October 30, 2026)
Binance, not users, will absorb the financial impact of the stolen funds. More than $6.34 billion in company funds has been set aside, with $5 billion held in the exact impacted token assets, including USDC, USDT, BTC, ETH, and BNB. That $5 billion is about 80% of the about $6.3 billion impacted amount. Binance is buying the remaining 20% of the lost token assets through market trades and private OTC (over-the-counter) purchases.
Withdrawals and Proof of Reserves
Security Incident Update #2 says the tech team targets starting to resume the withdrawal service within approximately 34 hours of that October 30 post, in phases, subject to completion of security checks. No first-party Binance announcement has said withdrawals have resumed.
Binance also plans to run an initial Proof of Reserves snapshot. Proof of Reserves is a public check of the assets Binance holds. It said it plans to have the result ready by Monday, November 2, 2026. That Proof of Reserves result has not been published.
Who it affects
Binance users
Use official Binance channels for status, and do not trust unofficial links, messages, or requests for account information. Ignore messages that hurry you toward a recovery or airdrop link.
ILV holders
On October 30, 2026, Illuvium co-founder Kieran Warwick posted (opens in new tab) that ILV had been stolen from Binance and that none had been sold.
A later Illuvium announcement said about 54,000 ILV was taken and had already been sold in a single swap into the SushiSwap ILV/ETH pool. That announcement says "Illuvium itself was never compromised." The ILV contract, staking, and holder wallets "are all safe." Binance asked projects to pull liquidity, and Illuvium declined. Binance has asked to buy back the ILV it lost, and Illuvium is working with Binance to make that happen. Illuvium said it will keep holders posted once it is done. Illuvium said it "will never DM you first." Binance's support announcements do not mention ILV, Illuvium, or a buyback.
At a glance
| When | What |
|---|---|
| October 29, 2026, 20:05 UTC | Hot wallets compromised, per Binance |
| October 29, 2026 | First public statement; withdrawals paused, per Binance |
| October 30, 2026 | Security Incident Update (2026-10-30); Security Incident Update #2 (2026-10-30), per Binance |
| Monday, November 2, 2026 | Proof of Reserves result planned to be ready, per Binance |
| Item | Detail |
|---|---|
| Loss | About $6.3 billion, per Binance |
| Set aside | More than $6.34 billion in company funds, per Binance |
| Already held | $5 billion of the about $6.3 billion impacted amount (about 80%), per Binance |
| Remaining | 20% of the lost token assets being bought, per Binance |
| Frozen on-chain | About $3 billion, per Binance |
| Withdrawals | Paused, per Binance |
| Deposits | Operational, per Binance |
| ILV | About 54,000 ILV taken and sold; contract, staking, and wallets all safe, per Illuvium |
On Web3Raider
Closest pages:
What to watch next
- Whether Binance posts that withdrawals have started to resume in phases, on Security Incident Update #2 or a newer support announcement.
- Whether Binance publishes the Proof of Reserves result it said would be ready by Monday, November 2, 2026.
- Whether Binance publishes the technical findings or the detailed technical post-mortem it promised.
- Whether Binance confirms the ILV buyback that Illuvium describes.
Bottom line: Watch Binance's official support announcements for withdrawal phases and for the Monday Proof of Reserves result. If you hold ILV, treat Illuvium's line that the contract, staking, and wallets are all safe as the studio's statement, and ignore unofficial DMs.
Official sources
- Security Incident Update #2 (2026-10-30) (opens in new tab)
- Security Incident Update (2026-10-30) (opens in new tab)
- Binance on X, October 29, 2026 (first public statement) (opens in new tab)
- Binance on X, October 29, 2026 (withdrawals paused) (opens in new tab)
- Kieran Warwick on X, October 30, 2026 (opens in new tab)
In this story
Browse hubs
Open related catalog hubs for this story.
