Illustration by NewsPlainly. The phone screen is not Binance's app; Sunday is the restart expected by co-founder Yi He, not a confirmed date.
Why it matters
Indian users who keep coins on Binance cannot withdraw them until the exchange reopens withdrawals, and industry executives told the Indian Express that Binance supplies most of the liquidity in India's crypto market. The theft is far bigger than Binance's emergency fund, so its promise to cover losses rests partly on company funds. Indian exchanges such as CoinDCX have already restricted some trading.
The Binance hack, in which about $6.3 billion in cryptocurrency was taken from the world’s largest crypto exchange late on Thursday, 29 October 2026, is the biggest crypto theft on record, far above the $1.5 billion taken from the exchange Bybit in 2025. Binance has paused withdrawals and says it will cover every loss. On Friday, US President Donald Trump said Washington was looking at whether North Korea was behind it, and a Binance co-founder said withdrawals should restart by Sunday.
For crypto users in India, the main question this weekend is simple: when can they move their money out? Here is what Binance and investigators have said so far, and what is still unknown.
How the Binance hack happened
Most of the money left Binance’s wallets in about 20 minutes, starting late on Thursday, according to the US blockchain analysis firms TRM Labs and Chainalysis, as reported by Reuters and Al Jazeera. “An attacker moved approximately 6.36 billion USD out of Binance wallets on 10 blockchains,” TRM said.
Binance’s own first account, posted on X and reproduced by the Indian Express and the Times of India, said the breach may have begun with a compromised laptop belonging to a DevOps engineer, someone who runs the company’s software systems. That gave the attacker access to a service container, an isolated section of the company’s software, from which unauthorised withdrawals were sent. Co-CEO Richard Teng said it was not a “one-click” action and that the company had found no evidence that any wallet’s private key, the secret code that controls it, had leaked. On Friday, Binance said it had found “additional points of breach”, Al Jazeera reported.
TRM said the attackers were able to order Binance’s wallets to empty into wallets they controlled, the same method used against the exchange Bybit in February 2025.
Who is suspected of the Binance hack, and what Trump said
TRM said it had assessed with “high confidence” that the attack was the work of TraderTraitor, a North Korean hacking unit linked to the Lazarus Group, and Chainalysis reached the same view, Reuters reported. The US Federal Bureau of Investigation (FBI) had blamed the 2025 Bybit theft on the same unit. North Korea routinely denies involvement in hacking, and its missions did not respond to Reuters’ requests for comment.
Neither Binance nor the US government has formally named anyone. “Our investigation has not attributed responsibility to any individual,” Teng said. Asked in the Oval Office on Friday whether North Korea was responsible, Trump said: “We don’t know. We’re looking at that,” Bloomberg reported. He added that Binance had told him the situation was “pretty much under control”.
Binance has its own history with US authorities. Founder Changpeng Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform, and Trump pardoned him in 2025, Al Jazeera reported. Binance also helped develop a stablecoin for a company that Trump and his sons co-founded, Bloomberg noted.
Binance hack in numbers
About half of the stolen money has been frozen. Binance said roughly $3 billion had been frozen on blockchains with the help of partners; more than $2.3 billion of that was frozen by Tether and Circle, the companies that issue the dollar-linked stablecoins USDT and USDC, Reuters reported. Binance has not said what happened to the rest.
| Item | Amount | Source |
|---|---|---|
| Estimated total taken | About $6.3 billion | Binance |
| Frozen so far | About $3 billion | Binance |
| Not yet frozen | About $3.3 billion | Reuters |
| Binance’s emergency fund (SAFU) | About $1 billion, held in bitcoin | Binance website, via Reuters |
| Previous record theft (Bybit, Feb 2025) | $1.5 billion | Al Jazeera |
| All crypto hacks in 2025 | $2.87 billion in nearly 150 attacks | TRM Labs |
SAFU, the Secure Asset Fund for Users, is the reserve Binance set up in July 2018 for events like this. Because the theft is far bigger than the fund, Teng said company funds would also be used to cover losses. Binance has been hacked before: about 7,000 bitcoins, worth around $40 million at the time, were stolen in 2019, and the exchange covered that from SAFU, the Indian Express noted.
Binance also warned on X that the $6.3 billion estimate “may continue to increase” as it traces the funds, Al Jazeera reported. Investigators are racing the clock: Chainalysis told CNBC it had seen “laundering patterns we have not seen before”, with funds sent back and forth between addresses to blur the trail.
When Binance withdrawals may resume
Deposits are working, Binance says. Withdrawals are the problem. The timing has shifted slightly with each update:
- Thursday night: Binance suspended deposits and withdrawals while it ran security checks.
- Next update: deposits were not affected, and withdrawals could resume within 48 hours once the withdrawal service was rebuilt, the company said in a post quoted by the Indian Express.
- Friday: Binance said it was still on track to resume withdrawals within 45 hours, Reuters reported.
- Separately: co-founder Yi He said in a post that withdrawals were expected to resume by Sunday, 1 November, according to Bloomberg.
Binance has also asked users to rely only on its official channels for updates, in the same post quoted by the Indian Express. It has promised a detailed technical post-mortem and an updated Proof of Reserves, a public check that it holds enough assets to cover customer balances, once the investigation and repairs are complete.
What it means for crypto users in India
The fallout reached Indian platforms within a day. CoinDCX restricted new futures positions on Friday, 30 October, after the incident, the Indian Express reported. Futures are contracts on a coin’s future price. The same industry executives told the paper that Binance provides the vast majority of the liquidity, the ready buyers and sellers, in the Indian crypto market.
How much Indian crypto money depends on Binance is hard to pin down. An industry executive who spoke to the Indian Express without being named said India has around 100 million crypto users and that 80% to 90% of them have direct or indirect exposure to Binance. NewsPlainly could not check those figures against official data.
Prices fell too. Bitcoin hit a six-week low of $76,368 and ether a two-month low of $2,178 before markets steadied, Reuters reported, and Binance’s own token, BNB, was down 5% over 24 hours. For Indian users with coins on Binance, the company’s position is that “user funds are safe” and every loss will be covered. Until withdrawals reopen, though, those funds cannot be moved off the exchange.
Frequently asked questions
How much was stolen in the Binance hack?
Binance estimates about $6.3 billion. TRM Labs put it at about $6.36 billion moved out across 10 blockchains. Around $3 billion has been frozen.
When will Binance withdrawals resume?
On Friday Binance said it was on track to resume them within 45 hours, and co-founder Yi He said they were expected by Sunday, 1 November 2026. Deposits are working.
Is my money on Binance safe?
Binance says user funds are safe and it will cover all losses from its SAFU fund and company funds. Withdrawals are paused until it reopens the service.
Did North Korea hack Binance?
TRM Labs and Chainalysis say with high confidence that North Korea's TraderTraitor unit did it. Binance has not attributed the attack, and Trump said the US is looking at it.