Binance Regular

Documented events with consequences still open. Each entry carries a source and a date.

1. Oct 29, 2026 Hack / funds theft Critical $6B ● open

   Security incident: about $6.3 billion taken from hot wallets, withdrawals reopening in phases

   On the evening of 29 Oct 2026 (from ~20:30 UTC) Binance's operational (hot) wallets on Ethereum, Arbitrum and Avalanche recorded unauthorized outflows to unknown addresses. Binance's initial investigation (X @binance, 30 Oct 02:25 UTC) pointed to a DevOps engineer's compromised laptop, from which the attacker reached a service container and submitted unauthorized withdrawal transactions; at 08:47 UTC on 30 Oct Binance updated this: the investigation uncovered "additional points of breach" and the attack is described as "complex", with facts still being gathered. Binance says it found no evidence of a wallet private key leak and that outflows stopped when withdrawals were paused. Binance estimates the impact at about $6.3 billion, of which about $3 billion has been frozen on-chain with partners (mostly stablecoins blocked by Tether and Circle). At 10:55 UTC on 30 Oct Binance said it has begun restoring affected assets for users and has reserved over $6.34 billion of company funds, $5 billion of it already held in the same tokens that were taken; the rest is being bought on market and OTC channels, which can take longer for low-liquidity tokens. Chainalysis and TRM Labs attribute the attack to the North Korean group TraderTraitor. At 14:33 UTC on 30 Oct co-CEO Richard Teng (X @_RichardTeng) added that the attack "was not carried out by one person", that the attacker used an EIP-7702 delegation to obtain execution approval over a hot wallet without going through normal approval controls, and a self-destruct mechanism that wiped tooling and traces; according to Binance the loss hit its own hot wallets, not customer funds, which are mostly held in cold wallets. Deposits have been operating normally since 04:36 UTC on 30 Oct. On 31 Oct the FBI attributed the attack to North Korea (as reported by CNBC and Decrypt). In official Recovery Update #4 on 1 Nov (X @binance, 04:11 UTC) Binance reopened withdrawals in phases from 06:00 UTC, starting with the most requested networks and tokens (including BTC, ETH, USDT, USDC, BNB, XRP); other networks are being re-enabled as they pass security checks, and some are still in testing. In the same update Binance says it has covered about 95% of the impacted amount with its own funds (up from 90% the day before), that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are 100% backed, and that losses will not be passed on to users; the remaining 5% is less liquid tokens still being bought. In official Recovery Update #5 on 2 Nov (X @binance, 12:49 UTC) Binance completed the zero-knowledge proof (zk-SNARK) of its Proof of Reserves for the 31 Oct 00:00 UTC snapshot: holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can independently verify, with the open-source tool on the PoR site, that their balance is backed at least 1:1. A new snapshot covering more tokens is planned for 4 Nov, with the full proof estimated to take 40-50 hours. Coverage stays at 95%; the next phase reopening withdrawals on more networks and tokens is announced for 3 Nov, as a progressive rollout. On 2 Nov (X @binance, around 08:30 UTC) Binance said fiat withdrawals are available for more than 25 currencies, including EUR and CHF, with USD newly added; at 14:35 UTC the same day it issued an official scam warning tied to the reopening (fake DMs, group chats and small transfers with an attached message promising faster withdrawals, compensation or moving funds into a "vault"). With official Recovery Update #6 on 3 Nov (X @binance, 03:30 UTC) the second phase began at 04:00 UTC, reopening withdrawals for more tokens and networks, again rolled out progressively as each pair passes security checks; Binance reiterates that it will bear the full financial impact of the theft and that losses will not be passed on to users. In the following hours it listed among the first restored assets several stablecoins on the Ethereum network (RLUSD, USD1, TUSD, FDUSD, XUSD); at 07:08 UTC the same day (X @binance) it added 34 tokens on the Ethereum network (including LINK, ONDO, SHIB, ENA, USDE, PENDLE, WBETH and BTC on Ethereum) and 22 tokens on the Solana network (including USD1, FDUSD, JUP, BONK, WIF, PYTH, RENDER). At 14:33 UTC on 3 Nov (X @binance) Binance published its first official incident report. The impact is about $6.34 billion, of which about $2.85 billion has been frozen or intercepted; as of 31 Oct 98% of the affected tokens had been replenished and are verifiable on the Proof of Reserves page, while less liquid tokens are still being bought. Binance acknowledges the incident "should not have happened" and cites the FBI for the attribution to North Korea. According to the report the flaw was not in the wallet keys but in access to an internal transaction-signing service: in June a wallet-team engineer had downloaded a tampered installer for a developer tool; in September a second engineer, approached through a fake job interview, ran an "assignment" on his work computer containing malware that endpoint security did not detect; from 20 Oct the attacker used an internal AI tool to reach two more engineers and a deployment token, and launched the attack on 29 Oct. Between 20:05 and 20:09 UTC five hot wallets sent 233.46 million XRP to the attacker, followed by about 970,500 SOL, 44.2 million OP and 18,270 BTC; the EIP-7702 delegation on an Ethereum hot wallet let the attacker keep moving funds even after withdrawals were paused, and the last unauthorized transfer (2,961.9 ETH) finalised at 23:56 UTC on 29 Oct; the delegation was revoked at 00:10 UTC on 30 Oct. Binance says it has closed the entry points, rebuilt the affected wallet system and internal tool in a new environment, replaced devices and revoked credentials, and engaged independent security firms for a review. In official Recovery Update #7 on 4 Nov (X @binance, 15:26 UTC) Binance says it has replenished about 98% of the impacted amount with its own funds; the remaining 2% is less liquid tokens still being bought on market and OTC channels, which will take longer. It also took a new Proof of Reserves snapshot at 00:00 UTC on 4 Nov covering 44 tokens (up from 10): generating the zero-knowledge proof that will let holders of those tokens independently verify at least 1:1 backing is expected to take about 50-60 hours. Withdrawals keep reopening in phases: not every network is live yet. With official Recovery Update #8 on 5 Nov (X @binance, 04:50 UTC) a new phase began at 04:00 UTC, reopening withdrawals for a further set of tokens and networks, prioritised by user demand over the past week and re-enabled gradually as each token/network pair passes security checks; deposits remain open. Binance has not yet given a date for full reopening. With official update no. 9 on 6/11 (X @binance, 04:10 UTC) a further phase of withdrawal reopening began at 04:00 UTC for more tokens and networks, on the same basis (priority by user demand, gradual reactivation after security checks); deposits remain open and there is still no date for full reopening. At 10:49 UTC on 6 Nov (X @binance) Binance set a target: reopening withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week, and withdrawals for all tokens on networks already restored (including BSC, ETH, MATIC, ARB, POL, OP) by then. It is a stated aim, not a guaranteed date.

   ↗ source
2. Jul 1, 2026 Regulatory action Critical ● open

   Binance suspends EU services after failing to secure a MiCA licence

   From 1 July 2026 new orders, deposits, sign-ups and staking/Earn products are halted for EU residents, Italy included; withdrawals remain open and funds accessible. Binance withdrew its Greek MiCA application on 24 June 2026 and says it will seek authorisation in France.

   ↗ source
3. Nov 21, 2023 Fine Critical $4B ✓ resolved

   Record $4.3 billion settlement with US authorities over AML and sanctions violations

   A $3.4bn FinCEN penalty with a five-year monitorship and a $968,618,825 OFAC settlement for 1,667,153 apparent sanctions violations, plus parallel resolutions with the DOJ and CFTC. Founder Changpeng Zhao pleaded guilty, stepped down as CEO and paid $50m.

   ↗ source
4. Oct 10, 2025 Depeg Severe $283M ✓ resolved

   USDe, BNSOL and wBETH depeg on Binance triggering cascading liquidations

   During the 10 October 2025 crash USDe briefly fell below $0.66 on Binance. The exchange paid $283 million in compensation to futures, margin and loan users holding USDe, BNSOL or wBETH as collateral in the 21:36-22:16 UTC window.

   ↗ source
5. May 7, 2019 Hack / funds theft Severe $41M ✓ resolved

   7,000 BTC stolen from the hot wallet, about $40 million

   Attackers obtained API keys and 2FA codes and withdrew 7,000 BTC in a single transaction, about 2% of BTC holdings. Binance covered the loss in full via the SAFU fund: no user funds were affected.

   ↗ source
6. Mar 27, 2026 Fine Moderate ✓ resolved

   Australia: A$10 million penalty for misclassifying 524 retail clients as wholesale

   The Federal Court penalised Oztures Trading (Binance Australia Derivatives) in an ASIC action: between July 2022 and April 2023 over 85% of Australian clients were classified as wholesale, exposing 524 retail investors to crypto derivatives without the required protections. That group incurred A$8.66m in trading losses and paid A$3.89m in fees; about A$13.1m in compensation had already been paid in 2023.

   ↗ source

verified on Nov 6, 2026

Weighted average across 2 public review platforms (4,485,900 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.