Binance hack: what happened and how crypto exchanges hold assets

According to Binance, crypto-assets worth around USD 6.3 billion were withdrawn in the Binance hack of 29 October 2026. They were held in hot wallets, the exchange's digital wallets that are connected to the internet. Withdrawals were then suspended until 1 November and reopened in stages. The case raises the question of what a balance on a crypto exchange typically means: usually a claim against the exchange. According to esisuisse, Swiss banks' deposit insurance does not cover cryptocurrency units held in bank accounts. Data as of 8 November 2026. The situation is ongoing, and the figures may change.

Binance hack: from the outflow to the reopening

• 29 October: According to the analytics firm TRM Labs, crypto-assets were withdrawn across ten blockchains (digital registers), with most of the outflow occurring within around 20 minutes from 20:05 UTC (Coordinated Universal Time).
• 30 October: Binance names the hacked laptop of an engineer as the preliminary cause. Unauthorised withdrawals were submitted through it, according to the company. Binance found no indication that a private key (secret key) had been leaked. On the same day, TRM Labs and the analytics firm Chainalysis attributed the attack to North Korea.
• 31 October: According to Reuters and RTÉ, the FBI (the US federal police) held North Korea responsible for the theft. This is a statement by the FBI, and investigations are ongoing.
• 1 November: Binance reopened withdrawals in phases, starting with bitcoin from 06:00 UTC. According to CoinDesk, further phases are to follow only after security and stability checks for each blockchain; no date has been given.
• 2 November: According to Decrypt, withdrawals in official currencies were due to start on 2 November. On the same day, Binance published a proof of reserves for ten crypto-assets, including bitcoin, ether and the stablecoins USDT and USDC. According to crypto.news, the reference date was 31 October, 00:00 UTC. According to Binance, client balances in these assets are covered at least 100% (crypto.news). The proof only applies to these ten assets.
• 5 November: According to a report by 24/7 Wall St., Binance said that around 98% of the affected assets had been replaced and announced a proof of reserves for 44 crypto-assets. The company said it would be verifiable in around 50 to 60 hours. Both statements come from the company.

Damage and coverage according to Binance

According to Binance, crypto-assets worth around USD 6.3 billion were withdrawn from hot wallets (statement of 1 November).

Some of the stolen assets were frozen, that is, blocked. Binance gives a figure of around USD 3 billion (as of 1 November), mainly stablecoins (crypto-assets pegged to a currency such as the US dollar). Frozen does not mean that money flows back. What stands behind the value of stablecoins is explained in the article on stablecoins: types, backing and risks.

On coverage, Binance reported (as of 1 November 2026) that around 95% of the assets had been replaced, up from 90% previously. On 2 November, Binance confirmed the 95%, according to The Block. According to CNBC, the remaining 5% consisted of less liquid crypto units (tokens), which are harder to buy and sell. According to a report of 5 November, Binance gave a figure of around 98%. Binance intends to cover the losses from the SAFU fund, an emergency fund, and from company funds. This is a promise by the company, not an independent guarantee.

Hot wallet and cold wallet: how exchanges hold assets

When a balance is held on an exchange, the exchange usually holds the keys, and clients have a claim against it. A hot wallet allows fast access and is connected to the internet. In the case of Binance, the amount withdrawn came from hot wallets, according to the company. Binance names a hacked laptop as the preliminary cause (see timeline). A cold wallet is often a device without an internet connection.

What does a proof of reserves show and what does it not show?

A proof of reserves is a snapshot. It shows holdings on a reference date.

On 2 November, Binance published such a proof for ten crypto-assets with 31 October as the reference date. According to crypto.news, it uses a zero-knowledge method. Clients can use an open-source verification tool on the Binance website to check whether their own balance is included in the reported holdings, without other people's data becoming visible. The proof shows the position on the reference date. It does not show how holdings develop afterwards, and it is no substitute for deposit insurance. The statement that the balances are covered comes from Binance itself. According to a report of 5 November, Binance said an announced proof covering 44 assets would be verifiable in around 50 to 60 hours.

Balances with an exchange and with a bank

Swiss banks' deposit insurance (organisation: esisuisse) covers client balances in bank accounts up to CHF 100,000 per client and bank. For crypto-assets, esisuisse distinguishes the following cases (as of 2 November 2026):

This applies to banks and, by analogy, to securities firms. On 12 January 2026, the Swiss Financial Market Supervisory Authority FINMA wrote that client assets in crypto-based assets should not form part of the custodian's bankruptcy estate (the assets distributed in the event of insolvency). This concerns licensed financial institutions. How deposit insurance works is explained in the article on deposit insurance in Switzerland. Individual circumstances may differ.

Risks and limitations

• No deposit insurance: According to esisuisse, cryptocurrency units held in accounts are not protected by deposit insurance.
• Counterparty risk: Anyone whose counterparty is the exchange bears its default and withdrawal risk. At Binance, withdrawals were suspended after the hack until 1 November.
• Company statements: The extent of the damage, the cause, the coverage and the liability are described by Binance itself. This also applies to the replacement rates of around 95% and 98% and to the coverage of at least 100% in the proof of reserves for ten assets.
• Open questions: A final report on the cause, further withdrawal phases and compensation are still outstanding.
• Market risk: Crypto-asset prices fluctuate strongly, and losses up to a total loss are possible. This article is general in nature and does not constitute investment advice.

Conclusion

According to Binance, around USD 6.3 billion was withdrawn from hot wallets in the Binance hack on 29 October 2026. A balance on an exchange is usually a claim against the exchange, and according to esisuisse, cryptocurrency units held in accounts are not protected by deposit insurance. A proof of reserves shows holdings on a reference date and does not protect any balance. The amount of the damage, the commitments and the coverage figures come from the company itself.