Binance account hacked? Here’s what to do
Move fast and in the right order: reclaim the account through Binance’s official flow, kick the attacker out of every session, then close the door they came through — usually a password that leaked in a breach and was reused.
Binance was hacked on 29 October 2026. Your balance was not the target, but the scams are coming
On 29 October 2026 attackers drained Binance’s own hot wallets of about $6.3 billion, the largest crypto theft on record, and Binance paused withdrawals that evening. The exchange says customer balances were not touched and that it is covering the loss itself. Withdrawals reopened in phases from 1 November, starting with Bitcoin. What reaches ordinary users now is the follow-up: emails, texts and DMs about a “Binance refund”, “compensation” or an urgent account “verification”. Binance does not send refunds for this incident, because your balance was never reduced. Ignore every link and check your account by opening the app yourself.
Binance’s announcement on the incident
Binance’s statements of 29–31 October 2026 as reported by TechCrunch (29 October), WinBuzzer (30 October) and CNBC (31 October–1 November 2026).
If your Binance account was hacked: start recovery at the official page (www.binance.com/en/support/faq/115003800652), change the password to a unique one, sign out all other sessions, and re-check the recovery email and phone on the account. Then find out how the attacker got in — check whether your password appears in known breach data — and turn on two-factor authentication so it can’t happen again.
Recover your Binance account, step by step
These steps follow Binance’s official process — expect it to take disabling the account takes a minute; reopening it through support usually takes from a few hours to a few days. Official links only: account recovery.
Open the Binance app or type binance.com yourself. Check your balances, your recent withdrawals and the list of logged-in devices. If everything matches what you did, your account was not affected by the hack.
If you see logins, withdrawals or API keys you did not create, disable the account straight away from Security settings (the official “disable account” option). It blocks trading and withdrawals until support reopens it.
Contact support through live chat in the app or on binance.com, say the account was compromised, and give the times and transaction IDs you saw. Do not use phone numbers or “support” accounts found through search results or social media.
Once you are back in: change the password, reset 2FA to an authenticator app or passkey you control, delete unknown API keys and devices, turn on the withdrawal address whitelist, and set an anti-phishing code.
If crypto was stolen, write down the transaction hashes and destination addresses, report the theft at ic3.gov and reportfraud.ftc.gov, and ignore anyone who offers to “recover” stolen crypto for a fee. That offer is a second scam.
What trips people up with Binance
- After a headline hack, the phishing wave is the real risk for account holders. Binance itself told users not to trust unofficial links, messages or requests for account information. A message about your “refund”, “claim” or “frozen balance” is the scam, even when it quotes the right amount of crypto you hold.
- Set an anti-phishing code in Security settings if you have not. Binance then prints that phrase in its genuine emails and some texts, so an email about the hack that lacks your code did not come from Binance, however official it looks.
- Binance support works through live chat inside the app or on binance.com, not through phone numbers found in search results. Anyone who calls about the hack, or a “Binance agent” who messages you first on Telegram, X or WhatsApp, is impersonating the exchange.
- Binance and Binance.US are separate companies with separate accounts and separate support. The October 2026 theft was at Binance.com. If your account is on Binance.US, its own recovery steps apply and a message mixing the two brands is a red flag.
Was Binance hacked? What happened in October 2026
Yes. On the evening of 29 October 2026 (UTC) funds started flowing out of Binance’s hot wallets, the online wallets the exchange uses to pay out withdrawals. Binance halted withdrawals across networks about two hours later. Binance put the loss at about $6.3 billion; TRM Labs traced roughly $6.36 billion across ten blockchains, and Chainalysis estimated about $6.4 billion. That is several times larger than the $1.5 billion Bybit theft of 2025.
Binance first pointed to a compromised laptop belonging to a DevOps engineer as a possible entry point, then co-CEO Richard Teng said the attack was more complex than one person’s access. Stablecoin issuers moved fast: Tether froze more than $1.5 billion in USDT and Circle about $823 million in USDC, and by 30 October Binance counted about $3 billion frozen in total. On 31 October the FBI said North Korea was responsible; press reports name the TraderTraitor group.
Binance says the stolen money was its own, not customers’, and that it is absorbing the loss with its SAFU emergency fund, part of its futures insurance fund and company treasury. By 31 October it said about 90% of the stolen assets were backed again, with the major coins fully covered. Withdrawals reopened in phases from 1 November, starting with Bitcoin, then Ethereum and BNB Chain, with delays as customers moved billions out. Binance has promised a detailed incident report once its investigation ends.
Still logged in? Lock the account down now
If you can still get in, you're racing the attacker. In this order: change the password to a long, unique one; sign out all other sessions/devices (the setting exists in Binance's security settings); confirm the recovery email and phone number are yours (attackers quietly add their own so they can "recover" the account later); remove unfamiliar linked apps or API access; and turn on two-factor authentication. Only then deal with anything the attacker posted, sent or bought.
Got a "new login" alert from Binance?
Treat it as real but verify it the safe way: never tap the link in the message itself (fake login alerts are a top phishing template for Binance). Open the app or type the address yourself, check the active-sessions list in security settings, and if you see a device or location you don't recognize, sign it out and change your password immediately. If the alert was genuine, that password is burned — assume it's circulating and change it everywhere else you reused it.
Locked out of Binance — email or phone was changed
This is the worst-case scenario and the most common complaint: the attacker changed the account email, phone number or password so the normal reset flow emails them, not you. Do NOT keep triggering password resets — they go to the hacker. Go straight to Binance's dedicated recovery flow (link above), which is built for exactly this case: it verifies you by your original signup details, previous passwords, linked devices or a government ID / selfie check, bypassing the stolen email. Watch for the security notice Binance sent to your OLD email when the address was changed — it usually contains a "revert this change" link that works for a limited time and is the fastest way back in.
The attacker spent, moved or stole money
Report the unauthorized transactions to Binance through the official flow the moment you're back in (or even before — fraud reports don't require account access). U.S. consumer protections for electronic transfers generally limit your liability the faster you report, so speed matters more than completeness. Also call the bank or card issuer behind the funding source — they can dispute, reverse or block further charges — and file at reportfraud.ftc.gov so the pattern is on record.
Why this happened — and how to make sure it can’t again
About a third of account takeovers are credential stuffing: a password you used on Binance (or the email behind it) leaked in some other company’s breach, and attackers replayed it here automatically. The FBI’s IC3 logged over 5,100 account-takeover complaints with $262M in losses in 2025 alone (IC3). Even when Binance itself was never breached, your reused password from another site opens it.
So after recovery, check what’s already out there: our free scanner shows which known breaches and dark-web dumps include your email — and whether passwords were exposed with it.
Check my exposure — free →After you recover: three doors to close
- Unique password + 2FA. A password manager plus app-based two-factor stops both stuffing and phishing replays.
- Reset everywhere you reused that password — email first (it’s the master key), then bank, then the rest.
- Shrink your public footprint. Attackers research targets on data-broker sites (your address, phone, relatives — enough to social-engineer support lines). Our free opt-out guide covers 190 of them, step by step.
Hacked Binance account, answered
How did my Binance account get hacked?
The most common cause isn't a hack of Binance itself — it's credential stuffing: a password you used on Binance leaked from some other site's breach, and attackers tried it here automatically. Roughly a third of account takeovers happen this way, with phishing (fake Binance login pages and alerts) close behind. That's why the first fix is a unique password, not just a new one.
Can I get my Binance account back?
Usually yes. Use the official recovery flow (https://www.binance.com/en/support/faq/115003800652) — it can verify you even when the attacker changed the email and password. Expect it to take disabling the account takes a minute; reopening it through support usually takes from a few hours to a few days; respond quickly to follow-ups so the case stays open.
Should I just make a new Binance account instead?
Not until you've tried recovery. The old account keeps your history and contacts — and while the attacker controls it, it will be used to scam people who trust you. Recover it, or at minimum report it as compromised so Binance can lock it, before you start over.
Will I get money back that was stolen through my Binance account?
Often, if you move fast. Report the unauthorized activity to Binance and to the bank or card behind it — U.S. protections for unauthorized electronic transfers generally limit your losses the sooner you report. Peer-to-peer payments you were tricked into sending yourself are much harder to recover than transactions the attacker made — another reason to report the takeover itself, with evidence.
Is my money safe on Binance after the hack?
According to Binance, customer balances were not reduced: the hot wallets that were drained held the exchange’s own funds, and Binance says it is covering the loss itself. Withdrawals have been reopening network by network since 1 November 2026. Whether to keep funds on any exchange is your call; the only part you control directly is your own account security.
Can I withdraw from Binance now?
Withdrawals resumed in phases from 1 November 2026, beginning with Bitcoin and followed by Ethereum, BNB Chain and stablecoins on several networks. Some networks reopened later and processing was slower than usual because of heavy traffic. The current list is in the app and in Binance’s announcements, not in a message someone sent you.
I got an email about a Binance refund or compensation. Is it real?
No. Binance says users did not lose money in the October 2026 hack, so there is nothing to refund. Messages offering a refund, a claim, or a “verification” to unlock your balance are phishing. Check whether your anti-phishing code appears in the email, do not click anything, and report it to Binance through live chat.
Who hacked Binance?
On 31 October 2026 the FBI said North Korea was behind the theft, and press reports name the TraderTraitor group, which is also blamed for the 2025 Bybit theft. Blockchain analytics firms TRM Labs and Chainalysis reached the same conclusion independently. Binance has not published its full incident report yet.
How do I stop my Binance account being hacked again?
Three things close most of the doors: a unique password (a manager makes this painless), app-based two-factor authentication, and shrinking your exposed footprint — checking your email against known breach databases and removing your personal data from data-broker sites that attackers use to research targets.