Binance says user funds are safe, so why can’t you withdraw?

Binance paused withdrawals because a hack drained its hot wallets, and it must stop money going out until it trusts its systems again. Your balance is still on Binance’s books. You just cannot move it off the exchange for now.

A Binance balance is a number on Binance’s internal ledger. Trades between users only change those numbers. A withdrawal is when Binance sends real coins to an outside address. A withdrawal pause closes the exit from the exchange ledger. It does not mean the balances on that ledger are gone.

Binance has promised to cover all losses from its SAFU fund and company money. Full repayment is a promise from Binance, and the net loss and the split between SAFU and company money are not public yet.

If your own account is locked for some other reason, see our guide to frozen withdrawals and locked accounts.

What happened in the Binance hack?

Late on October 29, 2026 (UTC), attackers drained Binance hot wallets on several blockchains. Binance paused withdrawals and estimated the total impact at about $6.3 billion. It said about $3 billion had been frozen on-chain and promised to cover all losses.

Binance’s initial investigation points to a DevOps engineer’s laptop that may have been compromised. If so, the attacker used it to reach a service container and submit withdrawals nobody had approved. Binance said it found “no evidence of any wallet private key leak.” It promised a post-mortem, a full incident report, with no date yet.

The dollar figures going around measure different things. Binance’s estimate is the total impact before any freezes. The frozen figure is the part that cannot move. Nobody has published the net loss.

Tokens that are frozen are locked in place at the attacker’s address by the stablecoin issuer or the network. A freeze stops the funds from moving. It does not bring them back.

TRM Labs and Chainalysis both attribute the attack to North Korean hackers, with high confidence. The North Korea link is a judgment by analytics firms. Neither Binance nor any government has officially named the attacker.

At 04:17 UTC on October 30, Binance co-founder and co-CEO He Yi said deposits were working normally. She said Binance expects to begin resuming withdrawals “in the next 48 hours.” The 48 hours is an expected start to reopening, not a deadline for every withdrawal.

As of October 30, 2026, Binance’s notices do not mention spot or futures trading, internal transfers, P2P, Binance Pay or the Web3 Wallet. Check those in your own app.

Why do exchanges pause withdrawals after a hack?

An exchange pauses withdrawals after a hack because it cannot yet tell which systems the attacker can still reach. A sent withdrawal cannot be pulled back. Stopping them all is the only sure way to keep more coins from leaving.

Exchanges keep most coins in a cold wallet, a wallet whose keys stay offline. A smaller amount sits in a hot wallet, an online wallet that signs withdrawals automatically. Exchange hacks usually hit hot wallets, because they sign on request.

During the pause the team cuts the attacker’s access and counts what left. Then it moves coins out of cold storage to refill the emptied hot wallets. Deposits and trading can keep running, because neither needs a signature from the exchange. Bitget kept both open after its 2026 hack.

Withdrawals usually come back one coin and one network at a time. A network is the blockchain a coin travels on. USDT can move on Ethereum or Tron, and each chain has its own hot wallet to check.

What is the Binance SAFU fund, and how much is in it?

SAFU (Secure Asset Fund for Users) is an emergency fund Binance built from a share of its trading fees. We looked up the address that trackers label as SAFU on October 30, 2026, 07:30 UTC and found 15,000 BTC, about $1.2 billion. That is roughly 19% of Binance’s estimated impact from this hack.

Binance started SAFU in 2018 with 10% of trading fees. In May 2019 a hack took 7,000 BTC and SAFU covered all of it. In early 2026 Binance converted the whole fund into bitcoin.

Binance does not publish a SAFU address. Trackers label 1BAuq7Vho2CEkVkUxbfU26LhwQjbCmWQkD as SAFU. We checked its history, and every large inflow and outflow lines up with a public SAFU announcement.

SAFU is not insurance. It is company money that Binance set aside. Binance has not published any legal obligation to pay out of it. Its open letter does set a refill rule. If the fund falls below $800 million, Binance tops it back up to $1 billion.

Binance estimates the total impact at about $6.3 billion, and about $3 billion of that is frozen. Even if every frozen dollar came back, SAFU alone could not cover the rest. The remainder has to come from company funds, the other source Binance named.

Because SAFU is now all bitcoin, its dollar value rises and falls with the bitcoin price.

How long did withdrawals stay paused after past exchange hacks?

In ten past hacks where the exchange or its fund covered the loss, the first withdrawals came back after a median of 6 days. In 9 of 10 cases something reopened within 11 days. Getting every coin back took a median of 8 days.

View full size ↗

The stolen coin tends to come back last. Upbit reopened bitcoin a week after its 2019 hack, while the stolen ETH took 47 days. Past pause lengths are not a forecast for this incident. We counted the days ourselves from exchange notices and press reports.

The lower rows went differently. WazirX lost close to half of its reserves and reopened only after a court-approved restructuring. Celsius, Voyager and FTX were not hacks. They ran out of money and filed for bankruptcy within weeks. FTX later paid over 100% of claims in November 2022 dollars, far below what the coins became worth.

Our list of past crypto exchange hacks covers more cases.

Hacked or out of money: how do you tell the two pauses apart?

A pause after a hack and a pause because the money is gone looked different in past cases. Hack pauses came with numbers, a named funding source and a coin-by-coin plan. Pauses from missing money came with vague wording and ended in bankruptcy.

View full size ↗

Mt.Gox called its trouble a “technical issue” in 2014 while coins had been leaking for years. So an exchange saying “hack” is not proof of safety either.

What separated the outcomes was size. Binance’s 2019 loss was about 2% of its bitcoin. WazirX lost close to half of its reserves. The question is whether company money and the fund can absorb the hole.

If an exchange does fail, see what happens when a crypto exchange goes bankrupt.

What did Binance’s own status data show during the pause?

At October 30, 2026, 07:30 UTC, Binance’s public status data showed withdrawals open for 0 of 990 coins. Deposits were open for 706 coins. No label on any blocked network used the word “hack”.

We read that data every ten minutes with a script. It has a deposit switch and a withdrawal switch for every coin and network. Binance documents the fields in its API docs, so anyone can check our count.

View full size ↗

The labels are standard templates. Wallet maintenance covered 476 networks. Its text reads “The wallet is currently undergoing maintenance. Withdrawals for this asset will be resumed shortly.” A low hot wallet balance covered 444. A network issue was cited on 31 and a security label on only 7.

Binance uses these labels for any pause. A label alone says nothing about whether customer balances are covered.

The deposit picture fits Binance’s later statement. At 00:13 UTC it said deposits were suspended too. At 04:17 UTC He Yi said they were working normally, without explaining the change. Our snapshot, three hours later, matched the second statement for most coins.

Prices did not drift. In the same minute, Binance’s mid price for five large coins sat within 0.09% of Bybit and OKX.

A paused exchange can trade at its own price. Mt.Gox bitcoin traded about 84% below other exchanges in 2014. In Upbit’s 2025 pause some altcoins ran more than 35% above global prices. Nothing of that kind showed up here. Our guide on price differences between exchanges explains why gaps open.

Held against the signals table, Binance’s first day sits mostly on the hack side.

This is one moment in a running measurement. When withdrawals reopen, this section will show which coins came back first.

Is Binance safe? How to check your balance in Proof of Reserves

Nobody outside Binance can answer “is Binance safe” with certainty today. What you can check is whether your balance is counted in Binance’s Proof of Reserves, a regular report that matches user balances against the coins Binance holds.

Binance puts every user balance into a Merkle tree, a structure of hashes where changing one balance changes the final fingerprint. A zk-SNARK, a kind of zero-knowledge proof, then shows that no account was left out or negative.

Your own record takes a few taps to find. Menu names can differ by app version.

1. Log in and open Wallet.
2. Open Verification, called Proof of Reserves in some versions.
3. Pick a snapshot date.
4. Find your Record ID and Merkle Leaf and check the balance listed.

Proof of Reserves is not an audit, and it only matches user balances at one moment. It does not show company debts outside user balances.

Snapshots taken before October 29, 2026 do not reflect this hack. Binance said it will publish an updated one after recovery. The verification tool is open source on Binance’s GitHub.

What should you do, and not do, while Binance withdrawals are paused?

While Binance withdrawals are paused, the useful steps are small. Read only official channels, record your balances and hold off on new deposits. The harmful ones are compensation links, paid “unblocking” offers and selling in a panic inside the paused exchange.

Binance’s own advice was not to trust “unofficial links, messages, or requests for account information.”

View full size ↗

What not to do

Binance has not announced any claim process. A message asking you to “claim compensation” is a warning sign by itself.

Do not pay anyone to release a withdrawal. Real exchanges take their fee on the withdrawal screen. Do not connect a wallet or sign anything to “verify” your balance. A signature on a fake site can empty your other wallets.

Ignore support accounts that write to you first on Telegram, X or WhatsApp. Start any support chat inside the Binance app. And do not sell in a panic at a price that only exists inside a paused exchange.

After FTX and WazirX, fake refund and claim emails followed. The FBI has warned about fake law firms that charge to recover crypto. See our guides on common crypto scams and whether scammed crypto can be recovered.

What to do

Follow Binance’s announcements page, its verified X accounts and the in-app notices. Screenshot your balances and withdrawal history with the date visible. Check your record in Proof of Reserves.

Read the latest notice before sending new coins to Binance. After past hacks, Upbit and Phemex replaced deposit addresses. Coins sent to the old ones were handled by hand, and late.

When will Binance withdrawals resume, and how do you check?

Binance has not given a date for every coin. Its co-CEO said on October 30 that Binance expects to begin resuming withdrawals within 48 hours. The reliable check is the withdrawal screen for your exact coin and network, plus Binance’s announcements page.

On the withdrawal screen, pick the coin and then the network. A paused network shows a status label, the same kind we counted above.

Past reopenings followed a pattern. Bitcoin often came back first, then ether and stablecoins. The attacked chain tended to come back last.

Expect a rush. Bybit handled about 350,000 withdrawal requests in roughly 12 hours after its 2025 hack. A withdrawal queue means your request waits its turn, so a few hours of pending is normal. See why a withdrawal stays pending.

Before you send, check the network, fee and minimum amount, and re-check the receiving address. A deposit address is the address an exchange gives you to receive a coin. If Binance replaces its deposit addresses, delete the old ones from your saved address books.

If you want a Binance account once things settle, this is its official sign-up page with our referral code.

Affiliate disclosure: some links are partner links. We may earn a commission at no extra cost to you. This is not investment advice.

Why open a second exchange account before you need one?

A second exchange account matters because when one exchange pauses withdrawals, everything you keep there waits with it. Opening and verifying an account takes hours or days. So the time to do it is before a pause.

A second exchange carries the same kind of risk. Bybit lost about $1.4 billion in a 2025 hack. It kept withdrawals open, borrowed ETH from partners and closed the gap within days. No exchange is risk-free, so the point is to spread what you hold.

Sign-up is similar everywhere. You register, verify your identity, turn on app-based 2FA and enter a referral code. Our Bybit sign-up guide and OKX sign-up guide walk through each screen. Our Bybit code is below.

5ZGKX#0Copy Type it in full, including the #0 at the end.

Affiliate disclosure: some links are partner links. We may earn a commission at no extra cost to you. This is not investment advice.

Test the route once with a small amount, so you know which network works and how long it takes.

What should stay on an exchange, and what in your own wallet?

Coins you trade often can sit on an exchange. Coins you hold for months can go in a self-custody wallet, a wallet where you hold the keys yourself. No exchange pause can touch them there.

An exchange balance is a claim on the exchange. A self-custody balance is coins on the chain that only your keys can move.

Self-custody moves the risk to you. Lose the recovery phrase and nobody can restore it. Our guides on how crypto wallets work and what a hardware wallet protects cover the setup.

Affiliate disclosure: some links are partner links. We may earn a commission at no extra cost to you. This is not investment advice.

My take on the Binance hack

On most signals, Binance’s response so far looks like past hacks where the exchange covered the loss. The open questions are the net loss and whether company money covers the rest as promised.

I would watch the post-mortem, the updated Proof of Reserves and the reopening plan. I would not sell at a price that only exists inside Binance, or answer any message about compensation.

What I would do is make sure one exchange never holds everything I own. That holds for Binance, and it holds for the exchanges I link to here.

This site uses affiliate (referral) links. If you sign up through one, we earn a commission at no extra cost to you.

Binance hack questions people ask

Read next: how to sign up for Bybit with our referral code