Explainer

The Binance Hack, Explained for Miners

What is confirmed, what is still rumor, what a hot wallet is, and what any of it means for the coins your graphics cards earn.

Published 30 October 2026. Written from sources read the same morning (US Eastern); the numbers below were still moving hour by hour and will be updated as Binance publishes its findings.

Short versionOn Thursday 29 October, an attacker emptied Binance's internet-connected "hot" wallets on ten blockchains in about 20 minutes. Binance puts the damage at roughly $6.3 billion, the largest crypto theft on record. Binance says user balances are safe and it will cover the loss, and it has paused deposits and withdrawals. Your mining rig is not involved. Your payouts might be, if they land on a Binance deposit address.

What is confirmed

Everything in this section comes from Binance's own statements or from the blockchain-analysis firms tracing the funds, with the source numbered in brackets and listed at the end.

WhenThursday 29 October 2026, starting at 20:05 UTC (4:05 pm US Eastern). XRP wallets went first, then Solana and Optimism, then at 20:20 a Bitcoin hot wallet (18,270 BTC) and Tron, and at about 20:23 the main Ethereum hot wallet, including 1.6 billion USDT. Most of the money moved in about 20 minutes; smaller sweeps continued into the night. [5]
How muchBinance's own estimate is "around $6.3B". TRM Labs counts about $6.36 billion at the prices of the moment across ten blockchains, with data to 00:30 UTC on 30 October. The previous record was the Bybit theft of February 2025, about $1.5 billion, so this is roughly four times larger. [2] [5]
What was frozenStablecoin issuers can freeze their own tokens, and did: Tether more than $1.56 billion, Circle more than $800 million, plus smaller freezes by Ripple, World Liberty Financial and the Arbitrum Security Council, about $2.7 billion in total. Binance's "verified frozen" figure was $2.54 billion late Thursday and about $3 billion by Friday morning. [1] [2] [4] [5]
What cannot be frozenNative coins have no issuer. TRM Labs says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that nobody can recall. [5]
Binance's responseDeposits and withdrawals suspended; "user funds are safe"; co-CEO Richard Teng said all losses will be covered from the SAFU insurance fund and company money. Binance said it has revoked the affected authorizations and will publish a technical post-mortem and an updated proof of reserves. [2] [4]
Binance's first explanationThe initial investigation points to a compromised laptop of a DevOps engineer, which gave the attacker access to a service container from which the withdrawals were submitted. Binance says it found "no evidence of any wallet private key leak", that it "was not a single 'one-click' action", and that it has "uncovered additional points of breach". [4]
WhoTRM Labs attributes the attack with "high confidence" to TraderTraitor, the North Korean unit the FBI blamed for Bybit. Chainalysis concurs. Binance itself has not named anyone. [4] [5]
MarketsBitcoin fell from about $80,300 to a low near $78,800 within the hour and traded below $76,500 overnight; Ether, Solana and XRP fell more, and BNB about 6 %. Roughly $628 million of leveraged positions were force-closed in an hour, almost all of them bets on prices going up. [6] [7]

What is rumor, estimate or not yet known

The exact totalFigures on Thursday night ran from "at least $2 billion" to $5.7 billion before Binance settled on about $6.3 billion. Chainalysis's early tally was about $5.9 billion. Binance says the number can still change as assets are recovered or frozen. [1] [2] [8]
The root causeThe "DevOps laptop" account is Binance's initial finding, not a final report. On Ethereum, researchers saw the attacker use a 2025 feature called EIP-7702 to pre-authorise 50 transactions and take over the wallet's balance in one move. Whether that was the way in, or only the way out, is not established. Binance has promised the post-mortem. [4] [5]
When withdrawals reopenA live ticker quoted "within 48 hours". Binance has not given a time. [2]
Whether SAFU is big enoughBinance says the fund and company money cover the loss. No audited figure for the fund's current size has been published. [4] [5]
Links to other incidentsPolymarket and Bitget had security incidents in the same 24 hours, and one researcher sees the Binance and Bitget funds mixed at a shared address. Binance has said nothing about a connection. [1] [5]

Hot wallet, cold wallet: the plain-English version

An exchange keeps most customer coins in cold wallets: the keys that can move the money sit on machines that never touch the internet, like cash in a bank vault. Moving coins out of them is slow and deliberate, which is the point.

To pay the thousands of withdrawals customers ask for every hour, the exchange also keeps a float in hot wallets: wallets whose signing systems are online and automated, like the cash in the registers. They hold a small share of the total, but at Binance's size a small share is billions of dollars.

Thursday's theft hit the hot side. The attacker did not break Bitcoin or Ethereum, and so far there is no sign the cold storage was touched; Binance's BNB holdings were not moved at all. [8] What the attacker got, by Binance's initial account, was a way to make the hot-wallet signing system approve withdrawals it should have refused. That is why a stolen laptop can matter more than a stolen key.

Why a GPU miner should care

Mining does not touch an exchange until you decide it should. Your cards hash, your pool pays the address you gave it, and the coins sit wherever that address lives. Three places where Thursday reaches you:

Payouts to an exchange deposit address. If your pool pays straight into a Binance deposit address, the coins still arrive, because deposits on-chain cannot be stopped, but you cannot move them out until withdrawals reopen. Binance's statement says those balances are safe. Nothing in this article changes that; it only reminds you that an exchange balance is a promise from a company, while a wallet whose keys you hold is a fact on the chain.
Price. A $6 billion sale of stolen coins and a market-wide drop hit every mining calculation. Check your break-even against today's prices, not Wednesday's. Our Hash Compass page uses live prices.
Scams. Binance's own first warning was about this: expect messages, emails and links claiming to "secure your account" or "process your refund". Binance says it will not ask for your account information through unofficial channels. Nobody else needs your seed phrase either. [1]

What redPeaRL users need to do

Nothing in the miner. redPeaRL talks to your graphics card and to the mining pool you chose; it holds no coins and no exchange keys. The one setting worth a look is the payout address in your pool account: if it is an exchange deposit address, consider pointing it at a wallet you control, at least until Binance publishes its post-mortem and reopens withdrawals.

From the redPeaRL team: we make redPeaRL, a Pearl (PRL) miner for AMD RX 9070 XT and RX 9060 XT cards. We have no relationship with Binance and no inside information; this article is assembled from the public sources below so that miners who do not follow exchange news have one plain-English page to read. We will update it when Binance publishes its findings.

Based on public reports as of the morning of 30 October 2026 (US Eastern). Dollar figures are the estimates of the parties named and will change. Not financial advice.

Sources

Zack Whittaker, "Binance pauses withdrawals as hackers suspected of stealing billions in crypto", TechCrunch, 29 October 2026 (Binance spokesperson statements, CZ's post, the early $2 billion and $5.7 billion tallies). techcrunch.com
CNBC, "Biggest-ever crypto hack impacts $6.3 billion as Binance works to contain fallout", 29 October 2026 (Binance's "around $6.3B" and "verified total frozen is $2.54 billion" posts on X, Richard Teng on SAFU and company funds). cnbc.com
NBC News, "Binance targeted in $6.3 billion crypto heist, the largest ever", 30 October 2026. nbcnews.com
BleepingComputer, "Binance links $6.3 billion crypto theft to compromised DevOps laptop", 30 October 2026 (Binance's statement to the outlet: the laptop, the service container, "no evidence of any wallet private key leak", the additional points of breach; Chainalysis concurring with TRM's attribution). bleepingcomputer.com
TRM Labs, "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History", published 02:10 UTC 30 October 2026 (timeline, per-chain amounts, EIP-7702 pre-authorisations, freezes, the $2.4 billion beyond reach, the Bybit comparison). trmlabs.com
CoinDesk, "$6 billion Binance hack sends bitcoin, ether tumbling; Standard Chartered expects more pain", 30 October 2026. coindesk.com
CryptoTicker, "Crypto Crash After Binance Hack: The Timeline of the Night", 29-30 October 2026 (CoinGecko five-minute prices; the $628 million of liquidations is CoinGlass data as cited by PANews). cryptoticker.io
Cyber Kendra, "Binance Hack: $3.3B Left Hot Wallets, $1.79B Frozen", updated 03:00 UTC 30 October 2026 (Chainalysis's $5.9 billion early estimate, Glassnode and Arkham tallies, BNB balances untouched). Secondary source. cyberkendra.com