Binance Explained: How It Works, the 2026 Hack and Staying Safe

What is Binance and how does it work?

Binance is a centralised cryptocurrency exchange: a company-run platform where users buy, sell and hold digital assets. CBS describes it as the world's largest crypto exchange by daily trading volume ^[1]. In a 2023 enforcement release, the US Treasury's sanctions office, OFAC, described the conduct at issue: Binance matched and executed virtual-currency trades on its online exchange platform between US users and users in sanctioned jurisdictions or blocked persons ^[10].

A centralised exchange (CEX) is run by one company that operates the trade-matching system and, in most cases, holds customers' assets for them. Holding assets on someone else's behalf is called custody.

On scale, Binance stated that it had over 120 million users by the end of 2022, according to OFAC's 2023 release ^[10]. This guide does not quote a 2026 user count because the research behind it did not find a reliable one.

What is in the news about Binance in November 2026?

Three stories overlap. As of 3 November 2026, several of the figures below are still moving.

• A record theft. About $6.3 billion was stolen from Binance wallets on 29 October 2026 ^[2][4].
• A product shutdown. Binance Pool and related mining services close on 10 November 2026 ^[6].
• Regulatory pressure. On 26 June 2026 Binance told EU customers it would not have a MiCA licence by the 1 July 2026 deadline ^[7], and in October 2026 the US Justice Department was reviewing compliance with the 2023 settlement ^[8].

How do crypto exchanges work?

A centralised exchange does two jobs: it matches orders, and it keeps records of what each customer owns. Both jobs depend on trusting the company that runs it.

How does order matching work?

In general terms, the exchange's system pairs a buy order with a sell order and executes the trade on its own platform. OFAC says Binance matched and executed trades on its platform between US users and users in sanctioned jurisdictions ^[10]. The trade happens inside the exchange's records, not as a separate transaction between two strangers.

Who holds your coins when you leave them on an exchange?

A private key is the secret code that authorises spending crypto. In the usual custodial model, the exchange controls the keys and your balance is its record of what it holds for you. That is a general explanation, and terms differ by platform, so read them. With self-custody, you alone hold the keys: no company can freeze the coins, but no company can recover them if you lose the keys.

Worked example. Suppose you buy 0.1 BTC on an exchange and leave it there. Your screen shows 0.1 BTC, but that figure is the exchange's record. If the exchange suspends withdrawals, as Binance did after the October 2026 theft ^[1], you cannot move the coins, even though in this illustrative example the balance still shows on screen.

The US SEC's Office of Investor Education and Assistance published a crypto custody bulletin on 12 December 2025. BeInCrypto quotes it warning: 'If the third-party custodian is hacked, shuts down, or goes bankrupt, you may lose access to your crypto assets.' ^[11] The bulletin also compares self-custody with third-party custody ^[11]. Binance began reopening withdrawals in phases on 1 November 2026 ^[1].

What does proof of reserves show?

Binance completed a cryptographic proof of reserves on a snapshot taken on a Saturday. It said its holdings in 10 cryptocurrencies, including Bitcoin, Ether and USDT, are backed at least 1:1. A further snapshot was planned for the following Wednesday, which falls on 4 November 2026, and the proof was expected to take 40-50 hours to generate ^[4].

Read it for what it covers. A proof built on a single snapshot of 10 assets says nothing about other tokens or about dates after the snapshot. It is one piece of evidence, not a verdict on the whole company.

What happened in the Binance hack of October 2026?

Hackers stole about $6.3 billion of crypto from Binance wallets on Thursday 29 October 2026 ^[2][4][12]. Binance suspended withdrawals afterwards ^[1]. CBS says the theft is thought to be the biggest crypto heist ever ^[1].

Who is blamed for the Binance hack?

In a statement on Saturday 31 October 2026 the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about 29 October. It named the group TraderTraitor, said it was converting the proceeds mainly into Ether, and expected further laundering through decentralised finance and instant swap services ^[1][12]. The FBI blamed the same group for the roughly $1.5 billion theft from the Bybit exchange in February 2025 ^[1][12]. Private analysts also pointed to the group, according to CBS ^[1].

Chainalysis says North Korea stole more than $2 billion in crypto in 2025, its most successful year on record ^[13]. North Korea denies the Binance allegation. Kim Yo Jong, a senior ruling-party official, called the FBI claims 'absurd rhetoric' in a statement published by state media ^[3].

How did the attackers get in?

That is still unresolved. Binance initially said a compromised employee laptop might have enabled the intrusion. It later reported that investigators had found additional points of breach ^[12]. It said it would publish a detailed incident report when its investigation is complete ^[2][12].

Why do the numbers differ between reports?

Binance and TechCrunch say $6.3 billion ^[2], while the FBI says 'more than $6 billion' ^[1]. ABC converts some figures into Australian dollars as well, for example giving Binance's figure of about US$4.649 billion of withdrawals as AU$6.6 billion ^[3], so always check the currency. All amounts here are in US dollars unless stated.

How much was stolen, replaced and withdrawn, and what is the BTC price?

As of 3 November 2026, Binance says it has covered about 95% of the stolen assets, net outflows have reached about $4.7 billion, and its SAFU fund has halved. These are provisional figures from different windows and are not directly comparable.

How much has Binance replaced?

CBS, in a report dated 1 November 2026, said Binance would cover 90% of the stolen assets, which is a pledge rather than a completed purchase ^[1]. Cointelegraph says the later 95% figure was up from about 90% a day earlier ^[4]. Binance said it had covered about 95% by 1 November 2026, that it would bear the financial impact, and that 'these losses will not be passed on to users' ^[2]. The remaining tokens are less liquid and take longer to buy at the required scale ^[2][4]. These are Binance's own figures, and the research behind this guide found no independent verification.

How much have customers withdrawn?

Between 6 a.m. and 3:30 p.m. UTC on 1 November 2026, Binance processed about $4.6 billion of withdrawals and about $1.0 billion of deposits, a net outflow of about $3.6 billion. TechCrunch put this at 2.1% of total assets under management ^[2]. ABC reported the same window, quoting Binance's figure of about US$4.649 billion of withdrawals between 06:00 and 15:30 UTC on 1 November, which it also gave as AU$6.6 billion ^[3]. A Binance spokesperson said net outflows since withdrawals reopened had reached $4.7 billion by 2 November, about 3% of assets ^[5]. Gross versus net figures, and the different windows behind the 1 November and 2 November numbers, explain why they differ.

What is SAFU and how much is left?

SAFU is Binance's emergency fund wallet. On 2 November 2026 it held about 7,500 BTC (about $583 million), down from about 15,000 BTC after a 7,499 BTC transfer linked to the hack. Binance's SAFU policy says it will top the fund back up to $1 billion if its market value falls below $800 million. The policy sets no timeline for replenishing it after a security incident ^[4].

What is the BTC price today?

At 6:30 a.m. ET on 2 November 2026 one Bitcoin cost $77,750.64, according to Fortune. That was about $32,770 lower than a year earlier ^[9]. Prices move continuously and differ between exchanges, so any figure needs a timestamp and a live tracker is the only way to see today's number. CBS reported that most major cryptocurrencies fell sharply on Friday 30 October 2026 after the hack ^[1]. The research behind this guide did not isolate the hack's exact share of any price move. This is not financial advice.

Is Binance safe in 2026?

There is no risk-free exchange, and the evidence on Binance points both ways. As of 3 November 2026, the company has taken steps to reassure customers, while the record shows reasons for caution.

What supports confidence?

• Binance says it covered about 95% of the stolen assets and that losses will not be passed on to users ^[2].
• It published a cryptographic proof of reserves showing at least 1:1 backing for 10 cryptocurrencies, including Bitcoin, Ether and USDT ^[4].
• It reopened withdrawals in phases from 1 November 2026 ^[1][12].

What raises doubt?

• The SAFU wallet halved to about 7,500 BTC, and the policy sets no timeline for topping it up ^[4].
• Net outflows were about $3.6 billion in one window on 1 November and about $4.7 billion by 2 November ^[2][5], so many customers chose to leave.
• The cause of the breach is not fully explained, and the detailed incident report is still pending ^[12][2].
• On 9 October 2026 Bloomberg Law reported that the US Justice Department is scrutinising whether Binance breached its 2023 settlement, as authorities probe platform activity for potential Iran sanctions violations. Tysen Duva, head of the DOJ Criminal Division, said officials were reviewing compliance but did not say Binance was in violation ^[8].
• In 2023 OFAC found that between August 2017 and October 2022 Binance had matched trades between US users and users in sanctioned jurisdictions or blocked persons, and it settled for $968,618,825 ^[10].

What is the balanced verdict?

The reassurances are the company's own, and several are unverified. The SEC's custody bulletin, as reported by BeInCrypto, warns that a hacked, closed or bankrupt custodian can leave you without access to your assets ^[11]. For large holdings, get qualified financial advice, and size what you keep on any exchange to what you could live with having frozen.

Can I withdraw my crypto from Binance, and how do I keep it safe on any exchange?

Yes, for some assets. Binance restored withdrawals in phases from Sunday 1 November 2026. As of 5 a.m. ET that day it had reopened Bitcoin, Ether, BNB, XRP, Base, Doge and Optimism, and said it would add more assets and networks as security checks were completed ^[1][12]. Expect delays for assets not yet on the list.

What steps reduce risk when moving funds?

1. Use official channels only. Check Binance's official network status page by typing the address yourself, and ignore links in unsolicited emails, texts or social posts, especially ones that mention the hack or refunds.
2. Decide how much to leave. Withdrawals were suspended after the October 2026 theft and only began reopening on 1 November ^[1]. Keep on an exchange only what you can afford to have frozen.
3. Understand the custody model. The SEC's bulletin, as reported by BeInCrypto, compares self-custody with third-party custody and warns that a custodian that is hacked, shuts down or goes bankrupt can cut you off from your assets ^[11]. Read a platform's terms before you deposit.
4. Harden the account. Use a unique password, two-factor authentication or passkeys, and, where offered, withdrawal allow-lists and anti-phishing codes.
5. Test with a small amount first. Send a small withdrawal to a new address before moving a large sum.

Self-custody removes exchange risk but adds your own: lost keys or a compromised device can mean permanent loss. Neither choice is perfect, and the right split depends on your situation.

Why is Binance shutting down Binance Pool, and what should miners do?

Binance will shut down Binance Pool, Pool Savings, Cloud Mining and Transaction Accelerator at 07:00 UTC on 10 November 2026. The closure also covers Telegram hashrate alerts, email notifications and the pool API. Stratum URLs and mining endpoints will be disabled, and shares submitted after that time will not be credited ^[6].

What do these terms mean?

• A mining pool combines many miners' computing power and shares rewards in proportion to work submitted.
• Hashrate is the computing power a miner or pool contributes.
• Cloud mining means paying a provider for mining output instead of running hardware.
• A Stratum URL is the server address that mining hardware connects to.

Why is Binance closing the pool?

Binance gave an 'ongoing review of products and services' as its reason, and Decrypt does not report a regulatory reason ^[6]. Binance Pool launched in April 2020. At the end of 2025 it ranked ninth among Bitcoin pools with about 26 exahashes per second, or 2.3% of the network, according to Hashrate Index as cited by Decrypt ^[6]. Decrypt, writing in October 2026, also notes two earlier changes: Binance opened access to more than 7,000 US stocks and ETFs for customers outside the US on 1 June, and closed its centralised NFT service on 3 July ^[6].

What should miners and savers do?

1. Repoint hardware to another pool well before 07:00 UTC on 10 November 2026, because shares after the cutoff are not credited ^[6].
2. Redeem Pool Savings before the service ends ^[6].
3. Keep your account in good standing. Binance says eligible outstanding rewards, balances and refunds will be processed afterwards, subject to product rules, account status and compliance checks ^[6]. Shares submitted before the cutoff count toward final rewards ^[6].

Is Binance licensed and legal where you live?

It depends on the country, and Binance's availability and terms differ by jurisdiction. Check Binance's current terms for your country before using it. This guide did not find an official list of restricted countries to cite.

What is the position in the EU?

Under the EU's Markets in Crypto-Assets Regulation (MiCA), crypto firms needed a licence from at least one member state by 1 July 2026 to serve all 27 member states. On 26 June 2026 CoinDesk reported that Binance told customers it would not have the licence by that deadline, and that it told clients in France, Italy, Poland and Spain it would restrict services. Binance had withdrawn its Greek application in late June 2026, said it was confident of securing a licence 'in the coming months', and the FT reported it planned to apply in France ^[7]. This guide did not find a report after 1 July 2026 that confirms the outcome.

What is the position in the US?

On 21 November 2023 Binance Holdings, Ltd. agreed to pay $968,618,825 to settle potential civil liability for 1,667,153 apparent violations of multiple US sanctions programmes ^[10]. In October 2026 the Justice Department was reviewing whether Binance breached its 2023 settlement, and it did not say Binance was in violation ^[8].

Licensing and legality are separate questions from safety. A licence sets rules a firm must meet, but it does not guarantee that a firm cannot be hacked.

What is different for readers in Iran?

Readers in Iran face sanctions, compliance and counterparty risks that other users do not. This section covers only what sourced reports say. It makes no claims about current internet filtering, VPN use or payment limits, because none of the sources reviewed covers them.

What do OFAC's findings say?

OFAC's release says Binance's October 2018 policy prohibited new users from sanctioned and high-risk jurisdictions including Iran, Syria, North Korea and Cuba. It also quotes 2018 internal chats in which the then chief compliance officer said Binance still supported Iranian customers but 'non-openly' ^[10]. OFAC found that trades between US users and users in sanctioned jurisdictions or blocked persons took place from August 2017 until October 2022 ^[10]. Past access therefore did not mean legal or officially supported access.

In October 2026 the DOJ was reviewing Binance's compliance with its 2023 settlement, while authorities probed activity on the platform for potential Iran sanctions violations ^[8]. The review's outcome is not known, so an account linked to Iran should be treated as exposed to compliance action. No source reports specific freeze outcomes.

What do analysts say about regime-linked flows?

Chainalysis says Iran's Islamic Revolutionary Guard Corps (IRGC) and its proxy networks accounted for over 50% of value received in Iranian crypto activity in Q4 2025, in over $3 billion of transfers during 2025 ^[13]. TRM Labs observed about $11.4 billion of total crypto activity in Iran in 2024 and roughly $10 billion in 2025, counting inbound and outbound flows. It reported that Iran's total volume fell about 60% year on year between 28 December 2025 and 16 January 2026, and that activity was overwhelmingly in stablecoins, especially USDT ^[14]. The scopes differ (IRGC-dominated transfers versus all flows), so the two figures should not be compared directly ^[13][14]. The drop shows how fragile access can be.

What about peer-to-peer exchangers?

FinCEN's alert of 11 May 2026 (FIN-2026-Alert002) says the Financial Action Task Force has called on all jurisdictions to prohibit Iranian digital asset service providers from operating in their countries. It says Iran-based providers help connect Iranian digital-asset activity to the global ecosystem, and that unregistered peer-to-peer exchangers are a risk ^[15]. For ordinary users this means counterparty and sanctions risk on those routes, since their flows can share rails with regime-linked networks ^[13][15].

What is likely next, and what is still uncertain?

As of 3 November 2026, the following items could change the picture, in rough order of date.

• 4 November 2026: a further proof-of-reserves snapshot covering more tokens was planned for that Wednesday, with the proof expected to take 40-50 hours to generate ^[4].
• 10 November 2026: Binance Pool and related services close at 07:00 UTC ^[6].
• Open-ended: the detailed incident report, which Binance has promised but not yet published ^[2][12], and any further findings on the additional points of breach that investigators reported ^[12].
• Open-ended: whether Binance replaces the remaining roughly 5% of stolen assets, which are less liquid and slower to buy ^[2], and whether it tops up SAFU, whose policy sets no timeline ^[4].
• Open-ended: the FBI expects further laundering through decentralised finance and instant swap services ^[1][12], so the recoverable share of the stolen funds is uncertain.
• Regulation: Binance said in June 2026 it was confident of a MiCA licence in the coming months ^[7], while the DOJ review of the 2023 settlement was under way in October 2026 ^[8].

Net outflows could keep growing or slow, and the figures reported so far use different windows ^[2][5]. Treat every number in this guide as a dated snapshot rather than a final count.