Binance, the world’s largest cryptocurrency exchange, confirmed a massive hack on October 29, 2026. According to the company, the amount affected reaches around $6.3 billion, or some 5.2 billion francs. Around 3 billion has been frozen on the blockchain, and both deposits and withdrawals are suspended. For a Binance customer in Switzerland, the episode raises a concrete question: what is a refund promise from a foreign platform worth?

A night of contradictory messages

Binance confirmed the attack at around 23:30 GMT on Thursday, October 29, according to the AFP dispatch carried by Allnews. For several hours, specialists had already been reporting an intrusion. At around 0:30 GMT on Friday, October 30, the platform temporarily suspended “all deposits and withdrawals”.

The messages posted on X did not always match. Binance first assured that customer funds were “completely safe”. A little later, it announced that it would cover “all losses”. The figure of $6.3 billion appeared afterwards, on its X account for Latin America.

Changpeng Zhao, Binance’s former boss, remains the majority shareholder without an operational role. He estimated the losses to be “a little higher” than one billion dollars, according to Allnews. Yi He, co-founder of Binance, said on X that withdrawals should resume by Sunday, November 1, reports finews.ch.

How the hacker took control of a Binance wallet

The core of the attack targeted a “hot wallet”, a permanently connected wallet used for customer withdrawals. Named Binance 14, it alone lost around $2.5 billion, according to Journal du Coin.

The tool used is called EIP-7702, an Ethereum improvement proposal that came into force with the Pectra upgrade on May 7, 2025. It allows an ordinary account to delegate its execution to a smart contract. All it takes is an authorization signed with the account’s private key.

Each authorization must carry the account’s exact sequence number, called the nonce. The hacker did not know this counter, because Binance 14 was processing withdrawals one after another. So he signed 50 consecutive authorizations and sent them in a single transaction. Blockaid, the security firm that detected the operation, sums it up: “only one out of 50 hit the mark”.

This delegation dates from October 29 at 20:20 UTC. According to Blockaid, the first transfer went out 3 minutes and 24 seconds later. It took 167,464 ether, 1.6 billion USDT and some sixty other tokens.

The key point lies elsewhere: no Ethereum bug was exploited. The protocol executed a valid signature. Ido Ben-Natan, head of Blockaid, speaks of a “misuse of the key”, not a theft.

Where the $6.36 billion went

The hacker struck around ten blockchains at the same time. TRM Labs, a blockchain analytics firm, puts the total at $6.36 billion, according to Journal du Coin. Blockaid, which counts only Ethereum, Bitcoin and Tron, arrives at 5.57 billion.

BlockchainAmount estimated by TRM Labs
Ethereum (including Binance 14 and 823 million USDC)around $3.79 billion
Bitcoin (18,270 bitcoins)around $1.47 billion
Tron (USDT and TRX)around $628 million
XRP Ledger (233.46 million XRP)around $296 million
Solanaaround $96 million
Arbitrum, Optimism, Base, Avalanche and Polygonaround $77 million for the five combined

According to TRM Labs, quoted by Inside IT, the attackers moved most of the sum in 20 minutes. It would be the biggest theft ever suffered by an exchange. The previous record, around $1.5 billion, targeted Bybit in February 2025.

Several players froze part of the loot:

  • Tether, issuer of the USDT stablecoin: around $1.6 billion, according to Allnews; more than 1.5 billion according to its boss Paolo Ardoino, quoted by finews.ch;
  • Circle, issuer of USDC: around $800 million, according to its CEO Jeremy Allaire, in coordination with the authorities;
  • the Security Council of Arbitrum, a network built on top of Ethereum: around $30.5 million in ETH and ARB tokens, on October 30 at 0:08 UTC.

A freeze is not a restitution. The funds blocked on Arbitrum will only move after a vote of the ArbitrumDAO governance, according to the network’s report. The same gap was seen with the hacked Cysic bridge on October 17: the freeze had not affected the tokens already sold on.

What Binance claims, what is established

The amounts come from Binance and analytics firms, not from an official investigation. Three levels need to be distinguished.

Established by public blockchain data: the delegation of Binance 14, the 50 authorizations, the transfers to around ten networks and the freezes by Tether, Circle and Arbitrum.

Claimed by Binance: around $3 billion frozen and the coverage of “all losses”. The company attributes the intrusion to the compromised laptop of a DevOps engineer, responsible for running the systems. This access allegedly opened a service container capable of submitting withdrawals. Binance says it found “no evidence of a private key leak”. It then reported other vulnerabilities, without detailing them, according to Inside IT.

Third-party analyses: TRM Labs attributes the attack to the North Korean group Tradertraitor, already named for the Bybit theft. According to Reuters, quoted by ICTjournal, Chainalysis also recognizes a North Korean modus operandi. TRM Labs concludes that the signing infrastructure of the hot wallets was compromised.

Since 2018, Binance has had a reserve fund, the Secure Asset Fund for Users (SAFU). It normally holds around one billion dollars, according to finews.ch. The sources consulted do not say how Binance would finance the rest of its promise.

Binance and Switzerland: what this changes for a holder

Binance claims not to have a fixed central headquarters. Since the start of 2026, its global business has mainly gone through companies authorized and supervised by the financial authority of Abu Dhabi Global Market, finews.ch points out. For a customer in Switzerland, it is therefore a foreign platform.

Counterparty risk. Leaving your cryptocurrencies on a platform means depending on it to access them. The suspension of withdrawals illustrates this: no customer can take out their assets as long as it lasts. The promise of coverage remains a statement by Binance, not a guarantee from a third party.

Self-custody. Keeping your tokens in your own wallet removes this platform risk. It does not remove all risk. According to Journal du Coin, the EIP-7702 mechanism also applies to private wallets: an authorization signed to a malicious contract hands over the entire account. To transfer its holdings, an institution supervised by FINMA may send crypto to the external wallet of its own identified customer, under FINMA’s travel rule.

The status of platforms in Switzerland. The Swiss Financial Market Supervisory Authority (FINMA) applies existing law to cryptocurrencies. Trading virtual currencies and providing wallets fall under the Anti-Money Laundering Act, with membership of a self-regulatory organization. Accepting crypto assets from the public may fall under the Fintech licence. The details are on our page on FINMA crypto authorization.

An authorization does not protect against everything. If a Fintech institution goes bankrupt, client funds are neither privileged nor covered by the deposit guarantee. A European MiCA licence, for its part, is not valid in Switzerland, which is not part of the European Economic Area.

Before opening an account, FINMA publishes two sections to consult: “Authorized institutions” and “Warnings”. FINMA’s warning list is, however, neither exhaustive nor always up to date. An overview of the framework is on our page FINMA and cryptocurrencies.

Authorized products follow other rules. For the first Swiss bitcoin ETF, authorized on October 20, 2026, FINMA required measures against custody risks. It also reminded investors that the capital invested can lose a significant part of its value.

Prices reacted briefly. Bitcoin briefly dipped below $77,000 before returning to around $78,400, according to finews.ch. BNB, the cryptocurrency issued by Binance, lost nearly 10% before rebounding by 2.67%, according to Allnews.

What we do not know yet

  • The exact point of entry: Binance mentions a compromised laptop, TRM Labs a breached signing infrastructure. Binance promises a detailed report at the end of the investigation.
  • The fate of the frozen funds: returning them to Binance remains a separate operation from the freeze. According to TRM Labs, the hackers still hold around $2.4 billion out of the issuers’ reach.
  • How the promised coverage will be financed and the actual date on which withdrawals resume.
  • The number of customers affected in Switzerland: none of the sources consulted gives it.

Sources