Binance $6.3B Hack: What It Means for Businesses Accepting Crypto
02/11/2026
On 29 October 2026, Binance confirmed a security incident with an estimated impact of about $6.3 billion and temporarily suspended all deposits and withdrawals. Blockchain analytics firm TRM Labs calls it the largest crypto theft on record. For businesses that accept crypto, the lesson is less about one exchange and more about where your revenue sits between payment and payout.
What happened
The incident. Binance said the security incident had an estimated total impact of about $6.3 billion, with about $3 billion frozen, and that it would cover all user losses from its SAFU fund and company funds (Fox Business).
The movement of funds. According to TRM Labs, about $6.36 billion left Binance wallets across ten blockchains, most of it within roughly 20 minutes from 20:05 UTC. Losses included 200,630 ETH, 18,270 BTC and about 1.875 billion USDT on Ethereum, plus assets on Tron, XRP Ledger and Solana.
Attribution. TRM attributes the attack with high confidence to TraderTraitor, a North Korean hacking group. Binance has not published a final root cause.
Freezes. Stablecoin issuers and other parties, including Tether and Circle, froze roughly $2.7 billion by early 30 October, per TRM.
Account access. Binance said user funds remain safe and that deposits and withdrawals were paused as a precaution. Reports on 30 October said Binance expected to begin resuming withdrawals within 48 hours.
What it means for merchants
Many online businesses route crypto revenue through an exchange account: customers pay to an exchange address or via an exchange payment product, and the balance sits there until someone converts or withdraws it. When an exchange pauses withdrawals, that revenue cannot pay suppliers, salaries or affiliates, even if the funds are later fully covered.
Two risks became visible this week:
Liquidity risk. Funds can be safe but unavailable. A pause of even two days can break payout schedules for Gaming, affiliate and marketplace businesses that settle partners daily.
Concentration risk. Keeping payment collection, conversion and storage with one provider means one incident affects all three.
What to do now
Map where your crypto revenue sits at each step: payment received, converted, stored, paid out.
Separate collection from storage. Accept payments through a payment gateway and sweep balances regularly to wallets you control.
Keep working capital in more than one place, across providers and networks, so one pause does not stop payouts.
Choose your stablecoin and network deliberately. Issuer freezes worked in this case, but they also show that USDT and USDC are centrally controlled assets; know the rules of the ones you hold.
Have a backup payment method ready so checkout keeps working if a provider goes offline.
How PassimPay helps
PassimPay is a crypto payment gateway for businesses, not an exchange account. You accept 74+ coins, including USDT and BTC, through plugins, payment links or API, and can send funds to your own wallets with automatic withdrawal rather than leaving revenue on one platform. Businesses that also need to pay out partners can use mass payouts, and teams onboarding new users can add a fiat-to-crypto on-ramp.
Not sure which stablecoin to settle in? Read USDC vs USDT for business.
This article reflects information available on 2 November 2026 and will be updated as Binance publishes more details.
FAQ
Were Binance users' funds lost?
Binance said user funds remain safe and that it will cover all losses from its SAFU fund and company funds.
Can merchants withdraw from Binance now?
Binance paused deposits and withdrawals on 29 October and said it expected to begin resuming them within 48 hours. Check Binance's official announcements for current status.
Who was behind the hack?
TRM Labs attributes it with high confidence to TraderTraitor, a North Korean group. Binance has not published a final root cause.
How can a business reduce exchange risk?
Accept payments through a gateway, sweep funds to wallets you control on a schedule, and keep working capital with more than one provider.
Sources:
Contact us →Do you like this article? Share it with your friends.
More
