On 30 October 2026, the direct answer from Binance itself is that user funds are safe. Co-CEO Yi He has said user funds are safe and that all losses will be covered from company funds and the SAFU emergency fund, which holds about $1 billion in bitcoin. That statement is the company's position, and it is the starting point for any discussion of user funds after the 29 October 2026 breach.

The breach itself was large. The estimated impact is about $6.3 billion, described as the largest crypto theft on record, surpassing Bybit's $1.5 billion in 2025. A large total does not automatically mean individual user balances were taken, but it does explain why Binance's statement about covering losses has drawn close attention and why verification matters.

One reason the company statement is being tested against later evidence is the reported ETH movement. About 204,500 ETH moved from a wallet called Binance 14, which was in Binance's 1 October proof of reserves, after the attacker reportedly used the Ethereum feature EIP-7702 to turn it into a sweeper. ETH backing is reported to have fallen from 100 percent on 1 October to near 94 percent after that movement.

Freezes have also limited further movement of part of the stolen assets. About $3 billion has been frozen so far, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze about $200 million, and World Liberty Financial froze $27 million in USD1. Those figures show action by issuers, but frozen assets are not the same as funds already restored to users.

As a precaution, deposits and withdrawals were suspended. Yi He said she expects withdrawal resumption to begin within the next 48 hours. Readers should be aware of a reporting discrepancy: some reports say deposits were unaffected. Because the reports conflict, the current status should be confirmed through official Binance channels rather than assumed.

The preliminary investigation offers early context on how the breach may have happened, without yet giving a final account. It suggests a compromised DevOps engineer's laptop may have let an attacker access a service container and submit unauthorised withdrawal transactions. No evidence of a wallet private key leak has been found so far, but that is a preliminary finding in an ongoing investigation.

Attribution claims are also preliminary in a different sense. TRM Labs traced the breach to the North Korean unit TraderTraitor, and other trackers also pointed to North Korea. That is an investigators' claim, not a court finding, and Pyongyang has previously denied hacking allegations. Attribution does not, on its own, answer whether a particular user's funds are intact.

The next verifiable milestone is the proof-of-reserves snapshot on 1 November 2026, which will show whether stolen assets were replaced. Market prices fell after the breach, with Bitcoin below $77,000, down about 4.5 percent in 24 hours to $76,664 and later about $77,984, ether down about 3.2 percent, BNB down about 3.9 percent, and more than $1 billion in leveraged positions liquidated in 24 hours. This article gives no advice on buying, selling, holding, or withdrawing, and readers should rely on official Binance channels for updates.

FAQ: Does Binance guarantee user funds are safe? Binance's stated position is that user funds are safe and losses will be covered from company funds and SAFU. What will confirm that position? The 1 November 2026 proof-of-reserves snapshot will show whether stolen assets were replaced. Are withdrawals available now? They were suspended as a precaution, with resumption expected to begin within the next 48 hours according to Yi He, subject to official confirmation.