Binance's $6.3B Hack: What Crypto-Accepting Merchants Must Do Now

On this page 6 sections

1. What Happened at Binance and What the Exchange Has Promised
2. Why the Binance Hack Hit Merchants Who Settle in Crypto
3. Custodial vs. Self-Custody Settlement: Weighing the Trade-Offs
4. Spreading Settlement Across Exchanges, Processors and Stablecoins
5. Handling Pending Orders, Refunds and Customer Questions During a Freeze
6. Questions to Ask Your Crypto Payment Provider This Week

Key takeaways

• Binance's promise to cover losses is a company commitment, not insurance. As NBC News noted, exchange accounts aren't automatically insured the way bank deposits are.
• Your baseline exposure is roughly your daily crypto volume times the days funds sit before payout, plus anything that keeps arriving during a freeze. Shortening the payout cycle cuts it the most.
• You can be exposed to an exchange you never signed up with if your processor, OTC desk or overseas partner uses it. Ask your provider directly.
• Payments that arrived through hack-linked addresses raise compliance questions. Find out how your provider screens incoming crypto and what happens if a payment you already accepted is flagged later.

Binance says it will absorb the losses from the roughly $6.3 billion theft it disclosed on Oct. 29, 2026, and it began reopening withdrawals in phases on Nov. 1. For merchants, the Binance hack is a reminder that crypto held on an exchange is a claim on that exchange. For about three days, that claim couldn't be cashed out. If you settle crypto payments into an exchange account or keep a working balance on one, do three things this week: cap how much sits on any single platform, ask your payment provider whether it had Binance exposure, and write the customer message you'll send during the next freeze.

What Happened at Binance and What the Exchange Has Promised

According to NPR, the theft began at 4:05 p.m. Eastern on Thursday, Oct. 29. Blockchain analytics firm TRM Labs estimates that about $6.36 billion moved out of Binance wallets across 10 blockchains, most of it within roughly 20 minutes. That makes it the largest crypto theft on record. As NPR noted, the same North Korean unit was behind the previous record, the $1.5 billion theft from Bybit in 2025. This one is about four times larger.

Binance's first explanation, reported by NBC News and CNBC on Oct. 30, was that a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng later said the attack was more complex than one engineer's misused permissions. On Nov. 3, NBC News reported Binance's statement that the intrusion began in June, when an employee on its wallet developer team downloaded a tampered AI tool after a fake job interview. On Oct. 31, the FBI attributed the theft to North Korea's TraderTraitor unit. North Korea has rejected the claim.

As of Nov. 3, Binance had made these commitments:

• Losses: Binance says customers will not bear the loss and that it will cover it, partly through its Secure Asset Fund for Users (SAFU), according to CNBC.
• Recovery: Binance said about $3 billion of the stolen assets had been frozen on blockchain networks, according to Bloomberg and CNBC.
• Coverage so far: On Oct. 31, CNBC reported that Binance had restored backing for 90% of affected assets. On Nov. 1, CNN reported Binance's statement that about 95% of the stolen amount was covered.
• Access: Withdrawals resumed in phases starting Nov. 1, beginning with the Bitcoin network and then Ethereum and BNB Smart Chain. CNN counted 15 assets restored by 7:36 a.m. Eastern that day.

The reopening set off a rush. TechCrunch reported $4.6 billion in withdrawals against $1.0 billion in deposits during the first window. Binance put that net outflow of $3.6 billion at 2.1% of its assets under management. Fundstrat's Sean Farrell told CNBC the breach did not appear to be a solvency event for Binance.

Why the Binance Hack Hit Merchants Who Settle in Crypto

Most crypto checkouts end in one of two places. In the first, the customer's coins land in a wallet the merchant controls. In the second, a processor or exchange holds them in an account in the merchant's name until the merchant sells them for dollars and withdraws to a bank. With the second setup, a withdrawal freeze stops everything downstream: payroll, supplier invoices, refunds and the transfer that turns crypto revenue into cash.

Reports conflict on whether deposits stopped. NBC News and Bloomberg said Binance suspended deposits and withdrawals. CNBC quoted co-founder Yi He saying deposits continued normally. If deposits did keep working, a merchant's settlement address could have kept receiving customer payments into an account that couldn't send anything out. For a settlement account, that's the worst combination.

Two other points matter more than the headline number. The first is insurance. As NBC News noted, exchange accounts are not automatically insured the way bank deposits are, so any reimbursement is up to the exchange. Binance's promise to cover losses is a company commitment. It is not deposit insurance, a card network rule or a legal guarantee.

The second is that your exposure can be indirect. Many U.S. merchants never open a Binance account themselves, but a crypto processor, OTC desk or overseas partner in their payment chain might. That is crypto payment counterparty risk: the failure of a company you never signed a contract with can still delay your money.

Custodial vs. Self-Custody Settlement: Weighing the Trade-Offs

Neither model is safe by default. Each one puts the risk in a different place.

The Binance attack started with a compromised employee machine, and that's the same weak point a small business has. If you move to self-custody to escape exchange risk, the laptop of whoever holds your keys becomes the target. At a minimum, use a hardware wallet, a written recovery process and a two-person rule for large transfers. Self-custody also doesn't remove issuer risk on stablecoins, which the next section covers. For most small merchants, the better move is to stay custodial and shrink the balance that sits there.

Spreading Settlement Across Exchanges, Processors and Stablecoins

The simplest fix is to hold less. If your provider can convert crypto to dollars at the time of sale and pay out to your bank on a schedule, your exposure shrinks to the payouts in transit. Conversion costs a fee, so check the provider's current pricing. Our guide to accepting crypto payments, including processor choices and tax treatment covers how those fees and payouts usually work.

If you need to keep crypto, split it. When you settle into two unrelated platforms, one freeze stops half your receipts instead of all of them. Stablecoins reduce price swings, but they add issuer risk. Tether and Circle froze some assets tied to the theft. That helped recovery, and it also shows that issuers can freeze tokens at an address, including one in a wallet you control yourself. Our explainer on how USDC settlement works for merchants walks through that trade-off.

Worked Example: Sizing Your Exchange Float

Illustrative numbers only. Assume an online store takes $60,000 a month in crypto payments, or about $2,000 a day over a 30-day month. It settles to an exchange account and withdraws to its bank once a week. Assume the freeze lasts three days and deposits keep arriving the whole time.

• Just before each weekly withdrawal, about $14,000 sits on the exchange (7 days × $2,000).
• A three-day freeze that starts right before payout day ties up that $14,000. Another $6,000 (3 days × $2,000) arrives during the freeze, so the total reaches $20,000.
• With daily withdrawals, the peak balance falls to about $2,000. The same three-day freeze then traps about $2,000 plus the $6,000 that arrives during the pause, or $8,000.

Here's the rule to take from this. Your baseline exposure equals daily crypto volume times the number of days funds sit before payout. If deposits keep landing during a freeze, add daily volume times the length of the freeze. Decide how much you could go without for a week, then set your payout schedule so your total stays under that number.

Handling Pending Orders, Refunds and Customer Questions During a Freeze

Freezes create three kinds of stuck transactions, and each one needs a different answer.

The customer couldn't pay. If a buyer was paying from a frozen Binance account, the coins never left, and your checkout invoice will usually expire. Don't ship. Email the customer, hold the cart or the price for a set period, and offer another way to pay. Card acceptance through an online payment processing account keeps orders moving when a crypto rail stalls.

The customer paid, but you can't move the funds. If the payment confirmed on-chain to your settlement address, the order is paid. The freeze is your cash flow problem, not the buyer's, so fulfill on your normal schedule.

You owe a refund. Follow your posted refund policy. Make sure it says whether refunds are calculated in dollars or in the original crypto amount, because prices moved sharply after the hack. If your crypto balance is locked, you can refund from a separate wallet or offer an equivalent dollar refund (if your policy allows it), so the customer isn't waiting on Binance. Crypto payments don't carry card-network chargeback rights, so a clear policy is the only dispute framework you have.

Sample message: "Our crypto payment partner temporarily paused withdrawals after a security incident. Your order is [confirmed / on hold]. If you'd prefer not to wait, you can pay by card at [link], and we'll cancel the pending crypto invoice."

Questions to Ask Your Crypto Payment Provider This Week

Ask in writing and keep the answers.

1. Where are my funds held, and whose name is on the account? Are merchant balances kept separate or pooled?
2. Did you hold any funds or liquidity at Binance, and were any of my settlements delayed between Oct. 29 and Nov. 1?
3. Can I auto-convert to dollars at the time of sale, and how fast do bank payouts arrive?
4. Do you screen incoming payments against addresses linked to the theft? TRM Labs reported on Nov. 3 that the stolen funds are being laundered through TRON, Ethereum and chained bridges, and it advises rescreening deposits as new addresses are linked to the theft. Ask what happens to a payment you already accepted if it gets flagged later.
5. How will you notify me during an incident, and how quickly?
6. What is my fallback if your service pauses?

Question 4 is a compliance issue as much as an operational one, because funds traced to a state-sponsored theft raise sanctions questions. Our guide to OFAC sanctions screening for online sellers explains the basics. This is general information, not legal advice, so confirm your obligations with a qualified attorney. For a broader checklist on licenses and regulatory history, see vetting your crypto payment partner.

Start with the float math. Multiply your daily crypto volume by the days funds sit before payout, then add a few days of volume in case deposits keep arriving during a freeze. If losing access to that total for a week would hurt, shorten your payout cycle before the next incident. If you plan to use card acceptance as your backup, a MannyPay specialist can review your setup through a free merchant services quote. Two open questions to watch: whether Binance covers the last of the stolen assets, and how much of the roughly $3 billion frozen on-chain is actually recovered.

Sources

1. Binance targeted in $6.3 billion crypto heist, the largest ever (NBC News)
2. Binance says hackers used fake job interview to compromise computer before $6.3 billion attack (NBC News)
3. $6.3 billion Binance hack is largest crypto theft on record (CNBC)
4. Binance's $6.3 billion hack: What we know and what comes next (CNBC)
5. Binance hack: Investigators in a 'cat and mouse game' to recover $6.3 billion in stolen funds (CNBC)
6. Binance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered (CNBC)
7. Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack Shakes Industry (Bloomberg)
8. A simple explainer of the massive $6.3 billion crypto heist at Binance (NPR)
9. Binance crypto hack: North Korea suspected to be behind biggest-ever heist (CNN)
10. Binance withdrawals resume following $6 billion hack (CNN)
11. Binance resumes withdrawals following $6.3 billion breach (TechCrunch)
12. Binance Resumes Withdrawals After $6.3 Billion Hack, FBI Points to North Korea (Yahoo Finance)
13. Binance hacked for record $6.3 billion, withdrawals suspended after "complex attack" (Yahoo Finance)
14. Binance resumes withdrawals for some cryptocurrencies after heist (Yahoo Finance)
15. The Binance hack is a compliance story: Four lessons for financial crime teams (ACAMS)
16. Binance Hack Update: North Korea Launders Proceeds Through Self-Minted Tokens and Chained Bridges (TRM Labs)

AR

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.