Binance hack of October 29: you received funds from an unknown address, or your deposit got frozen — what to do

Updated: November 3, 2026 · sources: Binance, FBI, Gate, Elliptic, Lookonchain, on-chain data

After the Binance hack, the stolen funds are spreading across thousands of wallets, and exchanges and services are blocking anything linked to them. If you received a transfer from an unknown address or an exchange froze your deposit, here is what to do in each case.

What is known as of November 3

• On October 29 funds were drained from Binance hot wallets. On-chain data shows the attacker took control of an exchange hot wallet in a single transaction and swept its tokens to their own addresses.
• On October 31 the FBI attributed the attack to North Korea's TraderTraitor group and published 628 addresses, asking services to block them.
• On November 1 Binance began reopening withdrawals in phases. The exchange said about 95% of the loss is covered and 10 main coins are 100% backed.
• Gate froze two accounts linked to the hacker. Elliptic estimates about $2.85B frozen or seized, while about $3.25B cannot be frozen.
• The loot is being split and mixed through DEXs, bridges and fresh wallets. So “dirty” funds can reach you two or three transfers later — from someone who did not steal them.

You received a transfer from an unknown address

An incoming transfer on its own does not make you an accomplice. The risk is different: if those funds are linked to the hacker's addresses, the exchange you send them to may freeze them — and it will be on you to prove you had nothing to do with it.

1. Don't send these funds to an exchange until you have checked the sender's address.
2. Check the sender's address in the form below: you will see sanctions, USDT/USDC issuer freezes and known labels, including addresses linked to the Binance hack.
3. Don't forward the funds “to get rid of them” — that looks like laundering and weakens your position.
4. If it was payment for a deal (P2P, goods, services), keep the chat, the agreement and the counterparty's details. That is your proof of lawful receipt.
5. Don't sign anything if, after the transfer, someone asks you to “return a mistaken payment” via a signature or a website: that is a common theft scheme.

An exchange froze your deposit after the hack

After hacks like this, exchanges screen incoming transfers against lists of the hacker's addresses — those published by the FBI and their own. Someone who received the funds several transfers later, knowing nothing about their origin, can be frozen too.

1. Don't open new tickets or make new deposits to that account — reply in the same request.
2. Ask the exchange to state the reason in writing: which transaction and which rule (sanctions, a link to the incident, a request from authorities).
3. Document the source of funds: who sent you the transfer and why, statements from other exchanges, chats, contracts.
4. Find out where exactly the link is: a direct transfer from a hacker address and a link three or four transfers away are different situations, and the appeal arguments differ too.
5. File an appeal with documents. To be honest: only the exchange decides, and nobody can guarantee the outcome.

Post-hack “compensations” are almost always fake

The rule is simple: check any “payout” or “promo” inside the exchange app only, never via a link in your DMs. Don't sign anything to “get money back”: approve and permit grant access to your tokens.

FAQ

Check an address on TelegramFrozen deposit review