Binance Hack Scams: Fake Refunds, Fake Support and How to Spot Them

By /

Key Takeaway:
About $6.3 billion was stolen from Binance’s hot wallets on 29 October 2026, and Binance says it will absorb the loss rather than pass it to users. That makes any message asking you to claim a refund, confirm your account, pay a release fee or connect a wallet a reason to stop. Don’t tap the link. Open the Binance app yourself, never share a 2FA code or seed phrase, and if you want to see where a link goes first, paste it into the free Link Expander.

What Actually Happened

Here’s what has been reported as of 1 November 2026. The figures have changed several times in three days, so treat them as a snapshot.

QuestionWhat’s been reported
How much was taken?About $6.3 billion from hot wallets across ten blockchains, starting at 20:05 UTC on 29 October. TRM Labs calls it the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack.
Who did it?The FBI attributes it to North Korea, naming the group TraderTraitor. TRM Labs reached the same view earlier.
How did they get in?Not explained yet. Binance first pointed to a possibly compromised engineer’s laptop, then co-CEO Richard Teng described a more complex process.
Who pays?Binance says it does. On 31 October it said it had replaced up to 90% of the stolen assets from its own funds. That isn’t money recovered from the attacker.
Can people withdraw?Partly. Withdrawals started reopening in phases on 1 November, beginning with Bitcoin, with more assets and networks added as checks finish.

Binance’s wording on the loss was direct: “Binance will absorb the financial impact of these stolen funds, not our users.” Keep that sentence in mind for the rest of this page.

Why a Hack This Big Brings Scams

A major breach gives scammers everything they need: millions of worried customers, a story that’s already in the news, and a reason to expect a message from the company. It lines up neatly with the signs of a scam, especially urgency and a request to act right now. On the day of the theft, Binance told TechCrunch that users should watch out for scams and not trust unofficial links, messages or requests for account information. Malwarebytes gave similar advice the next day.

One thing we can’t tell you is how widespread this already is. As of 1 November we found no published report naming specific fake refund sites or campaigns tied to this hack. The five scams below are the patterns security companies and Binance warn about, and each one has a long history. They’re what to look out for, not a list of confirmed attacks.

Also, don’t confuse the two groups. Nothing we’ve seen connects North Korean state hackers to fake refund messages. Those would normally come from ordinary fraudsters taking advantage of the headlines.

🚨 Five Scams to Watch For

1. The fake refund or compensation page

A message says your account was affected and you can claim compensation, usually within a short deadline. The link opens a copy of the Binance login page, which collects your password and 2FA code, or a page asking you to connect a wallet. Approving a wallet request there can give someone permission to move your tokens. In the statements reported through 1 November, we found no claim form and no request for users to apply for anything.

2. Fake Binance support

Someone contacts you by text, phone, Telegram, WhatsApp or a reply on social media, says your account is at risk, and offers to help. Then they ask for a login code, ask you to install remote-access software, or tell you to move your crypto to a “safe wallet”. That last one is just a transfer to the scammer. Binance’s own phishing guide names usernames, passwords and 2FA codes as what these attempts are after.

3. The “withdrawals are open” message

This one is believable because withdrawals really did start reopening on 1 November. A message telling you to hurry and get your funds out before the next pause leads to a fake login page. You don’t need the message at all. If withdrawals are open for your coin, you’ll see it on the withdrawal page inside the real app, or on Binance’s network status page.

4. The recovery expert

A “recovery firm”, “blockchain investigator” or law firm offers to get your money back for an upfront fee. The fee is the scam. The FBI has warned about fictitious law firms targeting people who lost crypto, and the FTC says legitimate organisations don’t charge you to get a refund. We cover how these work in our guide to recovery scams.

5. Address poisoning

This one needs no message. A scammer creates a wallet address with the same first and last characters as one you’ve used, then sends a tiny transaction to you, so the lookalike appears in your history. Later, you copy the wrong one. With many people moving funds as withdrawals reopen, it’s a good week to be careful. In 2024 one trader sent about $71 million to a lookalike address this way, and only got most of it back after negotiating with the attacker. You shouldn’t count on that ending. Get the address from the place you’re sending to, not from your history, and compare every character.

🔍 How to Check a Message

You can do all of this before tapping anything.

  1. Go to Binance yourself. Open the app from your home screen, or type the address. If something truly needs your attention, it will be there. This step alone defeats most of the scams above.
  2. Read the address from the right. The real site is the part just before the first single slash. binance.com.refund-claim.example/verify is a site called refund-claim.example. The “binance.com” at the front is a label anyone can add. Our lesson on reading a link before you tap it walks through more examples.
  3. See where it ends without opening it. Paste the link into the Link Expander. It follows the link on our server, shows each step, and warns if the address names a well-known brand on someone else’s domain or the domain is brand new. A clean result isn’t proof a page is safe, and it’s possible for a checked link to tell the sender it was visited. For a code in an image, use the QR Code Decoder. If the name looks right but something feels off, try the Lookalike Domain Checker, which catches letters borrowed from other alphabets.
  4. Ask Binance. Binance Verify lets you enter a web address, email, phone number or Telegram account to see whether it’s an official channel. Type that address yourself too, rather than following a link to it. Binance also offers an anti-phishing code that appears in its genuine emails, though its own guide warns that any email can be spoofed, so treat the code as one signal, not a guarantee.

It also helps to compare the demand with what’s been said publicly:

If a message saysCompare it with
“Claim within 24 hours or lose your refund”Binance says it’s absorbing the loss. We found no claim process in its reported statements.
“Send your code to verify your account”A 2FA code is what phishing is after. Treat any request for it as the warning sign.
“Pay a small fee to release your funds”The FTC says legitimate organisations don’t ask for payment to get you a refund.
“Move your coins to this safe wallet”None of the statements reported so far ask users to do this. A crypto transfer normally can’t be reversed.
“Enter your seed phrase to confirm”A seed phrase is full control of a wallet. No one needs it to help you.

What to Do If You Already Tapped or Typed

Move quickly, and always start from the real app, not the message.

  • You only opened the page. Close it. The main danger comes from what you type, approve or download. If you downloaded a file, don’t open it, and scan your device.
  • You typed your password or a code. Change your password and reset 2FA right away, then check your account’s activity, devices and any API keys. Report anything you don’t recognise through official support, which can disable the account.
  • You approved a wallet request. Move what’s left to a wallet you control and revoke the approval. Many wallets and block explorers can list token approvals.
  • You shared your seed phrase. Treat that wallet as gone. Create a new one and move everything you can immediately.
  • You sent money. Save the messages, wallet addresses and transaction details, then report it. In the US that’s the FBI’s IC3 and the FTC. Our lesson on what to do if you’ve been scammed has the full checklist. Expect recovery offers to follow, and don’t pay any of them.

Frequently Asked Questions

Do I need to claim a refund from Binance?

Based on what Binance had said publicly by 1 November, no. It says it will absorb the loss itself, and we found no claim process in its reported statements. If that ever changes, the place to confirm it is the app or Binance’s official site, reached on your own.

Was my own Binance account hacked?

Binance describes this as a theft from its own hot wallets and has said user funds are safe. We haven’t seen it reported as a break-in to individual customer accounts. It’s still worth checking your activity and security settings in the app, because scammers may try to use the news to get into accounts.

Was customer data leaked?

The reports we read are about wallets, not customer records, and we didn’t find a confirmed leak of customer data as of 1 November. That isn’t proof there wasn’t one, and the cause hasn’t been published. A message that knows your name or email doesn’t make it genuine either, since that information can come from many older breaches.

How do I know if withdrawals are really open?

Check the withdrawal page in the app or Binance’s network status page. Withdrawals are returning in phases, so availability depends on the coin and network. A message can’t tell you anything those pages can’t.

Are the North Korean hackers sending these messages?

We’ve seen no evidence of that. The FBI’s attribution covers the theft itself. Fake refund and support messages are a common follow-up to any big breach, and anyone can send them.

Related Reading

Sources

Scroll to Top