Binance hack: an API key and trade-history checklist for bot traders

On 29 October 2026 Binance paused withdrawals on several networks after what it called a security incident, and attackers took roughly $6.3 billion in crypto from its hot wallets. Binance says it will absorb the loss, not its users, and withdrawals began reopening on 1 November. No report we have read says that user API keys were part of the breach, but if you run a trading bot on Binance this is a good week to check what your keys can do.

This post is accurate as of 3 November 2026. Binance says its investigation is ongoing, so some details may change.

What happened

According to TechCrunch (29 October 2026), Binance said it had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure". Early estimates of the loss varied widely while funds were still moving.

By 31 October CNBC put the theft at about $6.3 billion in tokens taken from Binance's hot wallets, which would make it the largest crypto hack on record. Blockchain analytics firms give similar figures: TRM Labs put it at about $6.36 billion moved across ten blockchains, and Chainalysis at about $6.4 billion, according to Decrypt (30 October 2026).

Both firms linked the attack to TraderTraitor, a North Korean hacking group. On the evening of 31 October the FBI said North Korea was responsible, CNBC reported. Binance first said the attack may have involved a compromised DevOps engineer's laptop; co-CEO Richard Teng later said it was more complex than one engineer's permissions being misused. Binance has not published a full account of how the attackers got in.

Covered is not the same as recovered

Binance says it has covered up to 90% of the stolen assets, and that its ten largest assets, including BTC, ETH, USDT, BNB, SOL and USDC, are "fully backed 100%". As CNBC points out, that does not mean 90% of the funds have been recovered from the attackers. Binance is replacing them from its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury, and says it will keep buying the less liquid remaining tokens until coverage reaches 100%.

Withdrawals resumed on Sunday 1 November in stages, starting with the Bitcoin network, followed by Ethereum and BNB Smart Chain, according to CNBC.

Is Binance safe?

Nobody outside Binance can answer that yet, and we won't pretend to. What is on the record: the stolen funds came from Binance's own hot wallets, Binance says users will not bear the loss, and it has published no finding that customer accounts or API keys were accessed. Whether you keep money on any exchange is your call. What you can control is how much access your own keys grant, and whether your trading records exist anywhere other than the exchange.

The API key checklist

Most bot traders created their Binance keys once and haven't looked at them since. Work through these in API Management (profile icon, then Account, then API Management on the web, per Binance's API key FAQ).

• Audit every key's permissions and turn withdrawals off. A trading bot needs to read and to trade, never to withdraw. Binance's FAQ says it "strongly recommend[s] against enabling API keys for permissions other than reading" without IP restrictions, and an IP restriction is mandatory before withdrawal permission can be enabled at all. Delete any key you no longer recognise or use.
• Restrict keys by IP. Binance's API security tips recommend an IP whitelist on all API keys, whatever their permissions. If your bot runs on a server with a fixed IP, restrict its key to that address. Binance also deletes keys that have no IP whitelist and have been inactive for 30 days, according to the same post.
• Use separate keys for trading and for reading. The same Binance post recommends one key per application with only the permissions it needs. Give the bot a trade-only, IP-restricted key, and give journals, tax tools and analytics a separate read-only key. If one leaks, you revoke that one key and nothing else breaks.
• Rotate your keys. Binance's tips say to check active keys on the API Management page, rotate them periodically, and change them immediately if you suspect a compromise. Rotating means creating a new key with the same restrictions, updating the bot, then deleting the old key. Keep secrets out of your code repository and plain-text files.
• Export your trade history. Your records shouldn't depend on one exchange being online. On the web, Binance's spot trade history export guide says to go to Orders, then Spot Order, then Trade History, then Export Trade History, choose a date range and click Generate. Each statement covers up to one year, you can generate five a month, and the download link expires after seven days, so save the CSV straight away. For deposits, withdrawals and other wallet movements, use Assets, then Asset History, then Export Transaction Records, as described in Binance's transaction history guide.

What it means for algo and systematic traders

A withdrawal pause doesn't stop your bot trading, but it does show how much of your operation sits on one venue: the account, the keys, the bot's only record of what it did. An exported trade history is the one part you can keep yourself, and it is also what you need to judge whether the bot is working at all.

You can analyse that history with a read-only key. Tessera's Binance connection guide asks for an API key that can read spot trade history, says "Tessera only needs trade history access", and says not to enable withdrawals unless you need them elsewhere. The API sync covers a recent window; for a full history, upload the Spot Trade History CSV you exported above. See all supported brokers and platforms.

Once the fills are in, the free Entry Analysis report breaks your bot's results down by session, weekday, time of day and volatility, so you can see where it makes and loses money. No card is needed.