Binance Hack: Do You Need to Re-Verify? What the Notices Say About Your KYC Data
2 incident notices, 0 mentions of identity documents, faces, KYC or personal data. The notices cover the losses and who pays for them; a genuine identity update starts only after you log in yourself, and anything else asking for your ID or a selfie needs checking first.
Independent guide · Not affiliated with any platform · Not investment advice
Re-verifying, in Binance’s help centre, goes by the name Update Identity: the account holder logs in, presses a button on the verification page, uploads new documents and waits for the review. Hold that process up against the two notices Binance has published about the hot-wallet theft and the notices give no reason to re-verify. As of 31 October 2026, neither notice asks users to verify again, re-submit documents or claim anything, and no sentence in either refers to users’ identity documents, KYC or personal data.
As for whether your identity data was affected, the notices say neither that it was nor that it was safe. They do not discuss it at all, and we are not going to guess. Everything below reflects the position on 31 October 2026; the incident is still developing, and Binance’s latest official announcement takes precedence.
What the two notices cover, and what they leave out
The first, “Security Incident Update (2026-10-30)”, went out at about 02:23 UTC on 30 October (10:23 Beijing time). On the cause it says:
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.
On the losses: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.” And on where to look for news: “Please rely only on official Binance channels for updates.”
The second, “Security Incident Update #2 (2026-10-30)”, signed by the co-CEOs Yi and Richard, went out at about 19:33 UTC on 30 October, which was already 03:33 on 31 October in Beijing. It fixes the timeline: “At around 2026-10-29 20:05 (UTC), our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets.” That is 04:05 on 30 October, Beijing time. Who pays is stated more bluntly this time:
Binance will absorb the financial impact of these stolen funds, not our users.
The investigation has moved on too: “our subsequent investigation has uncovered additional points of breach.”
On keys, it repeats: “At this stage, we have found no evidence that wallet private keys were leaked.” On services: “Deposits and other unaffected platform services remain operational.”
On withdrawals: “The tech team targets to start resuming the withdrawal service within approximately 34 hours, subject to the completion of security checks. This will proceed on a phased approach.” The proof-of-reserves result is promised by “Monday 2026-11-02”.
When we checked the announcement list at 14:50 Beijing time on 31 October, #2 was still the latest entry. There was no #3 and no notice that withdrawals had resumed, so this page does not say they have.
Read side by side, the notices are silent on three things:
- Identity documents, faces, KYC, personal data: none of these terms appears in either notice. Nothing says they leaked; nothing says they are safe.
- Anything users must do: no request to re-verify, upload documents, register or file a claim.
- An exact time for withdrawals: only “approximately 34 hours”, a phased approach and the security-check condition.
Our reading is that silence here is just silence. It is not evidence you can relax, and it is not a sign you should worry.
Where a real identity update starts
The help page is “How to Update My Verified Identity Information?”, last updated 13 March 2026. It starts in one place only: “Log in to your Binance account and head to this page to start the process.” On the website you then click [Update Identity]; in the app the same button sits under Verifications.
While the update runs, the account is restricted:
upon declaring to update your KYC materials, your account will be restricted to “Withdrawal Only” mode until all of your new information has been submitted and verified.
This is easy to read backwards. The page says you can only withdraw while an update is in progress. Nowhere does it say you must update your identity before you can withdraw.
Email appears once, at the very end: “You will receive an email notification once the system review is complete.” The email reports the result. Our inference from that, which the page itself does not state, is that an email is not where documents get submitted.
The ordinary reasons a platform asks you to submit again are covered in When Verification Comes Back; they have nothing to do with this incident. If, once withdrawals are back, a withdrawal triggers a face scan, that is a separate comparison with your ID photo, explained in Why the Exchange Keeps Asking for Face Verification After KYC.
Checking a message that uses the incident to ask for ID
Notice #1 already gave the general rule: rely only on official Binance channels. In practice, three tools from Binance’s own pages help.
Anti-phishing code. The help article puts it this way: “Once you’ve enabled the anti-phishing code, it will be included in all genuine e-mails and SMS from Binance.” And the reverse: “If the displayed code that you set previously is incorrect or missing, it may be a phishing attempt and should be reported immediately”. It only works if you set the code up beforehand; without one, genuine mail carries no code either. Of the three, this is the one we lean on most, because you are checking for a string rather than judging the tone of a message.
Binance Verify. The official page reads: “Enter a URL, email address, phone number, Telegram, or social media accounts to check if the source is verified and officially from Binance.” It also says: “Binance will never request funds or tokens via private communications.” That sentence is about funds and tokens. It does not mention ID documents, and we are not going to stretch it into “Binance never asks for ID”. If a private message asks for your documents, run the sender through Verify.
Hand doubtful emails to support. “How to Prevent Phishing Attacks” names the pressure tactic directly: “attackers may try to push you into action by creating a sense of urgency. For example, an email might threaten that your account will expire, along with its funds, unless you move all assets to a ‘secure wallet.’ This is a scam”. It adds a caution about its own tool: “even if Binance Verify confirms an email as a ‘Verified Source,’ there’s still a chance that the email contains malicious content (including phishing links).” Its suggestion: “you can download the email as an EML file and send it to Binance Support”.
A different kind of approach comes from people who do not pose as the platform at all but offer to “speed up” verification for you. What happens with those is in What Happens If You Buy a Verified Account or Pay for KYC.
Covering the losses: nothing users are asked to do
Both notices agree on who bears the loss. The first says Binance “will cover all losses from the SAFU fund and the company’s funds”; the second, that Binance will absorb the impact, “not our users”. Neither offers a claim form or a registration step, and neither asks users to submit anything.
So a message saying you must upload ID or record a selfie to “receive compensation” or “migrate your assets” describes a step that neither notice contains. That is our conclusion from comparing the two. To check such a message, use the three tools above and read the latest announcement on Binance’s own site.
Whether to move funds or switch platforms is an investment decision, and this article does not comment on it.
If personal data were exposed, what notice should look like
As a yardstick for what a data-breach notice involves, Article 34 of the EU General Data Protection Regulation says:
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall communicate the personal data breach to the data subject without undue delay.
The same article requires that the communication “shall describe in clear and plain language the nature of the personal data breach”.
Whether this applies to you depends on which entity serves your account and where you live, and we do not assess that here. It is an EU legal requirement, not a promise by Binance to notify anyone in this form. Measured against it, the position on 31 October 2026 is simple: neither notice says anything about personal data.
How long your verification documents are kept and who receives them is covered in Is KYC Safe? How ID Data Leaks and How Long It's Kept; the outside firms that often handle the check itself are in The Vendor Chain Behind an Identity Check.
The cause, the timing, the $6.3B figure, who bears the loss, the private-key statements, the deposit and withdrawal arrangements and the proof-of-reserves date come from Binance’s English announcements “Security Incident Update (2026-10-30)” and “Security Incident Update #2 (2026-10-30)”, read 31 October 2026. The word identity appears once, in Notice #1’s line about working with law enforcement “to confirm the identity of these criminals”; no sentence in either notice refers to users’ identity documents, KYC or personal data.
The Update Identity steps, the Withdrawal Only rule and the email notice are from “How to Update My Verified Identity Information?” (updated 13 March 2026). The anti-phishing code sentences are from Binance’s English help article on the code; the Verify sentences from the Binance Verify page; the urgency example, the Verified Source caution and the EML route from “How to Prevent Phishing Attacks”. All read 31 October 2026.
While writing this we did not log into any account, start an identity update, or receive any of the messages described; everything here was checked against the official pages. Each sentence that is our inference says so where it appears.
Platform pages (read 31 October 2026): incident details from Binance, “Security Incident Update #2 (2026-10-30)”; the update process from “How to Update My Verified Identity Information?”; source checking from Binance Verify. The first notice, the anti-phishing code article and “How to Prevent Phishing Attacks” can be found by title in Binance’s announcements and help centre.
Regulation: GDPR Article 34, read 31 October 2026.
The list of what the notices leave out, and the assessment of “upload ID to get compensated” messages, are this site’s synthesis of those pages and represent no platform’s position.