Wallet Safety Checklist After the Binance Withdrawal Incident

Binance reported unauthorized withdrawals on October 30, 2026, and it has been turning withdrawals back on in phases. The reports describe an exchange incident. This checklist is for the wallet you control: phishing during the reopening, token approvals, a hardware wallet, the site in the address bar, and empty token accounts you no longer need.

SolPurge is a separate Solana tool. Closing an empty token account here does not withdraw funds from Binance, and it does not reverse a withdrawal the exchange already sent.

What the reports support

SOLANA·HUB's November 1 weekly recap says that on October 30 Binance wrote of unauthorized withdrawals of about $6.3 billion. Fox Business reported the same Binance estimate: an estimated total impact of approximately $6.3 billion, with about $3 billion already frozen. CNBC also reported an estimated $6.3 billion theft. It said Elliptic counted exactly $6.43 billion stolen, of which about $2.85 billion had been frozen or seized. Those are three published measurements of the same incident. This post uses them only with those attributions.

Fox Business reported Binance's account of the cause while the exchange was still investigating. Binance said a compromised laptop belonging to a DevOps engineer may have allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence that wallet private keys were compromised, and that it would cover the losses. The weekly recap says a later notice the same day named further points of entry besides that laptop, and that withdrawals stayed paused while deposits continued.

Reuters reported that Binance would start reopening more withdrawals at 04:00 GMT on November 3. The list includes assets on Solana, BNB Smart Chain, Ethereum, XRP, and Sui, plus some assets on Arbitrum, Optimism, Tron, and Base. Cointelegraph reported an initial reopening on November 1 and that same second phase, and said deposits remained available.

These reports describe unauthorized withdrawals from Binance. They do not describe a breach of the Solana network, and they do not describe self-custody wallets being emptied by this incident. CNBC, citing Chainalysis, reported that stolen funds were later moved across several chains, including onto Solana. That is a report about where assets were said to travel after they left the exchange.

Phishing while withdrawals reopen

The message that arrives while a withdrawal is pending is the risk most people will actually see. Bitcoin.com, reporting a Binance warning posted on November 2, said scammers may impersonate the exchange in direct messages, emails, group chats, and small transfers that carry a message. The pitches offer to speed up a withdrawal, sell priority processing, help you claim compensation, or move assets into a "Binance vault."

Binance's warning, as reported there and by Cointelegraph, says anyone promising to expedite a withdrawal for a fee is scamming you. Bitcoin.com's account of the warning says Binance rejected these requests:

A first contact from "Binance" about your account or funds
A place in the withdrawal queue, sold to you
A fee to unlock a network or asset
A transfer into a vault, a "safe account," a "secured wallet," or an address an impersonator provides
An eligibility, status, or compensation-claim link
A request for your password, two-factor codes, or seed phrase
A paid asset-recovery service

A request to connect a wallet, sign a transaction, or authorize access is a separate warning in that report. It is not a transfer to an address an impersonator names. Bitcoin.com says those requests can come from a phishing site, and that authorizing one can let a third party move your assets.

The unofficial proof-of-reserves site is not in that rejection list. Bitcoin.com reported it with Binance's reserve check: use the official site, and avoid an unofficial proof-of-reserves website.

If a withdrawal is still pending, check it in the Binance app.

Verify the site before you connect

Type the address yourself, or open a bookmark you saved before this week. A search ad, a reply, or a link inside a token name is a prompt, and the host in the address bar is the check.

For Binance, use the official app or the site you opened yourself. The November 2 warning, as reported by Bitcoin.com, points people to Binance's official verification page when they need to check a channel, account, or website.

For this app, the only official site is www.solpurge.com. The official page and How to Verify the Real Sol Purge list the fee wallet and the instructions a close transaction should contain. Read the host before you connect a wallet. Then read the transaction the wallet shows. Reject it when the destination, the program, or the amount differs from what you expected.

Check token approvals

A Solana token account can have a delegate. Solana's spend permissions docs describe that approval: you keep the tokens, and the delegate can transfer up to the amount you approved. Each token account has one delegate. A new approval replaces the previous one.

Revoke clears the delegate and sets the delegated amount back to zero. On the Token Program, the token account owner signs it. On Token-2022, the current delegate can sign it as well. Revoke a delegate you do not recognize or no longer use. Leave one in place only when you still want that address to spend from that account, and only up to the amount you meant to allow.

The signature is the other half. Binance's warning, reported by Bitcoin.com, says that once you connect, sign, or authorize a request, a third party can move your assets, and that an on-chain transaction is usually irreversible. Close the page if it asks for a seed phrase, a password, or a transfer to an address you did not choose.

A SolPurge close is a close of empty token accounts, which the verification guide spells out: closeAccount instructions, the platform fee transfer, an optional affiliate transfer, and compute-budget instructions. The fee is 6% of the reclaimed rent. With a referral, half of that fee is the affiliate transfer. A token approval is a different instruction. If the prompt is something else, do not sign it.

Use a hardware wallet for funds you hold yourself

A hardware wallet asks you to confirm the transaction on the device. Use that screen for the destination and the action before you approve a transfer from an address you control.

Coins that are still on Binance sit on the exchange until a withdrawal you requested arrives at an address you control. Confirm that destination on the device when you withdraw to an address the device holds. Keep the seed phrase off every website, including pages that claim to recover, verify, or unlock an account. Ledger's seed-phrase glossary describes that phrase as the backup that restores the wallet.

Close empty token accounts you no longer need

This is ordinary wallet maintenance. It runs on token accounts in a wallet you control. It is separate from the Binance withdrawal incident.

A Solana token account holds a rent deposit. Closing it deletes the account and returns the lamports, including that deposit, to the destination you choose. The token balance has to be zero first. Wrapped SOL is the exception in that guide: those accounts can be closed with a balance so the underlying SOL comes back. The same guide says a frozen account with a zero token balance can still be closed. That close does not undo the freeze.

SolPurge closes empty SPL Token and Token-2022 accounts. It does not burn tokens, and it does not close frozen accounts. The app shows that reason and leaves the account out of the close. It takes a 6% service fee on the reclaimed rent. With a referral, half of that fee goes to the affiliate. If a token balance is still above zero, sell or burn it somewhere else, then close the empty account. Some Token-2022 accounts still cannot be closed when fees are withheld or a confidential balance remains. An account whose close authority is held by another wallet cannot be closed from this wallet. The app shows the reason.

Hiding a spam token in the wallet leaves the account open, so the deposit stays locked. Why empty token accounts accumulate and the monthly cleanup checklist cover the rest of that pass.

A short checklist

Ignore messages that offer a faster Binance withdrawal, a queue place, compensation, or a "Binance vault." Check a pending withdrawal in the Binance app.
Open Binance and www.solpurge.com yourself. Use Binance's verification page for a channel you did not open yourself.
Revoke token delegates you do not recognize. Read every signature. Keep the seed phrase off the page.
Confirm self-custody transfers on a hardware wallet. Withdraw exchange balances only to an address that device controls.
Close empty SPL Token and Token-2022 accounts you are finished with. SolPurge does not burn tokens and does not close frozen accounts. It takes a 6% service fee on the reclaimed rent. With a referral, half of that fee goes to the affiliate.

Confirm the site, the signature, and the destination before you approve anything. SolPurge closes empty token accounts. It is not a way to retrieve funds from Binance.