Binance began reopening withdrawals in phases on Sunday, November 1, 2026, after hackers drained approximately $6.3 billion from the exchange’s hot wallets in what blockchain intelligence firms described as the largest crypto theft on record.
Binance said in a November 1 support update that phase one of withdrawals would resume between 06:00 and 09:00 UTC. Reuters later reported that bitcoin, ether and some stablecoin withdrawals had resumed, with additional assets expected to follow in phases.
The exchange said deposits remained open and were not affected by the incident. Binance also said it had covered approximately 95% of the impacted amount, up from 90% in its previous update, and that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, according to its proof-of-reserves snapshot.
The remaining 5%, Binance said, consisted of less liquid tokens outside that top group. The exchange said those assets may take longer to source at the required scale through market and over-the-counter channels.
In a November 2 update, Binance said the zero-knowledge proof for its October 31 reserves snapshot was complete, allowing users holding those ten tokens to verify their balances were backed at least one-to-one. The exchange planned its next withdrawal phase for November 3, with details still to come.
Binance has said users will not absorb the loss. It will use a mix of its Secure Asset Fund for Users, part of its Futures insurance fund, and corporate treasury funds to cover the financial impact. It has also committed to replenishing SAFU to approximately $1 billion.
Binance’s early explanation points to signing infrastructure
Binance’s initial incident update on October 30 said the attack may have involved a compromised DevOps engineer’s laptop. According to the exchange, that may have allowed the attacker to access a service container and submit unauthorized withdrawal transactions. Binance said it had found no evidence of wallet private key leaks and would publish a detailed technical post-mortem after its investigation is complete.
Elliptic’s November 1 update reported that Binance had since identified additional breach points and described a complex attack. The exchange had not disclosed those additional points, leaving the full cause unresolved.
TRM Labs said roughly $6.36 billion left Binance wallets across ten blockchains, with most of it moving in about 20 minutes beginning at 20:05 UTC on October 29. Chainalysis put the total closer to $6.4 billion and said funds began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. ET.
TRM’s technical assessment said the attacker used an EIP-7702 delegation on Ethereum to make a Binance hot wallet run attacker-controlled code, while other affected Binance wallets appeared to send funds through ordinary signed transfers. TRM said that points to a compromise of Binance’s hot-wallet signing infrastructure. Binance has not yet confirmed that full technical account.
The FBI attribution raises pressure on laundering routes
The FBI said on October 31 that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. The bureau said it tracks the activity as TraderTraitor and had observed the actors converting stolen assets primarily into Ether.
The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, urged crypto exchanges, DeFi services, blockchain analytics firms, THORNode operators, RPC node operators and instant exchanges to block transactions connected to published TraderTraitor addresses.
The FBI attribution followed earlier assessments from private blockchain intelligence firms. TRM Labs said it attributed the attack to TraderTraitor with high confidence, citing on-chain and off-chain intelligence. Chainalysis said its assessment was strengthened when investigators observed Binance theft proceeds commingling with funds from a recent Bitget exploit attributed to North Korean actors.
The recovery race showed what can and can’t be frozen
Estimates of frozen or secured assets varied as investigators tracked a moving target. Binance said roughly $3 billion had been frozen on-chain in its early update. TRM Labs put the figure near $2.7 billion. Chainalysis said approximately $2.8 billion had been frozen. Elliptic said it had verified $2.85 billion of frozen or seized funds as of its November 1 update.
Those figures differ because the case was changing quickly, and each firm was measuring a different snapshot of on-chain activity. They all point to the same larger pattern: the assets most likely to be frozen were stablecoins and issuer-controlled tokens.
Stablecoin issuers such as Tether and Circle can blacklist specific addresses, stopping those tokens from moving. That is very different from Bitcoin or Ether, where there is no central issuer with a freeze switch. Elliptic said native assets such as Bitcoin, XRP, Solana and NEAR cannot be frozen by an issuer, though they may still be blocked if they reach an exchange, bridge, broker or other service that screens stolen funds.
Frozen assets are not the same as returned assets, but they can be held in place while legal and operational steps continue. Unfrozen assets may keep moving through wallets, bridges, decentralized exchanges and swap services, forcing investigators to follow the trail until funds touch a chokepoint.
For users, the risk is operational as much as financial
Binance’s promise to cover losses gives users an immediate layer of reassurance, but the event still raises harder questions about platform controls. A reserve fund matters after an incident. It does not answer how a compromised endpoint or internal service path can turn into billions of dollars in signed withdrawals.
Binance urged users to rely only on official Binance channels during the incident. Major crypto incidents often create confusion, and confusion gives impersonators room to push fake recovery offers, fake support messages or fake compensation claims.
For businesses that hold or accept crypto, the incident also puts new attention on hot-wallet approval design, employee device security, signing policies, withdrawal limits, chain-specific controls and rehearsed incident response.
What happens next
- Technical cause: Binance has not yet published its full post-incident report. Until that arrives, the compromised-laptop explanation remains preliminary.
- Recoverable funds: Frozen assets still need a legal and operational path back. Unfrozen assets may continue moving through wallets and services for weeks or months.
- Withdrawal stability: Binance has restarted withdrawals in phases, but some assets and networks may return later than others while the exchange completes security checks.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
