Binance Covers 95% of Affected Amount and Gradually Resumes Withdrawals After $6 Billion Hack
Key Facts
Binance said on November 1 that it had covered about 95% of the amount affected by the hack, up from 90% in its previous update, and had begun resuming withdrawals in stages. The company had set the start window for the first phase between 06:00 and 09:00 UTC, while keeping deposit services open. Agence France-Presse reported that the first network opened in the first phase was Bitcoin. Binance said reopening withdrawals was an important milestone in the recovery, but did not mark the end of efforts to restore services and strengthen protections. The resumption comes as the exchange continues to cover the remaining share of affected assets.
Binance said balances in Bitcoin, Ether, Tether, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are 100% fully backed. Tokens outside the top 10 assets account for about 5% of the affected amount, according to the company's November 1 update. Binance described these tokens as less liquid, extending the time needed to secure the required quantities. It added that it continues to buy the remaining assets through market channels and over-the-counter trading. As a result, withdrawal availability may vary across assets and networks during the recovery phases.
Reuters reported that Binance had internally allocated about $6.34 billion in company funds to cover losses. Funding for the token repurchases came, according to the news agency, from part of the $1 billion SAFU fund, the futures insurance fund and the company's treasury. The company had said it would restore the SAFU fund to about $1 billion after using part of it. Binance said it would bear the financial impact of the stolen funds and would not pass the losses on to users. It also pledged to publish a report on the incident after the investigation is complete.
In its technical investigation, Binance said its initial review indicated that an engineer's laptop on the DevOps team may have been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. It added that it had found no evidence that private wallet keys had been leaked. The U.S. Federal Bureau of Investigation said North Korea was responsible for stealing more than $6 billion in virtual assets from the exchange, and named the activity "TraderTraitor." The bureau said the stolen assets were converted mainly into Ethereum, and said they were likely later laundered through decentralized finance and instant-swap services. It urged node operators, decentralized finance services and virtual-asset service providers to block transactions linked to addresses used by the activity to launder assets.
Binance said its partners helped identify about $3 billion in affected assets through Friday, October 30. In efforts to freeze funds, the Associated Press reported that Circle froze funds linked to the incident worth more than $800 million in coordination with law enforcement, while Tether's chief executive said his company had frozen more than $1.5 billion. Reuters said the bulk of the theft took place over about 20 minutes starting late Thursday. In a broader context, the news agency cited TRM Labs researchers as saying that attackers stole $2.9 billion in cryptocurrency in about 150 attacks in 2025. Reuters reported that Binance's 2025 annual report cited about 335 million registered users and about $162.8 billion in assets under custody.
Bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000, according to the Associated Press. In a report published by Reuters on October 30, the currency hit a six-week low, falling 3% to $76,469.82, while Ether dropped more than 3% to $2,185.83. Binance said additional networks and assets would be opened when ready, warning of temporary delays or longer processing times because of heavy traffic at the start of the rollout. It said it would continue strengthening protections, completing the recovery and providing progress updates. The company did not set a deadline for making all assets and networks available, and a post-incident report will be issued once the investigation is complete.