EL7.AI
CryptoMedium•2 November 2026•
4 min read

Binance Gradually Resumes Withdrawals After Theft Estimated to Have an Impact of $6.3 Billion

Key Facts

1Binance estimated the incident’s impact at about $6.3 billion.
2Coverage of affected assets reached about 95%, with 5% remaining uncovered.
3The FBI said North Korea was responsible for stealing more than $6 billion from Binance.
4Net outflows from the platform totaled $3.64 billion during the monitoring period after reopening.

Binance began resuming withdrawals on November 1 after suspending them following a security incident that the company said had an estimated impact of about $6.3 billion. It said the first phase would begin between 06:00 and 09:00 UTC, with services gradually restored after security and readiness checks. CoinDesk reported that withdrawals began at 06:00 and that the fifteen assets and networks listed in the first phase were available by 12:36. The platform said deposits remained available while withdrawals were suspended. Reopening the service restores access to assets, while the flows following the resumption put the platform’s ability to handle customer requests under scrutiny.

The first phase included multiple assets and networks, including BTC, ETH, BSC, TRX, SOL and XRP, with the remaining assets and networks to be made available in turn as they were ready. Binance said it set priorities based on user-demand data from the week before reopening. The company warned that processing could be delayed by heavy traffic. In an update published by Binance Japan on November 2, it said withdrawals of BTC, ETH, BNB, XRP, SOL, TRX, DOGE and SUI had fully resumed in its services there. It added that withdrawals of AVAX, GRAM and ARB had partially resumed, while other assets had not yet returned, and availability varied by network.

Binance said in its update that coverage of affected assets had risen to about 95%, compared with 90% in the previous update, and that the remaining 5% comprised less liquid tokens outside the top ten assets, which take longer to make available in the required volume. It announced that balances of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully covered at 100%. The company had raised coverage from 80% to 90% in an October 31 update, according to its statement. It also said preparing the full proof of reserves takes about 40 to 50 hours because of the computational load, and that the updated reserves snapshot was dated midnight UTC on October 31. The company pledged to absorb the financial impact of the stolen funds, saying the losses would not be passed on to users.

In a separate estimate, TRM Labs said transfers from Binance wallets totaled about $6.36 billion across ten networks on October 29, with most occurring over about 20 minutes starting at 20:05 UTC. Binance estimated the total impact at about $6.3 billion and said it had frozen about $3 billion on-chain as of its October 30 update. The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, and named the activity “TraderTraitor.” Binance said its preliminary investigation indicated that a laptop belonging to an engineer on the DevOps team had been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The company added that it had found no evidence of private wallet keys being leaked.

CoinDesk reported that Binance said it processed $4.649 billion in withdrawals against $1.01 billion in deposits during the first monitoring period after reopening, for net outflows of $3.64 billion. According to Reuters, net outflows represented 2.1% of the platform’s assets, according to the company. Binance said withdrawal volumes fell after the initial surge and became more stable, with deposits of nearly $1 billion and withdrawals of about $4.6 billion on Sunday. Reuters compared the flows with nearly $7 billion withdrawn from USD Coin over a week during the 2023 Silicon Valley Bank crisis, and about $6 billion withdrawn from FTX over 72 hours in 2022. Bitcoin recovered some of its losses over the weekend to trade above $78,000 on Monday, while Ether rose from its two-month low.

Yi He, Binance’s co-chief executive, said the company’s priority was to secure the trading environment before enabling withdrawals and resuming operations. The company said it would continue working with law enforcement and industry partners to track and recover the funds. It also pledged to publish a report on the incident after the investigation was complete, without specifying when it would be released. The resumption of withdrawals remains tied to the readiness of assets and networks, under the phased reopening mechanism announced by the platform. In its update on Binance Japan services, the company said it had not identified any impact on its Japanese customers’ assets at that time.