Binance Gradually Resumes Withdrawals After $6.3 Billion Asset Hack

Key Facts

Binance said its hot wallets were hacked at about 20:05 UTC on October 29, 2026, resulting in the loss of an estimated $6.3 billion in tokenized assets. The exchange set a window from 06:00 to 09:00 UTC on November 1 to begin the first phase of withdrawal resumption. It said service would return in stages, with other assets and networks added as they became ready. In its November 1 update, it said it had secured about 95% of affected assets, up from 90% in its previous update. Withdrawals resumed as Bitcoin had closed at $78,354 on November 1, according to EL7 data.

Binance said in a October 30 update that it had allocated more than $6.34 billion in company funds to cover losses, including $5 billion in the affected tokens themselves, such as USDC, USDT, BTC, ETH and BNB. It said those amounts covered about 80% of affected assets in that update. It also said its partners had worked with law enforcement, blockchain intelligence firms and asset issuers to trace and freeze funds. About $3 billion in on-chain assets had been frozen as of the October 30 update. Binance said the remaining 5% in its November 1 update consisted of tokens outside the top ten assets it had listed, and that their lower liquidity made securing the required amounts slower.

The first phase of withdrawal resumption covered 15 tokens, including Bitcoin, Ether, Dogecoin and some stablecoins, USDC and USDT, according to Reuters. Binance said additional assets and networks would be made available as they became ready, and withdrawals would resume progressively. The exchange had said deposits and other unaffected services remained operational during the temporary suspension of withdrawals for security reviews and to address affected systems. The company described the resumption of withdrawals as an important milestone in its response, but said the work was not over. It added that it would continue securing the remaining assets and strengthening security measures, and publish a review of the incident after the investigation was complete.

Binance said its initial investigation pointed to the possible involvement of a compromised laptop, but a subsequent investigation uncovered additional intrusion points. In its October 30 update, it added: "At this stage, we have found no evidence of a leak of the wallets' private keys." The U.S. Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets to North Korea and identified the specific cyber activity as TraderTraitor. The bureau said it had observed the stolen assets being converted primarily to Ethereum. It added that the assets are expected to be laundered later through conversions using decentralized finance and instant-swap services. The attribution puts the flow of funds and the ongoing investigation among the issues Binance said it would address in its review of the incident.

The Associated Press reported that Bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000. EL7 data showed it closing at $78,354 on November 1, then at $78,140.64 on November 2. The agency said Tether had frozen the equivalent of more than $1.5 billion linked to the possible incident, while Circle said it had frozen more than $800 million in coordination with law enforcement. These figures differ from the roughly $3 billion Binance said had been frozen on-chain as of its October 30 update, as they are separate statements from different entities. Reuters reported that Binance said on October 28 that it had $171 billion in assets under management and 335 million registered users worldwide.

According to Reuters, Binance customers withdrew $3.64 billion, or 2.1% of the exchange's assets, when it resumed operations on November 1. The company said withdrawals had begun to stabilize after the initial surge, while deposit volumes remained high. Reuters, citing researchers at TRM Labs, reported that cryptocurrency thefts totaled $2.9 billion across about 150 incidents during the previous year. These figures place the Binance hack within a broader wave of thefts, as the exchange works to secure the remaining less-liquid tokens. Binance said the resumption of withdrawals did not conclude its response and that a review of the incident would be published after the investigation was complete.