Binance Resumes Withdrawals After $6.3 Billion Hack

Binance resumed customer withdrawals following a $6.3 billion security breach on October 29, 2026, after covering a large portion of the stolen funds.

Binance Resumes Withdrawals After $6.3 Billion Hack

Cryptocurrency exchange Binance faced a security breach on or about October 29, 2026, resulting in the theft of digital assets valued at about $6.3 billion. While the exchange enacted a week-long freeze on customer withdrawals to contain losses and run security checks, the incident triggered dueling narratives between corporate assurances, federal attribution, and outside skepticism over how the massive loss was managed.

Binance co-CEO Richard Teng stated, Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users. The exchange reported covering about 95% of the stolen amount by November 1, up from 90% in an earlier update, using its corporate treasury, a portion of the Futures Insurance Fund, and the Secure Asset Fund for Users, known as SAFU. Yet, skepticism remains over the mechanics of such recovery. Some industry commentators argue that a loss of this scale lacks fully corroborated public documentation of transaction hashes and wallet addresses, raising questions about how coverage is defined across on-chain recovery versus internal balance-sheet replenishment.

What Led to the $6.3 Billion Security Breach?

The breach unfolded rapidly on October 29, 2026, when an estimated $6.3 billion in virtual assets was transferred from Binance wallets across ten blockchain networks, with most withdrawals occurring within roughly 20 minutes. Blockchain intelligence firm TRM Labs attributed the attack to TraderTraitor, an elite North Korean hacking group, stating it made the judgment with high confidence based on robust on-chain and off-chain intelligence. Singapore-based Pangolin Intelligence also pointed to North Korean hackers.

Video: Binance to resume withdrawals after covering bulk of stolen $6.3 billion — Khaleej Times (YouTube)

On October 31, the FBI officially released information advising that the Democratic People's Republic of Korea was responsible for the theft. The agency observed TraderTraitor actors converting stolen assets primarily into Ethereum and warned that funds would be laundered further through decentralized finance platforms and instant swap services. President Donald Trump cast doubt on the official attribution, telling reporters, We don't know if it's North Korea, while adding, I'm not concerned. We're learning about it.

How Did the Phased Resumption of Withdrawals Unfold?

Following the October 29 suspension, Binance began reopening its withdrawal infrastructure on November 1. The phased rollout involved stability checks, prioritization based on user demand, and coordination with law enforcement and industry partners.

On November 1 at 06:00 UTC, Binance began resuming withdrawals in phases.
By 10:30 a.m. ET, the exchange had processed around $4.6 billion in withdrawals and $1 billion in deposits.
By 12:36 UTC, Binance confirmed that withdrawals on all networks and 15 initial digital currencies had resumed.
Subsequent updates saw expanded withdrawal services for DOGE on its native network, alongside ETH, USDT, and USDC on Optimism, following earlier resumptions across BTC, ETH, BSC, XRP, and Base.

Binance warned users to expect temporary delays or longer processing times during the initial rollout due to heavy traffic volume. Net outflows stabilized at about $3.64 billion, equal to 2.1% of the exchange's publicly reported assets under management.

Who Gains and Who Loses as Laundering Efforts Continue?

While Binance works to restore remaining services and test systems, the hackers are actively laundering the stolen capital across different blockchain networks. On-chain tracking platform Lookonchain reported that the attacker began converting nearly $96 million worth of stolen Solana into Bitcoin. Specifically, a transfer of 486,970 SOL valued at $46.4 million was moved toward Bitcoin via cross-chain service Relay Protocol, followed by a larger stash of 970,522 SOL worth approximately $95.9 million.

This cross-chain activity complicates recovery efforts. While centralized stablecoins can be frozen at the token contract level, Bitcoin relies on a public blockchain without a central authority capable of freezing funds, though its transparent ledger allows analytics firms to trace movements. Meanwhile, Binance reported that approximately $3 billion in affected assets had been frozen on-chain through cooperation with industry participants, law enforcement, and asset issuers.

Recovery and Coverage Metric	Reported Figure / Status	Source Attribution
Total Estimated Stolen Assets	About $6.3 billion	Newscord, Indiablooms, Brave New Coin
Asset Coverage Percentage	Approximately 95% covered (up from 90%)	Newscord, Indiablooms
Net Outflows Recorded	$3.64 billion (2.1% of assets under management)	Newscord
Frozen On-Chain Assets	Approximately $3 billion	Newscord, Brave New Coin
Stolen Solana Conversion Pool	970,522 SOL (approx. $95.9 million)	Brave New Coin (Lookonchain)

What Should Users Do Next?

For everyday cryptocurrency holders and exchange customers, the episode serves as a stark reminder of custodial risk. Security analysts advise users to review account activity, change passwords, enable hardware-based two-factor authentication, revoke unfamiliar API keys, and confirm that withdrawal settings remain unaltered. Customers should rely strictly on official Binance announcements and verifiable blockchain data rather than unverified social media claims, remaining vigilant against scammers seeking to exploit the crisis through fake recovery services.

Binance stated it will publish a more in-depth incident report once its internal investigation is fully complete.