Binance Resumes Withdrawals After $6.3B Hack, Says 95% of Stolen Assets Now Covered

Binance, the world’s largest cryptocurrency exchange by trading volume, has reopened withdrawals, three days after attackers drained about $6.3 billion from its hot wallets in the largest crypto theft on record. The exchange is reopening networks in stages. It started with Bitcoin on Sunday, November 1, and says it has now replaced about 95% of the stolen assets with company money.

Phase One Withdrawals Begin With Bitcoin

In its Security Incident Recovery Update #4, posted on X early on November 1, Binance said phase one would begin between 06:00 and 09:00 Coordinated Universal Time (UTC), which is 11:30 to 14:30 Indian Standard Time (IST). The exchange said it would reopen networks and assets one at a time after security and stability checks. It chose the order based on user withdrawal demand over the past week.

Binance later confirmed on X that the Bitcoin network was the first to reopen. Withdrawals of ETH, Tether (USDT) and USD Coin (USDC) on Ethereum followed, along with BNB, USDT and USDC on BNB Smart Chain.

Recovery Update #4 lists 15 networks for phase one:

Binance said it will add more networks and assets once they pass the same checks. It also warned that heavy traffic in the first hours could cause some withdrawals to be delayed or fail, and asked users to try again later. The exchange has not given a date for restoring every remaining asset.

The restart comes later than the roughly 45-hour window Binance gave on October 30, which pointed to about 05:47 UTC on November 1, as The Crypto Times reported. It also confirms that services are coming back in stages rather than all at once.

Binance Raises Coverage to 95% of Affected Assets

Recovery Update #4 says Binance has now covered “approximately 95% of the impacted amount,” up from 90% in its previous update on October 31. Coverage stood at about 80% on October 30. By then, co-CEO Richard Teng had said the exchange set aside more than $6.34 billion and already held about $5 billion of it in the same tokens that were stolen, as reported earlier.

The remaining 5% is made up of less liquid tokens outside the top ten affected assets, which take longer to buy. On a $6.3 billion base, that gap works out to roughly $315 million, based on Binance’s own percentages. Binance says ten assets are now fully backed on a 1:1 basis: Bitcoin (BTC), Ether (ETH), USDT, BNB, Solana (SOL), USDC, XRP, USD1, Ripple USD (RLUSD) and Zcash (ZEC). Users can check these against the exchange’s Proof of Reserves page. Proof of Reserves is a published snapshot that compares customer balances with the assets the exchange holds on-chain.

According to Binance, the money comes from three places. The first is its Secure Asset Fund for Users (SAFU), an emergency reserve created to repay customers after security breaches. The second is part of its Futures Insurance Fund, and the third is its corporate treasury. Binance is also buying the missing tokens through public markets and over-the-counter (OTC) deals, which are large trades made directly between two parties instead of on an open order book. The Crypto Times earlier reported on Binance’s OTC buybacks, including a deposit of 128.63 million ENA from a wallet linked to Ethena.

Covering a loss is different from recovering it. The 95% figure means Binance has restored backing for customer balances with its own capital. It does not mean 95% of the stolen funds have come back from the attacker. Reuters reported that SAFU holds about $1 billion, mostly in Bitcoin, and that Binance reported about $162.8 billion in assets under custody in its 2025 annual report. Measured against that custody base, the $6.3 billion loss is about 3.9%.

How the $6.3 Billion Hack Unfolded

According to blockchain intelligence firm TRM Labs, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains on October 29, most of it within about 20 minutes starting at 20:05 UTC. Binance’s own estimate is about $6.3 billion. The affected chains were Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. TRM counted 18,270 BTC among the stolen assets, worth about $1.47 billion when it published, as well as 233.46 million XRP.

On Ethereum, TRM said the attacker used EIP-7702 to turn a Binance hot wallet into a “sweeper” it controlled, using 50 authorizations it had signed in advance. EIP-7702 is an Ethereum Improvement Proposal, added in the 2025 Pectra network upgrade, that lets a regular wallet temporarily hand control to smart contract code. A hot wallet is an exchange wallet that stays connected to the internet so it can process withdrawals quickly.

Binance first pointed to a compromised DevOps engineer’s laptop. It later said investigators had found additional points of breach. The exchange says it has found no evidence that any wallet private keys were leaked. A full breakdown of the attack is available in the Crypto Times Binance hack explainer.

Binance suspended deposits and withdrawals at about 22:15 UTC on October 29. It restored deposits on October 30 while withdrawals stayed paused.

FBI Attributes the Attack to North Korea

On October 31, the Federal Bureau of Investigation (FBI) said that the Democratic People’s Republic of Korea (DPRK), or North Korea, was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29. The FBI calls this activity “TraderTraitor.” It said the attackers were converting stolen assets mainly into ETH. Working with the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), the bureau asked THORChain node operators, decentralized finance (DeFi) services and other crypto businesses to block transactions linked to the addresses it published.

The FBI used the same label in February 2025, when it attributed the roughly $1.5 billion Bybit hack to North Korea. That was the previous record. The Binance theft is about four times larger. The Crypto Times compared the two attacks side by side. Binance itself has not publicly named the attackers. It says it is working with law enforcement to confirm who they are.

About $3 Billion Remains Frozen

Binance says about $3 billion of the affected assets is frozen on-chain. Most of that is in stablecoins, which are tokens pegged to the U.S. dollar. Issuers including Tether, Circle, Ripple and World Liberty Financial can freeze stablecoins at the contract level. Some analysts had put the frozen total closer to $2.7 billion, The Crypto Times reported.

Bitcoin and Ether cannot be frozen this way, so most of the unfrozen funds are in those two assets. Chainalysis has said an emergency pause on the cross-chain protocol THORChain interrupted part of the laundering flow.

What Comes Next

Three items are still open. Binance has not said when every network will reopen. It has not yet published the full zero-knowledge Proof of Reserves report, which would let users cryptographically confirm that their balances are included without exposing personal data. The technical post-mortem it promised will come once its investigation ends.

Regulators are also paying attention. Commodity Futures Trading Commission (CFTC) Chair Michael Selig has cited the breach in calling for federal registration of crypto exchanges.

The next test is how smoothly the remaining networks reopen and whether Binance closes the last 5% gap.

Also Read: What the $6.3B Binance Hack Means for Indian Crypto Investors