Binance Restarts Withdrawals After $6.3 Billion Hack—95% Replaced, Not Recovered

Binance began reopening withdrawals on November 1 after an October 29 security breach that the exchange estimated at about $6.3 billion, turning its immediate crisis response toward restoring customer access. Reuters reported that bitcoin withdrawals had started shortly after 06:00 UTC on Sunday, while Binance's own announcement set out a phased restart across multiple networks. The company said it had covered approximately 95% of the impacted amount through purchases of replacement assets using its own resources. That distinction is central: replenishing balances does not mean investigators have recovered 95% of the cryptocurrency stolen by the attackers. Binance has committed to absorbing the financial impact rather than passing the losses to users, but its restoration programme and investigation remain ongoing.

The first-stage announcement listed 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana and XRP, with specific asset-and-network combinations becoming available progressively. Ethereum withdrawals in that table include ETH, USDT and USDC, while other chains have their own supported combinations. Binance said the order of reopening was based on demand during the preceding week and on security and operational-readiness checks, rather than a blanket switch restoring every token everywhere. It also warned that heavier traffic could cause temporary delays or longer processing times and directed customers to verify the status of their selected asset and network. Deposits remained open according to the exchange, so the withdrawal restart should not be read as confirmation that every service had previously stopped or that every withdrawal route is now available.

The scale of the theft comes from estimates with different valuation conventions, not a single immutable dollar amount. Blockchain intelligence firm TRM Labs traced approximately $6.36 billion across ten blockchains, valuing transfers at the prices prevailing when the assets were taken; it described the event as the largest crypto theft on record. Its analysis, reflecting observations through October 30 at 00:30 UTC, said most of the outflows occurred within roughly 20 minutes beginning at 20:05 UTC on October 29. Binance's initial disclosure put the impact at around $6.3 billion, while TRM noted that changing market prices had already altered the dollar value of the same assets. Those figures describe the stolen portfolio and its valuation, not losses crystallised by every customer or an independently audited measure of Binance's remaining financial resources.

Replacement funding and asset freezing are separate parts of the response. In its November 1 update, Binance said it was buying affected tokens through market and over-the-counter channels, and that the remaining approximately 5% consisted of less-liquid assets that took longer to source at the required scale. Reuters reported that the financing drew on the Secure Asset Fund for Users, the Futures Insurance Fund and the corporate treasury. TRM had separately identified roughly $2.7 billion frozen by stablecoin issuers and network intervention as of its earlier October 30 cutoff, while Binance's later initial-incident update reported about $3 billion frozen. A frozen balance is not necessarily a returned balance, and neither dated freeze estimate should be added to the replacement figure as though the categories were interchangeable or free of overlap.

The attribution also became more specific over the weekend. In an October 31 notice, the FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korea and identified the malicious activity as TraderTraitor. The bureau said it and its partners at the United States Secret Service and IRS Criminal Investigation had observed stolen assets being converted primarily into ETH, with further laundering through decentralised finance and instant-swap services expected. It urged relevant private-sector services to block transactions involving the identified laundering addresses or funds derived from them. That is an official law-enforcement attribution, rather than a court finding; Reuters also reported that North Korea has historically denied state-linked cybertheft and that President Donald Trump expressed uncertainty about its involvement on Saturday.

The technical cause has not yet been settled in a public, completed post-incident report. Binance's October 30 statement said its preliminary investigation suggested a compromised DevOps engineer's laptop had enabled access to a service container and the submission of unauthorised withdrawal transactions, while it had found no evidence of a wallet private-key leak. TRM's separate analysis identified an Ethereum wallet delegation using EIP-7702, a feature that lets a wallet authorise smart-contract behaviour, alongside ordinary signed transfers on other chains. TRM assessed the cross-chain pattern as evidence pointing toward compromised hot-wallet signing infrastructure. These accounts illuminate different parts of the incident but do not justify treating an analyst's infrastructure hypothesis as a confirmed key theft, blaming Ethereum itself for the whole breach, or declaring that all residual security risks have been eliminated.

For exchange customers and institutional counterparties, the episode separates reserve backing from reliable access to funds. Binance said the balances of ten named assets, including BTC, ETH, USDT and USDC, were fully backed and pointed users toward its proof-of-reserves snapshot. That is the company's current representation; a reserve snapshot alone does not establish the completeness of an exchange's liabilities, the effectiveness of its signing controls or uninterrupted withdrawal availability. The difference matters even when an exchange can finance replacement purchases, because customers still depend on operational checks and on liquidity in the particular assets they need. For competing venues, the incident reinforces the relevance of custody design and treasury resilience alongside trading volume, fees and the size of an emergency fund.

The immediate milestone is therefore a controlled reopening, not the end of the recovery process. Binance has said it will publish further incident details once the investigation is complete and will continue sourcing the remaining affected assets. The next useful disclosures will be a completed account of the breach, updates on every outstanding withdrawal route and a clear separation of tokens replaced, assets frozen and funds actually returned. Official service notices are more informative for current availability than a headline percentage, while promised reimbursement should not be confused with an independent guarantee of future safety. As of November 1, the central facts are a phased withdrawal restart, company-funded replenishment reported at approximately 95%, and a record theft whose forensic and financial consequences are still being worked through.