The cryptocurrency exchange says it has replaced 95% of stolen assets and is restoring withdrawal services, while the FBI attributes the unprecedented theft to North Korean hackers.
Binance began restoring cryptocurrency withdrawals on Sunday, November 1, 2026, after hackers stole approximately $6.3 billion in digital assets from the exchange. The company says it has replaced 95% of the stolen funds and will cover the remaining losses rather than passing the financial burden to customers.
The attack occurred on October 29 and forced the world’s largest cryptocurrency exchange to temporarily suspend withdrawals while investigators examined the breach. The FBI has attributed the theft to TraderTraitor, a North Korean state-sponsored hacking operation, raising national security concerns about the use of stolen digital assets to generate revenue for Pyongyang.
Binance is restoring access in stages, beginning with major cryptocurrencies including Bitcoin and Ether. Although services are returning, the investigation continues, and the company has not yet completed replacing every stolen token.
Hackers Steal $6.3 Billion From Binance
Binance said its hot wallets were compromised at approximately 20:05 UTC on October 29. Hot wallets are cryptocurrency storage systems connected to the internet, allowing exchanges to process transactions quickly but also creating potential entry points for attackers.
According to the exchange, its preliminary investigation suggests that hackers gained access through a compromised laptop belonging to a development operations engineer. The attackers allegedly used that access to enter a service container and submit unauthorized withdrawal transactions.
Binance said investigators had found no evidence that private wallet keys were exposed. However, the company acknowledged that the investigation was incomplete and promised to publish a detailed technical report after determining how the intrusion occurred.
The estimated $6.3 billion theft is the largest cryptocurrency exchange hack publicly reported to date. Its scale exceeds the approximately $1.5 billion stolen from Bybit in February 2025, an attack that American authorities also attributed to North Korean hackers.
The exchange immediately revoked affected wallet authorizations and suspended withdrawals while reviewing its security systems. It also contacted law enforcement agencies and blockchain intelligence companies to trace the stolen assets.
By October 30, Binance reported that approximately $3 billion in affected cryptocurrency had been frozen on blockchain networks. Those funds were identified and restricted through cooperation with industry partners, although freezing assets does not necessarily mean the money has been returned.
The company said it was also rebuilding parts of its infrastructure and introducing additional security checks before allowing normal transaction activity to resume.
Binance Replaces 95% of Stolen Assets
Binance has committed to absorbing the financial damage from the theft. Its recovery program draws on emergency reserves, insurance-related funds and corporate assets to replace cryptocurrency removed during the attack.
The exchange initially reported that it had covered approximately 80% of the losses. That figure increased to 90% by October 31 and reached 95% in its November 1 recovery update.
The company said it had allocated more than $6.34 billion to address the incident. Reuters reported that the funds came from several sources, including Binance’s Secure Asset Fund for Users, its Futures Insurance Fund and corporate treasury.
The Secure Asset Fund for Users, commonly called SAFU, was established in July 2018 to protect customers during exceptional events such as security breaches. Binance originally built the reserve by allocating a portion of trading fees to the fund.
The company previously experienced a significant security incident in May 2019, when hackers stole approximately 7,000 Bitcoin. Binance used its emergency fund to cover that loss and maintained that affected customers would not suffer financial damage.
The latest attack is substantially larger and presents a more complicated recovery challenge. Binance must replace several different cryptocurrencies rather than simply reimburse a single type of asset.
According to its October 31 announcement, the exchange had restored full backing for ten major assets: Bitcoin, Ether, Tether, BNB, Solana, USD Coin, XRP, USD1, Ripple USD and Zcash.
The remaining losses involve less-liquid tokens that are more difficult to purchase in large quantities. Binance is acquiring those assets through cryptocurrency markets and private over-the-counter transactions.
Importantly, replacing stolen assets is different from recovering the original cryptocurrency from hackers. Binance is using its financial resources to restore customer backing while investigators separately attempt to identify, freeze and recover the stolen funds.
Withdrawals Resume in Stages
Binance began reopening withdrawal services on Sunday after completing initial security reviews. The first phase included 15 cryptocurrencies, with Bitcoin, Ether, XRP and Dogecoin among the supported assets.
Bitcoin withdrawals resumed shortly after 06:00 UTC, according to Reuters. Access to Ether, BNB and selected stablecoins also returned as the company gradually restored transaction processing.
The phased approach allowed Binance to monitor system performance rather than immediately restart every withdrawal network. Additional cryptocurrencies and networks were scheduled to become available as technical checks were completed.
The suspension created considerable concern among customers who could not immediately transfer their assets to external wallets or other exchanges. Withdrawal restrictions are especially sensitive in cryptocurrency markets because users often rely on rapid transfers during periods of uncertainty.
The reopening produced substantial customer activity. The Financial Times reported that Binance experienced approximately $4.65 billion in withdrawals during the first nine and a half hours after services resumed.
During that period, customers deposited approximately $1.01 billion, creating net outflows of about $3.64 billion. The outflows represented approximately 2.1% of assets held by the exchange before the attack.
Those figures demonstrate that significant amounts of cryptocurrency continued moving through Binance after the suspension ended. However, transaction volume alone does not establish whether customers have regained confidence in the platform.
Binance said it would continue monitoring withdrawals and deposits as more services returned. Customers were advised to rely on official announcements for information about supported assets and possible transaction delays.
FBI Identifies North Korean Hackers
The FBI publicly attributed the attack to North Korea on October 31, identifying the responsible operation as TraderTraitor. The bureau said the theft involved more than $6 billion in virtual assets and took place on or about October 29.
American investigators have previously linked TraderTraitor to cryptocurrency theft operations associated with North Korea. The designation refers to cybercriminal activity that U.S. authorities believe is directed or supported by the North Korean government.
The FBI said investigators had observed the attackers converting stolen cryptocurrency primarily into Ethereum. Authorities expect additional efforts to conceal the origin of the assets through decentralized finance platforms and instant cryptocurrency exchange services.
These transactions can complicate investigations because stolen funds may be divided among numerous digital wallets and moved across different blockchain networks.
The FBI released cryptocurrency addresses believed to be controlled by or closely connected to the attackers. It urged digital asset companies, exchanges and infrastructure operators to block transactions involving those addresses.
The investigation involves cooperation among the FBI, the U.S. Secret Service and the Internal Revenue Service’s Criminal Investigation division. Authorities are seeking to interrupt laundering activity and prevent further movement of the stolen assets.
North Korea has repeatedly denied accusations that it sponsors cryptocurrency theft and other cybercriminal operations. Reuters reported that North Korean diplomatic representatives did not respond to requests for comment concerning the Binance incident.
The American attribution nevertheless represents a significant development because it directly connects the record-breaking theft to an operation already known to federal investigators.
Why Cryptocurrency Theft Raises National Security Concerns
North Korean cyber operations have become a major concern for American financial and intelligence agencies. U.S. officials have long accused Pyongyang of using digital asset theft to obtain funds outside traditional banking channels.
Cryptocurrency creates particular enforcement challenges because transactions can cross international borders without relying on conventional financial intermediaries. Although many blockchain transactions are publicly visible, identifying the people controlling digital wallets can be difficult.
Authorities believe sophisticated hacking groups use complicated laundering techniques to disguise the movement of stolen funds. These methods may involve exchanging assets, transferring money between blockchains and routing transactions through numerous accounts.
In February 2025, the FBI attributed the Bybit cryptocurrency theft to North Korean actors associated with TraderTraitor. That earlier attack demonstrated the ability of state-linked hackers to target major international exchanges.
The Binance incident represents a much larger financial loss from a single reported breach. It also illustrates the potential consequences when attackers gain access to operational systems responsible for authorizing cryptocurrency transfers.
According to blockchain security researchers cited by Reuters, hackers stole approximately $2.9 billion across nearly 150 cryptocurrency attacks during 2025. The Binance theft alone exceeds that combined annual figure.
These comparisons underscore the enormous financial scale of the latest intrusion. They also explain why the investigation extends beyond ordinary corporate cybersecurity and involves federal agencies responsible for financial crime and national security.
Binance Faces Questions About Security and Reserves
The breach has renewed scrutiny of how major cryptocurrency exchanges protect customer assets. Platforms that hold large amounts of digital currency must balance the convenience of rapid transactions with safeguards against unauthorized access.
Binance has promised to strengthen its infrastructure and conduct a comprehensive review of the systems involved in the attack. The company has not yet released the final technical findings needed to determine every point of failure.
It has also published an updated proof-of-reserves snapshot dated October 31. The report is intended to provide information about assets backing customer balances after the company replaced much of the stolen cryptocurrency.
Binance said customers holding the ten major tokens identified in its recovery update would be able to verify their assets were backed at least one-to-one once the required cryptographic proofs were completed.
The company expected that verification process to be available by November 3. Proof-of-reserves information can improve transparency, although it does not replace a comprehensive independent financial audit or establish the effectiveness of internal security controls.
The exchange must now complete its remaining asset purchases while maintaining sufficient reserves and meeting regulatory obligations. Investigators also face the separate challenge of preventing the attackers from laundering billions of dollars in stolen cryptocurrency.
For customers, the immediate priority is the restoration of reliable access to their funds. Binance says it will cover the entire loss, but the final recovery process and technical investigation remain unfinished.
The next major developments will include the return of remaining withdrawal services, completion of the replacement program and publication of the promised security report. Federal investigators are continuing efforts to trace the stolen cryptocurrency and disrupt the North Korean operation accused of carrying out the attack.