The exchange says it has replaced most of the stolen crypto from its own funds, but customers pulled out $3.6 billion more than they put in after the restart.
Binance began letting customers pull crypto out again on Sunday, less than three days after attackers drained roughly $6.3 billion from the exchange’s hot wallets. Investigators say it is the largest crypto theft on record. Within hours of the restart, customers had withdrawn billions more than they deposited, though the company says volumes settled after an initial spike.
The world’s leading cryptocurrency exchange by trading volume asserts that it has substituted roughly 95% of the pilfered funds using its proprietary capital, ensuring that users will bear no burden from the deficit. “Binance will absorb the financial impact of the stolen funds, not our users,” the company stated within its Nov. 1 recovery update.
How the theft unfolded
According to blockchain intelligence firm TRM Labs, most of the money left Binance-controlled wallets in about 20 minutes starting at 20:05 UTC on Oct. 29, with a second wave about three hours later. The attacker moved funds across 10 blockchains, including Bitcoin, Ethereum, Tron, Solana and the XRP Ledger. TRM’s analysis values the haul at about $6.36 billion at the prices when each transfer happened. That figure includes 18,270 bitcoin and more than 200,000 ether, and it is about four times the $1.5 billion taken from rival Bybit in February 2025.
Binance’s own early findings point to a compromised laptop belonging to a DevOps engineer. The exchange said the attacker used it to reach a service container and submit unauthorized withdrawals. It later said investigators had found additional points of entry, and it has repeatedly said there is no evidence that wallet private keys leaked. TRM says that on Ethereum the attacker used a pre-authorized delegation feature to turn a hot wallet into a sweeper. A full post-incident report has been promised once the investigation ends.
| Date (UTC) | Development |
|---|---|
| Oct. 29, 20:05 | Outflows from Binance hot wallets begin |
| Oct. 30 | Binance puts impact at about $6.3 billion, says about $3 billion is frozen, pauses withdrawals |
| Oct. 31 | FBI names North Korea’s TraderTraitor; Binance reports 90% of losses replenished and takes a reserves snapshot |
| Nov. 1, 06:00 | Phase one of withdrawals opens; all 15 initial networks live by 12:36 |
| Nov. 2 | Binance completes reserve proof for 10 major tokens |
Who is being blamed
Investigators, rather than Binance, provided the attribution. TRM indicated that TraderTraitor, a state-sponsored hacking collective from North Korea, executed the assault. The organization stated, “We make this judgment with high confidence.” Jonathan Levin, who serves as the chief executive of Chainalysis, pointed to connections with previous heists, noting that the syndicate stood out as the probable perpetrator.
On Oct. 31, the FBI publicly attributed the theft to North Korea and identified TraderTraitor, the exact syndicate previously implicated in the Bybit breach. According to the bureau, the cybercriminals were swapping illicit tokens for ether in preparation for additional laundering cycles, prompting authorities to urge digital asset platforms to halt any transactions linked to the collective’s wallet addresses.
Frozen funds and the cost of making users whole
About half of the stolen value has been immobilized, mostly because stablecoin issuers can lock tokens on their own networks. Binance reported that approximately $3 billion had been frozen with assistance from blockchain collaborators. Tether noted it locked roughly $1.6 billion in USDT, while Circle restricted over $800 million in USDC, AFP conveyed. TRM’s calculation, which likewise includes freezes carried out by Ripple and World Liberty Financial alongside an intervention by Arbitrum’s Security Council, reached roughly $2.7 billion. Bitcoin and ether cannot be frozen using the same mechanism. When TRM released its assessment, it estimated that about $2.4 billion remained in the hands of the attackers.
Replenishing the remainder is falling on Binance’s balance sheet. The exchange said it had set aside more than $6.34 billion of company funds. In an Oct. 31 update, it said the money was coming from its corporate treasury, part of its futures insurance fund and a partial draw on SAFU, an emergency reserve created in 2018. Binance moved 7,499 bitcoin out of the SAFU wallet that day, about half its holdings, according to Cointelegraph. The company says it intends to restore the fund to about $1 billion but has not given a date. The last 5% of the losses is in less liquid tokens that it is still buying on the market and through over-the-counter desks.
Withdrawals return, and customers test the exchange
Withdrawals reopened in phases from 06:00 UTC on Nov. 1, starting with assets that saw the most demand in the prior week, including bitcoin, ether, BNB, XRP and major stablecoins. By 12:36 UTC, all 15 networks in the first phase were live, according to Bloomberg. Binance says more assets will follow as security checks are completed, but it has not published a full schedule.
Customers moved quickly. Between 06:00 and 15:30 UTC on Sunday, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits, for net outflows of $3.64 billion, according to figures the company shared. That equals about 2.1% of the $171 billion in assets Binance said it held on Oct. 28. Third-party trackers such as DefiLlama showed larger 24-hour drops. Binance co-chief executive Yi He said some of those flows were transfers between the exchange’s own wallets.
On reserves, Binance said on Monday that cryptographic proof was complete for an Oct. 31 snapshot covering 10 tokens, including bitcoin, ether and USDT, each backed at least 1:1. That snapshot predates Sunday’s outflows. A new snapshot covering more tokens is planned for Nov. 4.
Market reaction
Prices fell as news of the theft spread. Bitcoin and ether dropped nearly 5% and 6% before recovering much of the decline, and Binance’s BNB token briefly fell nearly 10%, AFP reported. By Monday, bitcoin was trading around $77,500 to $78,000, roughly 5% below its level before the attack.
The upcoming challenges involve whether the rest of the networks resume operations punctually, how well the following reserve snapshot withstands the withdrawals, and the proportion of the locked funds that will eventually be recovered. Authorities have not disclosed the amount they anticipate reclaiming.
