The exchange says it has replaced most of the stolen crypto from its own funds, but customers pulled out $3.6 billion more than they put in after the restart.
On Sunday, Binance resumed cryptocurrency withdrawals, less than 72 hours after hackers looted approximately $6.3 billion from the platform’s hot wallets. According to investigators, this incident stands as the biggest digital currency heist in history. Shortly after services were restored, users pulled out billions more than they deposited, although the firm noted that activity eventually stabilized following an initial surge.
The world’s leading cryptocurrency exchange by trading volume asserts that it has substituted roughly 95% of the pilfered funds using its proprietary capital, ensuring that users will bear no burden from the deficit. “Binance will absorb the financial impact of the stolen funds, not our users,” the company stated within its Nov. 1 recovery update.
How the theft unfolded
Based on insights from blockchain analytics provider TRM Labs, the vast majority of the funds exited Binance-controlled addresses within a roughly 20-minute window commencing at 20:05 UTC on October 29, followed by a subsequent wave roughly three hours later. Across 10 distinct blockchains—such as Bitcoin, Ethereum, Tron, Solana, and the XRP Ledger—the malicious actor transferred these assets. TRM’s analysis estimates the total loot at approximately $6.36 billion based on market values at the exact moment of each transaction. That staggering sum encompasses 18,270 bitcoin alongside over 200,000 ether, dwarfing by about fourfold the $1.5 billion pilfered from competing platform Bybit back in February 2025.
Binance’s initial discoveries suggest a breached laptop owned by a DevOps specialist. The trading platform reported that the intruder leveraged it to access a service container and execute unauthorized withdrawals. Afterward, the company noted that forensics experts uncovered supplementary access vectors, while continuously maintaining that no proof exists of a private key compromise concerning the digital wallets. According to TRM, the malicious actor utilized a pre-authorized delegation mechanism on Ethereum to convert a hot wallet into a sweeper. An exhaustive post-incident assessment has been pledged upon the conclusion of the probe.
| Date (UTC) | Development |
|---|---|
| Oct. 29, 20:05 | Outflows from Binance hot wallets begin |
| Oct. 30 | Binance puts impact at about $6.3 billion, says about $3 billion is frozen, pauses withdrawals |
| Oct. 31 | FBI names North Korea’s TraderTraitor; Binance reports 90% of losses replenished and takes a reserves snapshot |
| Nov. 1, 06:00 | Phase one of withdrawals opens; all 15 initial networks live by 12:36 |
| Nov. 2 | Binance completes reserve proof for 10 major tokens |
Who is being blamed
The attribution comes from investigators, not from Binance. TRM said the attack was carried out by TraderTraitor, a North Korean state hacking unit. “We make this judgment with high confidence,” the firm wrote. Chainalysis chief executive Jonathan Levin said the group was the likely culprit, citing links to earlier thefts.
On Oct. 31, the FBI publicly attributed the theft to North Korea and named TraderTraitor, the same group it blamed for the Bybit hack. The bureau said the hackers were converting stolen tokens into ether ahead of further laundering, and it urged crypto businesses to block transactions tied to the group’s addresses.
Frozen funds and the cost of making users whole
About half of the stolen value has been immobilized, mostly because stablecoin issuers can lock tokens on their own networks. Binance said roughly $3 billion had been frozen with help from blockchain partners. Tether said it froze about $1.6 billion in USDT and Circle more than $800 million in USDC, AFP reported. TRM’s tally, which also counts freezes by Ripple and World Liberty Financial and an intervention by Arbitrum’s Security Council, came to about $2.7 billion. Bitcoin and ether cannot be frozen in the same way. When TRM published its analysis, it estimated that about $2.4 billion was still under the attackers’ control.
Replenishing the remainder is falling on Binance’s balance sheet. The exchange said it had set aside more than $6.34 billion of company funds. In an Oct. 31 update, it said the money was coming from its corporate treasury, part of its futures insurance fund and a partial draw on SAFU, an emergency reserve created in 2018. Binance moved 7,499 bitcoin out of the SAFU wallet that day, about half its holdings, according to Cointelegraph. The company says it intends to restore the fund to about $1 billion but has not given a date. The last 5% of the losses is in less liquid tokens that it is still buying on the market and through over-the-counter desks.
Withdrawals come back, and users put the platform to the test
Withdrawals reopened in phases from 06:00 UTC on Nov. 1, starting with assets that saw the most demand in the prior week, including bitcoin, ether, BNB, XRP and major stablecoins. By 12:36 UTC, all 15 networks in the first phase were live, according to Bloomberg. Binance says more assets will follow as security checks are completed, but it has not published a full schedule.
Customers moved quickly. Between 06:00 and 15:30 UTC on Sunday, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits, for net outflows of $3.64 billion, according to figures the company shared. That equals about 2.1% of the $171 billion in assets Binance said it held on Oct. 28. Third-party trackers such as DefiLlama showed larger 24-hour drops. Binance co-chief executive Yi He said some of those flows were transfers between the exchange’s own wallets.
Regarding its reserves, Binance announced on Monday that cryptographic verification had been finalized for an October 31 snapshot encompassing 10 assets, such as bitcoin, ether, and USDT, with every single one supported at a minimum 1:1 ratio. That particular snapshot occurred prior to Sunday’s withdrawals. An upcoming snapshot featuring additional tokens is scheduled for November 4.
Market reaction
Prices fell as news of the theft spread. Bitcoin and ether dropped nearly 5% and 6% before recovering much of the decline, and Binance’s BNB token briefly fell nearly 10%, AFP reported. By Monday, bitcoin was trading around $77,500 to $78,000, roughly 5% below its level before the attack.
The tests ahead are whether the remaining networks reopen on time, whether the next reserve snapshot holds up after the outflows, and how much of the frozen money is eventually returned. Law enforcement has not said how much it expects to recover.
