The exchange says it has replaced most of the stolen crypto from its own funds, but customers pulled out $3.6 billion more than they put in after the restart.
Binance began letting customers pull crypto out again on Sunday, less than three days after attackers drained roughly $6.3 billion from the exchange’s hot wallets. Investigators say it is the largest crypto theft on record. Within hours of the restart, customers had withdrawn billions more than they deposited, though the company says volumes settled after an initial spike.
The world’s biggest crypto exchange by trading volume says it has replaced about 95% of the stolen assets with its own money and will not pass the loss on to users. “Binance will absorb the financial impact of the stolen funds, not our users,” the company said in its Nov. 1 recovery update.
How the theft unfolded
Based on insights from blockchain analytics provider TRM Labs, the vast majority of the funds exited Binance-controlled addresses within a roughly 20-minute window commencing at 20:05 UTC on October 29, followed by a subsequent wave roughly three hours later. Across 10 distinct blockchains—such as Bitcoin, Ethereum, Tron, Solana, and the XRP Ledger—the malicious actor transferred these assets. TRM’s analysis estimates the total loot at approximately $6.36 billion based on market values at the exact moment of each transaction. That staggering sum encompasses 18,270 bitcoin alongside over 200,000 ether, dwarfing by about fourfold the $1.5 billion pilfered from competing platform Bybit back in February 2025.
Binance’s initial discoveries suggest a breached laptop owned by a DevOps specialist. The trading platform reported that the intruder leveraged it to access a service container and execute unauthorized withdrawals. Afterward, the company noted that forensics experts uncovered supplementary access vectors, while continuously maintaining that no proof exists of a private key compromise concerning the digital wallets. According to TRM, the malicious actor utilized a pre-authorized delegation mechanism on Ethereum to convert a hot wallet into a sweeper. An exhaustive post-incident assessment has been pledged upon the conclusion of the probe.
| Date (UTC) | Development |
|---|---|
| Oct. 29, 20:05 | Outflows from Binance hot wallets begin |
| Oct. 30 | Binance estimates the impact at roughly $6.3 billion, notes that about $3 billion remains frozen, and suspends withdrawals |
| Oct. 31 | The FBI identifies North Korea’s TraderTraitor; Binance announces that 90% of the losses have been replenished and captures a reserves snapshot |
| Nov. 1, 06:00 | The initial phase of withdrawals is launched; all 15 starting networks become operational by 12:36 |
| Nov. 2 | Binance finalizes its proof of reserves for 10 primary tokens |
Who is being blamed
Investigators, rather than Binance, provided the attribution. TRM indicated that TraderTraitor, a state-sponsored hacking collective from North Korea, executed the assault. The organization stated, “We make this judgment with high confidence.” Jonathan Levin, who serves as the chief executive of Chainalysis, pointed to connections with previous heists, noting that the syndicate stood out as the probable perpetrator.
On Oct. 31, the FBI publicly attributed the theft to North Korea and identified TraderTraitor, the exact syndicate previously implicated in the Bybit breach. According to the bureau, the cybercriminals were swapping illicit tokens for ether in preparation for additional laundering cycles, prompting authorities to urge digital asset platforms to halt any transactions linked to the collective’s wallet addresses.
Frozen funds and the cost of making users whole
About half of the stolen value has been immobilized, mostly because stablecoin issuers can lock tokens on their own networks. Binance reported that approximately $3 billion had been frozen with assistance from blockchain collaborators. Tether noted it locked roughly $1.6 billion in USDT, while Circle restricted over $800 million in USDC, AFP conveyed. TRM’s calculation, which likewise includes freezes carried out by Ripple and World Liberty Financial alongside an intervention by Arbitrum’s Security Council, reached roughly $2.7 billion. Bitcoin and ether cannot be frozen using the same mechanism. When TRM released its assessment, it estimated that about $2.4 billion remained in the hands of the attackers.
Binance’s balance sheet is bearing the weight of covering the remaining deficit. The exchange disclosed that upwards of $6.34 billion in proprietary capital has been allocated. According to an Oct. 31 update, these funds stem from its corporate treasury, a segment of its futures insurance fund, and a partial withdrawal from SAFU, an emergency safety net established back in 2018. Data cited by Cointelegraph indicates that Binance transferred 7,499 bitcoin out of the SAFU wallet on that date, which accounts for roughly half of its reserves there. The firm stated its intention to replenish the pool to approximately $1 billion, though a specific timeline remains undisclosed. The final 5% of the shortfall consists of less liquid digital assets that are currently being acquired through open markets and over-the-counter channels.
Withdrawals come back, and users put the platform to the test
Withdrawals were reactivated incrementally beginning at 06:00 UTC on November 1, with priority given to tokens experiencing the highest demand throughout the preceding week, such as bitcoin, ether, BNB, XRP, and prominent stablecoins. Bloomberg reported that by 12:36 UTC, all 15 networks included in this initial wave were fully operational. Binance indicated that additional cryptocurrencies will be integrated once safety protocols are finalized, although a comprehensive timeline remains unreleased.
Customers moved quickly. Between 06:00 and 15:30 UTC on Sunday, Binance processed about $4.65 billion in withdrawals against $1.01 billion in deposits, for net outflows of $3.64 billion, according to figures the company shared. That equals about 2.1% of the $171 billion in assets Binance said it held on Oct. 28. Third-party trackers such as DefiLlama showed larger 24-hour drops. Binance co-chief executive Yi He said some of those flows were transfers between the exchange’s own wallets.
Regarding its reserves, Binance announced on Monday that cryptographic verification had been finalized for an October 31 snapshot encompassing 10 assets, such as bitcoin, ether, and USDT, with every single one supported at a minimum 1:1 ratio. That particular snapshot occurred prior to Sunday’s withdrawals. An upcoming snapshot featuring additional tokens is scheduled for November 4.
Market reaction
Prices fell as news of the theft spread. Bitcoin and ether dropped nearly 5% and 6% before recovering much of the decline, and Binance’s BNB token briefly fell nearly 10%, AFP reported. By Monday, bitcoin was trading around $77,500 to $78,000, roughly 5% below its level before the attack.
The upcoming challenges involve whether the rest of the networks resume operations punctually, how well the following reserve snapshot withstands the withdrawals, and the proportion of the locked funds that will eventually be recovered. Authorities have not disclosed the amount they anticipate reclaiming.
