Binance sets phased withdrawal reopening after $6.3bn hack

Binance says it is preparing to resume withdrawals in phases on Sunday, three days after attackers took about $6.3 billion in assets from the exchange’s hot wallets in what appears to be crypto’s largest theft by dollar value. The exchange says it has replaced about 95% of the affected assets and will bear the loss, but the reopening plan leaves users waiting for access to some networks while security checks continue.

In its November 1 recovery update, Binance said phase one was planned for 06:00 to 09:00 UTC. The rollout covers major networks including Bitcoin, Ethereum, BNB Chain, Solana and Tron, with other networks and assets to follow after further checks. Binance said deposits remain open and that users may face delays as withdrawals return.

How did attackers reach the wallets?

Binance’s investigation is still underway. The company initially said a DevOps engineer’s compromised laptop may have given an attacker access to a service container and the ability to submit unauthorized withdrawals. It later reported finding additional breach points, while saying it had found no evidence that wallet private keys were leaked.

Reuters, citing blockchain analytics firm TRM Labs, reported that attackers compromised Binance’s transaction-signing infrastructure, which authorizes withdrawals. The bulk of the funds moved in about 20 minutes. That account points to a different security boundary than a stolen private key: an attacker may be able to misuse the system that approves transfers even if the underlying keys are not exposed. Binance has not yet published the technical post-mortem needed to establish the full sequence.

The exchange says affected hot wallets process transactions, while most user assets are held in cold wallets. The distinction limits what this incident says about the whole custody system, but it does not answer how the compromised infrastructure was able to authorize transfers on this scale.

How does the loss compare with earlier crypto thefts?

At roughly $6.3 billion, the reported loss is more than four times the $1.5 billion stolen from Bybit in February 2025, previously described as the largest crypto heist. The comparison is by dollar value; it does not measure the share of each exchange’s assets or the eventual amount recovered.

Binance and its partners say about $3 billion of the stolen assets have been frozen on-chain. That is distinct from replacing the assets: Binance says it has set aside funds to cover the customer shortfall, using its SAFU reserve, corporate treasury and a portion of its futures insurance fund. Its latest update says the remaining 5% consists of less liquid tokens that take longer to source. Frozen assets may still be difficult to return, while replacement from the company’s reserves does not itself recover the stolen coins.

What should users watch next?

The first test is whether Binance restores withdrawals on the announced schedule, and how quickly it adds the networks left out of phase one. The exchange says it will publish a proof-of-reserves update and a technical post-incident report after the investigation. Those disclosures should clarify what controls failed, how user balances are backed across assets, and whether the frozen funds can be recovered.

Attribution also remains unsettled in the company’s account. Blockchain firms have linked the attack to North Korea’s TraderTraitor group; the FBI said Saturday that the same group was responsible and asked crypto businesses to block transactions connected to identified addresses. The FBI said the group was converting stolen assets primarily into ether. Tracking and freezing funds may constrain that process, but neither step guarantees that Binance will recover them.

Source material

• November 1 recovery update — binance.com