Binance sets phased withdrawal restart after $6.3bn hack

Binance said it would begin restoring withdrawals in phases on Sunday, two days after a breach of its hot wallets caused an estimated $6.3 billion in losses. The exchange’s Nov. 1 recovery update says deposits remained open and unaffected platform services stayed operational during the suspension. The disruption was to withdrawals; Binance did not say it halted trading.

The scale sets this incident apart from the previous record. The Associated Press reported that blockchain firm TRM Labs attributed the attack to North Korea’s TraderTraitor unit, while Binance said its investigation had found additional breach points beyond an initial suspected compromised laptop. TRM put the amount moved from Binance wallets at about $6.36 billion across ten blockchains, largely within 20 minutes. The AP’s account of the breach compares it with the $1.5 billion Bybit hack in 2025; Binance’s loss is larger in dollar terms, though founder Changpeng Zhao said other incidents affected more bitcoin.

What is reopening, and what remains restricted?

Binance said phase one would make withdrawals available progressively across 15 networks, including Bitcoin, Ethereum, BNB Chain, Tron and Solana. On Ethereum, the listed assets include ETH, USDT and USDC; on Bitcoin, BTC. The company said it would restore further networks and assets after security and readiness checks, prioritising pairs according to user demand over the previous week. Users could face delays during the initial rollout.

This is a narrower intervention than a full exchange shutdown. Binance said deposits and other unaffected services remained operational, while withdrawals were paused to contain the incident, assess affected systems and validate their integrity. That kept users able to access some platform functions, but left them unable to move assets off the exchange during the review. For traders working across venues, that can limit how quickly they reposition capital even if trading continues.

Does replacement of the lost assets mean they are recovered?

No. Binance said it had covered about 95% of the affected amount by buying or setting aside replacement tokens, with the remaining 5% made up of less-liquid assets that could take longer to source. That is distinct from recovering the stolen coins: the company said about $3 billion had been frozen on-chain, and that recovery efforts with law enforcement and industry partners were continuing.

Binance says it will absorb the losses through its Secure Asset Fund for Users, a portion of its futures insurance fund and corporate funds. Its Oct. 31 update said major assets including BTC, ETH, USDT, BNB and USDC were fully backed, and that the futures fund remained above its required coverage level. The approach offers a way to protect user balances quickly, while drawing on reserves designed for other forms of platform risk. Binance has promised to replenish SAFU to about $1 billion.

Which signals will show whether the response is holding?

The next tests are the pace and reliability of withdrawal restoration, confirmation that all affected assets are backed, and the eventual technical post-incident report. Binance said it would publish that report once its investigation is complete. The report will matter because the company has not yet explained the full attack sequence, and its initial theory of a compromised laptop has widened to include additional breach points.

Asset freezes and replacement funds can limit immediate losses, but they do not establish how access was obtained or whether the same weaknesses remain elsewhere. The withdrawal schedule, completion of the replenishment, and verified findings on the breach are the concrete measures to watch.

Source material

• Nov. 1 recovery update — binance.com
• AP’s account of the breach — apnews.com