- Binance Covers 95.00% of Assets Lost in US$6.3 Billion Cyberattack
Binance has begun restoring cryptocurrency withdrawals after a cyberattack resulted in the theft of approximately US$6.3 billion in digital assets from the exchange’s hot wallets.
The company started the first phase of the restoration process on November 1, 2026, following several days of security reviews, system upgrades and efforts to replace the stolen assets.
Withdrawals were scheduled to resume progressively between 6:00 am and 9:00 am UTC, with access initially restored for major cryptocurrencies and blockchain networks.
Bitcoin, Ether, BNB, Solana, XRP, Dogecoin and several stablecoins were among the assets included in the first phase. The restoration also covered withdrawals through networks such as Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, Polygon, Arbitrum, Base, Optimism and Avalanche.
Binance said services for other assets and networks would be restored only after they passed additional stability and security checks.
“We are taking a controlled approach to do so safely,” the exchange said. “We will continue to monitor closely as services return in phases.”
Customers may experience delays or longer processing times during the initial reopening because of elevated transaction volumes. Binance advised users whose withdrawal requests fail to wait briefly before trying again.
The attack occurred at about 8:05 pm UTC on October 29, when unauthorised transactions were initiated from Binance’s internet-connected hot wallets.
Hot wallets are cryptocurrency storage systems connected to the internet to facilitate regular deposits and withdrawals. While they provide greater convenience than offline storage, their connectivity can make them more vulnerable to cyberattacks.
Binance initially estimated the value of the stolen tokens at about US$6.3 billion, making the incident potentially the largest digital-asset theft recorded.
The loss substantially exceeded the approximately US$1.5 billion stolen from cryptocurrency exchange Bybit in February 2025.
Binance suspended withdrawals after detecting the unauthorised transactions but left deposit services operational.
The exchange said the suspension was necessary to contain the breach, determine its scope, inspect its withdrawal infrastructure and prevent further unauthorised activity.
During the shutdown, its technical and security teams revoked compromised authorisations, introduced additional controls and worked with blockchain analytics companies, law enforcement agencies, token issuers and other exchanges to trace the stolen assets.
Approximately US$3 billion of the stolen funds had been frozen on blockchain networks by October 30, according to an earlier company update.
Binance said it had set aside more than US$6.34 billion from its Secure Asset Fund for Users and corporate treasury to protect customers from losses.
The exchange initially replaced about 80.00% of the affected assets, raising the coverage level to 90.00% before reaching approximately 95.00% by the time withdrawals began reopening.
Bitcoin, Ether, Tether’s USDT, BNB, Solana, Circle’s USDC, XRP, USD1, RLUSD and Zcash balances are now fully backed, according to the company.
The remaining 5.00% consists mainly of less-liquid tokens that are more difficult to purchase in the volumes required. Binance said it was continuing to acquire those assets through market purchases and over-the-counter transactions.
“As we have said throughout this incident, user funds remain safe,” Binance said. “Binance will absorb the financial impact of the stolen funds, not our users.”
The United States Federal Bureau of Investigation has attributed the attack to TraderTraitor, a North Korean state-sponsored cyber group that has previously been linked to large cryptocurrency thefts.
Blockchain investigators observed the attackers converting some of the stolen assets into Ether and expect further efforts to launder the funds through decentralised financial platforms and other cryptocurrency services.
North Korea has consistently denied operating state-linked cyber groups for espionage, theft or revenue generation.
Binance’s investigation initially considered the possibility that a compromised employee laptop had enabled access to part of its infrastructure. Subsequent analysis identified additional points of entry, although the exchange said it had found no evidence that wallet private keys were exposed.
The company has promised to publish a detailed post-incident report after completing its investigation. The report is expected to explain the sequence of the attack, contributing security failures and measures introduced to prevent a recurrence.
Binance said the resumption schedule was developed using withdrawal-demand data from the previous week, allowing the most frequently requested tokens and networks to be prioritised.
The first phase covered Bitcoin withdrawals and Ethereum-based withdrawals involving Ether, USDT and USDC. BNB, USDT and USDC withdrawals were also restored through BNB Smart Chain.
Other services included Tron and USDT withdrawals through the Tron network, along with Solana, XRP, Dogecoin, Toncoin, Polygon, Avalanche, Arbitrum and Sui transactions.
Although the restoration is an important step, the attack raises significant questions about security controls at centralised cryptocurrency exchanges.
Binance’s ability to replace the stolen assets demonstrates the financial resources available to the world’s largest cryptocurrency exchange. However, the scale of the loss also exposes the risks created when large volumes of customer assets are held in internet-connected wallets.
The incident could lead regulators to demand stricter custody controls, stronger internal authorisation systems and more frequent independent verification of exchange reserves.
Binance said it would produce an updated proof-of-reserves snapshot to allow users to verify that customer balances remain fully backed.
“Resuming withdrawals is a major milestone, but our work continues,” the exchange said.
The success of the phased reopening will now depend on whether Binance’s systems remain stable under heavy customer demand and whether the company can complete replacement of the remaining affected tokens without causing market disruption.
