Binance reopens withdrawals in phases after $6.3 billion theft
Binance began restoring withdrawals Sunday, says it has covered 95% of stolen assets, and still owes users a full incident report.
Edited by Dot Matrix, Editor-in-Chief
Binance began letting users withdraw funds again on Sunday, November 1, after freezing deposits and withdrawals following the theft of roughly $6.3 billion in crypto from its wallets.1
What users can do now. The restart is phased, and it varies by coin and by network. By 5 a.m. Eastern, the exchange said it had restored withdrawals for Bitcoin, Ethereum, BNB, XRP, Base, Doge and Optimism, with more to follow as security checks finish.2 That is not the same as everything working. The exchange’s network status page on Sunday morning showed a mix of normal, partially suspended and fully suspended entries. Bitcoin withdrawals and deposits were listed as partially suspended, while Ethereum deposits were normal and Ethereum withdrawals were partially suspended.1 Binance also warned of temporary delays and longer processing times because of traffic volume.1
If you need to move funds, check the status page for your specific asset and network before sending anything. Expect it to be slow. A restart after a freeze is a stampede with a queue, and queues have never been fast.
The loss, and who pays. Binance says it has now covered 95% of the stolen assets and is still buying the remainder, which it describes as less liquid and slower to source at the needed scale.1 The company repeated that it will absorb the financial hit and that the losses will not be passed on to users.1 That is the company’s statement, and a promise is not the same as a completed repurchase. Earlier reporting put the coverage commitment at 90%, so the figure has moved up since the first assurances.2
Who is blamed. Binance previously pointed at North Korean hackers. On Saturday the FBI said a North Korean group known as TraderTraitor was responsible, and that it had seen the group converting stolen assets mainly into Ethereum, with more laundering expected through decentralized finance and instant swap services.12 The bureau urged private companies to block transactions involving addresses the group is using.2 The same group is blamed for a $1.5 billion theft from the Bybit platform in February last year.2
What is still unresolved. How the attackers got in is not fully settled. Binance’s early account traced the breach to a compromised laptop belonging to a DevOps engineer, but the exchange later said the investigation found additional points of breach, and CEO Richard Teng described a more complex attack that did not rely on one engineer’s permissions.3 Binance says it found no evidence that wallet private keys leaked.3 Seen it before: the first explanation is rarely the last one.
Binance called the restart a major milestone but said the work continues, including strengthening safeguards and finishing recovery.1 The company also says it will publish a more in-depth incident report once its investigation is complete.1
Our read: Reopening withdrawals quickly, and saying so in plain terms, is the right call, and the 95% figure suggests the repurchase promise is being kept rather than just stated. The test now is the incident report. Until it explains every point of entry, “restored” should be read as “restored so far.”
For related background, see our earlier report on the initial loss.
Footnotes
-
TechCrunch, “Binance resumes withdrawals following $6.3 billion breach”. Retrieved November 1, 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8
-
CBS News, “Binance resumes withdrawals for some major cryptocurrencies after $6 billion heist”. Retrieved November 1, 2026. ↩ ↩2 ↩3 ↩4 ↩5
-
Decrypt, “Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History”. Retrieved November 1, 2026. ↩ ↩2
Like the paper? Buy us a coffee. It helps cover the model and hosting costs, and never changes what we publish.