Binance Reopens Withdrawals After $6.3 Billion Hack: $4.65 Billion Leaves in the First Nine Hours

Binance began restoring customer withdrawals at 06:00 UTC on Sunday, Nov. 1, and processed $4.65 billion of them by 15:30 UTC, three days after attackers drained an estimated $6.3 billion from the exchange's hot wallets in the largest theft the crypto industry has ever recorded.

"Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026," the exchange said in a status update on X. The first phase covers 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, the XRP Ledger, Tron, Base and Arbitrum. All routes in that phase were live by 12:36 UTC, while other networks remain under testing. Deposits were never interrupted.

The reopening was the real test of the exchange after the Oct. 29 breach. By our calculation, the $4.65 billion in withdrawals against $1.01 billion in deposits left net outflows of about $3.64 billion — roughly 2.1% of the $171 billion in assets shown in Binance's Oct. 28 proof-of-reserves snapshot. That is a heavy day, but far from the kind of run that broke FTX in November 2022, when the exchange could not meet withdrawals at all. The busiest half hour, starting at 08:00 UTC, saw $733 million leave the platform.

The FBI confirms North Korea is behind the theft

On Oct. 31, the FBI attributed the attack to North Korea, linking it to the hacking activity it tracks as TraderTraitor — the same cluster it blamed for the $1.5 billion Bybit theft in February 2025. The bureau said the stolen funds were being converted mainly into ether and asked node operators, exchanges and DeFi services to block the attacker's addresses.

Blockchain analytics firm TRM Labs counted about $6.36 billion leaving Binance-controlled addresses across 10 networks in a burst that began at 20:05 UTC on Oct. 29 and lasted roughly 20 minutes. The haul included 18,270 BTC, about 200,630 ETH, 1.875 billion USDT and 823 million USDC, plus XRP and SOL. Binance's initial findings pointed to a compromised DevOps engineer's laptop that gave the attacker access to a service container used to submit withdrawals; the exchange said it found no evidence that wallet private keys had leaked. At $6.3 billion, the theft is about 4.2 times the size of the Bybit record it replaces.

Binance is paying the bill itself

The exchange says customers will not bear the loss. Binance has replaced about 95% of affected assets using company funds and its Secure Asset Fund for Users (SAFU), up from 90% a day earlier, and says it is sourcing the remaining, less liquid tokens through market and OTC channels. "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed 100%," the company said, citing a reserve snapshot taken at 00:00 UTC on Oct. 31.

Part of the damage may yet be recovered. Stablecoin issuers moved within hours: Tether CEO Paolo Ardoino said the company froze more than $1.57 billion in USDT, and Circle froze over $800 million in USDC, bringing total frozen funds to about $3 billion. The bitcoin and ether, however, cannot be frozen by any issuer, and the hacker has already split some $1.4 billion of BTC across 19 wallets.

Markets have steadied since the initial shock. Bitcoin, which fell 4.8% to below $77,000 on Oct. 29, traded near $77,800 on Sunday, while BNB was around $709 after an 8% drop on the day of the attack. For context on institutional demand, see our Bitcoin & Ether ETF Flows Tracker, and for Binance's other recent changes, our report on the closure of its bitcoin mining pool on Nov. 10.

Two dates to watch: Binance has promised an updated proof-of-reserves report on Nov. 2, and a full post-incident report once its investigation is complete. The pace of withdrawals on Monday, when U.S. and Asian trading desks are back at full strength, will show whether confidence holds.

Related: Bitcoin & Ether ETF Flows Tracker · Binance Is Closing Its Bitcoin Mining Pool · Bank of America Hit With $1.21 Billion in US Penalties · OCC Finalizes GENIUS Act Stablecoin Rules · AI and Crypto Security Audits

Sources: Binance (withdrawal update) · Binance recovery update #4 · FBI · TRM Labs · Tether CEO

This article is for information only and is not investment advice. Figures are preliminary and may change as Binance and investigators publish updates.