Binance has resumed cryptocurrency withdrawals following a hack that stole $6.3 billion, marking the largest cryptocurrency theft on record. The exchange began reopening access on November 1, in stages, after security checks and work to replace the missing assets. Withdrawals had been halted following the October 29 breach of its hot wallets, though deposits and other operations continued during the probe.
The return of withdrawal services triggered significant movement of funds. Customers withdrew $4.65 billion from the exchange within the first nine and a half hours, while deposits reached $1.01 billion. The resulting net outflow of $3.64 billion represented 2.1% of Binance’s total assets under management, according to the company’s figures. Binance warned customers to expect possible delays during the initial stages of the withdrawal resumption.
Security Checks and Asset Replacement
Binance initially restored access across 15 cryptocurrency networks and assets, including Bitcoin, Ethereum, BNB, Solana, and XRP. The company confirmed it would continue restoring other networks as security checks were completed. It also affirmed that approximately 95% of the stolen assets had been replaced, with the remaining 5% consisting of less liquid tokens that require more time to purchase in sufficient quantities.
Read Also: Global Leaders Urge AI-Driven Cyber Threat Collaboration
Binance emphasized that customers would not bear the cost of the incident. “Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds,” the company stated in its November 1 recovery update. It plans to use its corporate resources and the Secure Asset Fund for Users (SAFU) to cover the losses, ensuring customer balances in major cryptocurrencies and stablecoins remain fully backed.
FBI Investigation and North Korean Link
The Federal Bureau of Investigation (FBI) attributed the theft to North Korea, identifying the hacking group TraderTraitor as responsible. In a statement on October 31, the FBI confirmed North Korea’s involvement in stealing over $6 billion from Binance on or around October 29. Investigators noted that the attackers primarily converted the stolen funds into Ethereum, with further laundering attempts expected through decentralized finance platforms and instant swap services.
This theft adds to a series of major cryptocurrency attacks linked to North Korean hackers, who have been accused of using cybercrime to fund their weapons programs. The Binance incident surpasses the $1.5 billion theft from Bybit in February 2025, also attributed to North Korean hackers.
Read Also: Nigeria Boosts Smartphone Security with Stricter Regulations
Ongoing Recovery and Investigation
Binance’s initial investigation suggested a compromised engineer’s laptop might have been involved, but subsequent probes revealed additional breach points. The company found no evidence of leaked wallet private keys and has been reviewing affected systems, strengthening security controls, and collaborating with law enforcement and blockchain intelligence firms. Cryptocurrency issuers and industry partners assisted in tracing and freezing some stolen funds.
Despite the initial surge in withdrawals, Binance reported that withdrawal volumes had begun to stabilize, with substantial deposit activity continuing. The exchange is yet to fully restore all affected withdrawal networks, and its recovery efforts and breach investigation remain ongoing. Binance has pledged to publish a detailed incident report and an updated proof-of-reserves report to enhance transparency for its users.
