Binance reopens crypto withdrawals in phases after $6.3B theft

Binance began restoring withdrawals in phases on November 1, four days after unauthorized transactions drained about $6.3 billion in token assets from its hot wallets. The exchange says it has replenished roughly 95% of the affected amount and will bear the financial loss. In its withdrawal recovery update, Binance said it would reopen networks and assets as security and readiness checks were completed.

The outage followed an incident Binance says began around 20:05 UTC on October 29. The company’s second update described the event as unauthorized withdrawals from compromised hot wallets. Its initial investigation pointed to a DevOps engineer’s compromised laptop, which may have enabled access to a service container and submission of withdrawal transactions. Binance later said investigators had found additional points of breach. It has reported no evidence that wallet private keys were leaked, and has not yet published its full technical account.

Which withdrawal routes are coming back first?

Binance is restoring access by network and asset pair, rather than reopening all withdrawals at once. The first phase covers major networks including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, Arbitrum and Optimism, alongside selected assets on each. Binance says it prioritized assets using user-demand data from the previous week, and will add other routes after their security checks are complete.

The staged rollout makes withdrawal availability specific to each network and token. Binance warned that traffic could cause temporary delays or longer processing times, and directed users to check the withdrawal page or network status page for whether a particular route is available. Deposits remained open during the suspension and were not affected, the exchange said.

How is Binance covering the stolen assets?

Binance says it will use its Secure Asset Fund for Users (SAFU) and corporate funds to cover the loss. In the November 1 update, it said it had replenished about 95% of the impacted amount. The remaining 5% consisted of tokens outside its top ten affected assets, which Binance described as less liquid and slower to source at the required scale. It said it was buying those assets through market and over-the-counter channels.

The exchange also reported that blockchain partners had frozen about $3 billion on-chain. That is a recovery effort separate from Binance’s stated plan to replace the stolen token balances: freezing assets may prevent their movement, while replenishment restores the exchange’s holdings. Binance has not said that all frozen funds have been returned.

What remains unknown about the breach?

The full attack path remains under investigation. Binance’s initial account connected the suspected laptop compromise to a service container used to submit unauthorized withdrawals, but its later disclosure of additional breach points means that account is incomplete. The company says it is working with law enforcement, blockchain intelligence firms, token issuers and other industry partners to trace funds. It has promised a post-incident report after the investigation concludes.

The Associated Press reported that blockchain firms attributed the attack to North Korea-linked TraderTraitor, while Binance said it was still working with law enforcement to identify those responsible. Attribution remains a third-party assessment, not a conclusion Binance has confirmed. For now, the exchange’s published updates establish the loss, the staged return of withdrawals and its coverage plan, but leave the intrusion sequence unresolved.

Sources and documents

• withdrawal recovery update — binance.com