Binance reopens more withdrawals after $6.3bn hot-wallet theft

Binance began reopening withdrawals for more assets on November 3, after hackers stole about $6.3 billion from a Binance hot wallet and the exchange suspended withdrawals during its response. The latest rollout adds assets across eight networks, but Binance says each network and asset pair will return only after security checks. Its November 3 recovery update says deposits remain open and that Binance will bear the financial impact of the theft.

The incident is under investigation. Binance’s earlier security update said the initial investigation pointed to a possibly compromised laptop, but later work found additional intrusion points. The company said it had found no evidence that wallet private keys were compromised. It has not yet published a verified technical account of how the attacker moved from access to unauthorized withdrawals.

Which withdrawals are reopening, and how is Binance sequencing them?

Binance is restoring withdrawals progressively, asset by asset, after completing what it calls security and readiness checks. The November 3 phase covers assets on BSC, Ethereum, Solana, XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base. Bitcoin and ether are among the assets listed for BSC and Ethereum, while the announcement says not all listed withdrawals will become available at once.

The distinction matters because a withdrawal depends on both the asset and its network. A token may be listed for reopening on one network while its availability on another is still pending. Binance says it is prioritizing assets based on user demand over the previous week and will add more as they are ready. During the rollout, it warns that traffic may cause delays and tells users to check the withdrawal page or network status page for availability.

This is a staged restoration of withdrawal services, not confirmation that the security investigation is complete. Binance says it will continue strengthening safeguards and that the losses will not be passed on to users. Its earlier update said it had revoked authorizations associated with affected addresses, added security controls and worked with law enforcement, blockchain intelligence firms, asset issuers and industry partners to freeze assets.

What did the halt stop on-chain?

Binance’s announcement describes a hot-wallet theft: the affected wallet was used for unauthorized withdrawals. Hot wallets are online wallets that exchanges use to send assets, so their outbound transfers can be observed on public blockchains. On-chain analytics firm Bitquery’s review of Binance wallets found that payouts on Solana, BNB Chain and TRON stopped within seconds of one another at about 20:36 UTC on October 29. Ethereum payouts ended minutes later.

Bitquery counted 2,248 payouts from Binance hot wallets over the next 54 hours, compared with 1.19 million in the equivalent period a week earlier. That count measures transfers from wallets Bitquery identified as Binance hot wallets; it does not reveal every internal account action or establish the full attack path. The data shows the withdrawal interruption taking effect across several networks, while Binance’s later statement confirms that deposits and other unaffected platform services continued.

How much of the theft has Binance recovered?

Binance said approximately $3 billion in assets had been frozen on-chain by the time of its October 30 update. It also said it had set aside more than $6.34 billion in company funds and was replenishing the stolen assets, including with matching tokens. A freeze can restrict movement of assets at addresses controlled by the attacker, but Binance’s figure does not mean the funds have been returned to the exchange.

The remaining questions are operational and forensic: which intrusion points enabled the withdrawals, how the access controls failed, and whether the frozen assets can be recovered. Binance says it expects to publish a technical post-mortem after its investigation and verification are complete. Until then, the phased reopening confirms that individual withdrawal paths have passed checks; it does not settle the cause or final recovery total.

Sources and documents

• November 3 recovery update — binance.com
• security update — binance.com