Binance starts phased withdrawal reopening after $6.3B hack

Binance said it would begin restoring withdrawals in phases on Nov. 1, after a security breach moved about $6.3 billion in assets from its wallets and forced a precautionary withdrawal suspension. The exchange’s recovery update set the first phase for 06:00–09:00 UTC, subject to security and readiness checks. Binance described the restriction as a withdrawal pause; the update does not say that trading was halted.

The breach affected wallets across multiple networks. Blockchain intelligence firm TRM Labs estimates that about $6.36 billion moved to attacker-controlled addresses across ten blockchains on Oct. 29, with most of the transfers occurring in roughly 20 minutes from 20:05 UTC. TRM attributes the attack to TraderTraitor, a North Korean hacking group. Binance says it has found no evidence that wallet private keys were leaked, and has not yet published a root-cause report.

Which withdrawals are in Binance’s first reopening phase?

The first phase covers selected assets on 15 networks, including BTC on Bitcoin; ETH, USDT and USDC on Ethereum; and BNB, USDT and USDC on BNB Smart Chain. Binance says it will restore each network and asset pair progressively after completing checks, prioritising them using user-demand data from the previous week.

The staged rollout matters because restoring withdrawal access requires the exchange to validate the affected services and monitor them as they return. Binance warned that users could encounter delays or longer processing times as traffic comes back. It said deposits remained open during the withdrawal suspension. Additional assets and networks are to follow once they are ready.

How did the attacker move funds from Binance wallets?

TRM’s analysis identifies a different mechanism on Ethereum from the ordinary signed transfers it observed on the other nine affected chains. On Ethereum, the attacker used EIP-7702 authorizations to delegate a Binance hot wallet’s behavior to a sweeper contract. A hot wallet is connected to the internet and used to process customer withdrawals.

According to TRM’s technical account, the attacker prepared 50 authorizations for consecutive wallet nonces, then submitted them together. Because a wallet’s nonce advances with transactions, preparing a sequence increased the chance that one authorization would still match when executed. One did. The contract allowed the operator to direct the wallet to transfer assets to an attacker-controlled address; the delegation also let the attacker sweep funds that later arrived in that wallet.

TRM says wallets on the other chains sent funds through standard signed transfers. Since those transfers used different chains and signing schemes, TRM assesses that the incident likely involved access to Binance’s hot-wallet signing infrastructure. That remains an investigator’s assessment, not a confirmed Binance root cause. Binance’s initial update pointed to a potentially compromised DevOps engineer’s laptop and access to a service container, but its subsequent update said investigators had found additional points of breach.

How much of the stolen value has been recovered or replaced?

Binance says it will absorb the losses through its Secure Asset Fund for Users and corporate funds. Its Nov. 1 update said it had covered about 95% of the impacted amount, with the remaining 5% consisting of less liquid tokens that take longer to source. It also said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were fully backed.

That replenishment is separate from recovering the stolen tokens. Binance says it is working with law enforcement and industry partners to trace and recover assets. TRM reported that issuers and network operators had frozen roughly $2.7 billion on-chain by Oct. 30, while some stolen assets had moved into cryptocurrencies that issuers cannot freeze. The phased withdrawal reopening restores access to selected networks; it does not resolve the investigation or establish how the attacker obtained signing access.

Sources and documents

• recovery update — binance.com
• TRM’s technical account — trmlabs.com