Binance is working to restore services and replenish assets after hackers stole approximately $6.3 billion in cryptocurrency from its online wallets on October 29.
The exchange confirmed that unauthorized withdrawals began at around 20:05 UTC. It temporarily suspended withdrawals while investigating the breach and securing affected infrastructure, promising that users would not bear the financial losses.
How did the attack happen?
Binance’s initial investigation suggested that a compromised employee laptop may have played a role. However, an October 30 update said investigators had uncovered additional points of breach and were still establishing the full sequence of events.
The company said it had found no evidence at that stage that wallet private keys had leaked. That statement does not mean the withdrawal systems were secure: attackers had nevertheless managed to initiate unauthorized transfers. A complete technical explanation remained subject to investigation.
Blockchain analytics firm Elliptic estimated the theft at approximately $6.43 billion across 11 blockchains, compared with Binance’s estimate of around $6.3 billion. Its analysis described funds leaving several hot wallets—the internet-connected wallets used to support exchange activity.
Who does the FBI blame?
In an October 31 alert, the FBI attributed the theft to North Korea, identifying the activity as TraderTraitor.
The agency said investigators had observed the attackers converting stolen assets primarily into ether. It warned that further laundering could involve decentralized-finance platforms and instant-swap services, and urged cryptocurrency businesses to block transactions linked to identified addresses.
Attribution and recovery are separate challenges. Identifying an alleged perpetrator does not automatically return the assets.
Will customers lose money?
Binance says it will absorb the financial impact using company resources, including its emergency reserve arrangements.
In its November 2 update, the exchange said approximately 95 percent of the affected amount had been replenished. It described the outstanding portion as less-liquid tokens that take longer to acquire in sufficient quantities. These are Binance’s reported figures.
Replenishment should also be distinguished from recovery: replacing stolen assets with company funds does not mean the original assets have been retrieved from the attackers.
Are withdrawals available again?
Withdrawals began reopening in phases on November 1, according to CoinDesk’s reporting. Availability depended on the asset and network, with further restoration tied to security checks.
On November 2, Binance said it was preparing another withdrawal phase and had completed the verification proof associated with its October 31 reserves snapshot for ten listed tokens. That dated snapshot should not be read as a guarantee about every asset or future platform conditions.
The next tests are completing replenishment, restoring remaining services, and publishing a detailed explanation of how the breach occurred. Binance’s response will be judged by those outcomes as well as its promise to protect customers.
Gold Rebounds After Sharp Selloff as Investors Weigh Rates and Middle East DiplomacyNovember 5, 2026
The Family Transfers Behind a Much Bigger Economic StoryNovember 5, 2026