Binance reopens withdrawals in phases after October hack; 98% of funds replenished

Binance has reopened withdrawals in phases since 1 November, three days after a security incident on 29 October that the exchange puts at about $6.3 billion, and says about 98% of the affected amount has now been replenished from its own funds. Withdrawals for Hyperliquid (HYPE) and Aptos (APT) came back on 8 November, two of six tokens Binance had aimed to restore by the end of next week. Some assets are still waiting, and Binance has not said when every withdrawal route will be open again.

What happened

On the evening of 29 October, large amounts of crypto moved from Binance hot wallets, the internet-connected wallets used for day-to-day transfers, to new addresses. Changpeng Zhao, the founder who no longer runs the company but remains its largest shareholder, said it looked like a hack, and Binance then confirmed to TechCrunch that it was dealing with a security incident and investigating reports of a potential security issue.

A Binance spokesperson told TechCrunch that withdrawals were temporarily suspended on multiple networks as a precaution, and later updates from Binance said all deposits and withdrawals were temporarily suspended while the company carried out security checks, froze funds, and worked with law enforcement.

Early estimates of the scale moved a lot, and they should not be read as a confirmed loss total. TechCrunch reported that crypto watchers said at least $2bn had been drained, while some estimates put the figure upwards of $5.7bn, with the numbers unconfirmed and the theft possibly still ongoing at the time of reporting, because investigators were still separating unauthorised transfers from other movements.

Binance's first account, on 30 October, pointed to a possibly compromised laptop belonging to a DevOps engineer. Its initial findings report on 3 November describes a longer chain instead. In June, an engineer installed a tampered installer for an AI coding tool. In September, a second engineer was approached on a legitimate job platform, went through video interviews with a fake recruiter and a fake chief executive, and downloaded a coding assignment that carried malware the device's security tools did not flag. On 20 October, the attackers used that computer and an internal AI tool to reach two wallet engineers' computers and find a container deployment token. On 29 October, between 17:15 and 19:56, the attacker logged on to a colleague's computer, deployed a container and ran a malicious script. Unauthorised withdrawals began at 20:05 UTC, and the incident was contained by 00:10 UTC on 30 October. Binance says the attackers also exploited Ethereum's EIP-7702 mechanism to gain execution rights over a hot wallet. The FBI attributed the theft to North Korea's TraderTraitor group on 31 October, and North Korea has denied involvement. Binance calls these findings initial, and says it has commissioned an independent cybersecurity review. No final post-mortem has been published.

What has changed since 30 October

Deposits came back on 30 October. By 31 October, Binance said it had covered about 90% of the affected amount and that holdings of ten tokens were fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It took a proof-of-reserves snapshot at 00:00 UTC on 31 October.

Withdrawals started returning on 1 November, in phases. The first phase ran between 06:00 and 09:00 UTC and covered 15 networks, with all of them live by 12:36 UTC. Binance said about 95% of the affected amount was covered by then. In the first nine and a half hours, users withdrew $4.649 billion and deposited $1.01 billion, a net outflow of about $3.64 billion, which Binance puts at 2.1% of its assets under management.

On 2 November, Binance said the full zero-knowledge proof for the 31 October snapshot was complete, so holders of the ten fully backed tokens can check for themselves that their balances are backed at least 1:1. A proof of reserves is a snapshot at one moment, not a full audit of the exchange.

More assets followed in three further batches: over 100 asset-network pairs across nine networks from 04:00 UTC on 3 November, then 69 pairs covering 62 tokens across six networks on 5 November, then 58 pairs across nine networks on 6 November. Counting the four published lists, withdrawals had been scheduled to reopen for 259 token-network pairs covering 151 tokens. Each pair opens only after its own security and readiness checks, so a token appearing on a list does not mean it is available at once.

On 4 November, Binance said about 98% of the affected amount had been replenished, and it took a new proof-of-reserves snapshot at 00:00 UTC covering 44 tokens, up from 10. The full zero-knowledge proof for that snapshot was expected to take 50 to 60 hours to generate, and by 6 November Binance said it was ready, so holders of those 44 tokens can check their own balances too.

On 6 November, Binance also named six tokens it was working to reopen by the end of next week: HYPE, INJ, APT, PLASMA, NEAR and LTC. On 8 November, the first two came back: HYPE and APT withdrawals were re-enabled. The other four had not been restored at that point.

This recovery is separate from Binance's planned closure of accounts in France, Spain, Italy and Poland on 31 December 2026, which is a licensing matter, not part of the security incident.

What Binance says about user funds

Binance says user funds are safe, and that it will cover all losses using funds from its SAFU fund and the company. It has set aside more than 100% of the funds needed from its own resources, and says the losses will not be passed on to users. It has also said it will rebuild its SAFU emergency fund to about $1 billion after drawing on it.

Its 30 October update put the estimated total impact at about $6.3bn, with about $3bn frozen on-chain so far in work with blockchain partners. Binance later put the affected total at about $6.34bn, and said about $2.85bn had been frozen or intercepted. Blockchain analytics firm Elliptic puts the theft higher, at $6.43bn, and estimates that $2.85bn of it, 44%, is frozen or seized, while about $3.11bn remains in addresses linked to the theft, mostly in ETH and bitcoin, with little if any turned into cash so far. Those are Elliptic's estimates, not Binance's figures.

Freezing assets does not by itself settle the final loss figure. Binance has said it will publish a detailed technical post-mortem after the investigation is complete and the facts are verified, and an updated proof of reserves after remediation is complete.

Binance also warned users to be cautious of scams and to trust only its official channels, not unofficial links, messages, or requests for account information. That warning matters in general terms after a widely reported incident, because fake support messages and phishing links tend to circulate while users wait for an update. On 8 November, Binance co-founder Yi He added a warning against sending the exchange funds tied to flagged addresses, such as discounted USDT bought from a stranger, saying law enforcement can freeze those deposits and Binance cannot lift the freeze.

What is still unknown

The cause is not finally confirmed, and Binance has not named an attacker beyond the FBI's attribution, or said whether it received any correspondence from the hackers. The final loss figure is also not settled: the $6.3bn figure is Binance's estimated impact, the $2.85bn figure is the amount frozen or intercepted so far, and neither is the same as a final audited loss.

Al Jazeera reported that the price of Bitcoin fell about 5% after the incident, dropping below $77,000. At about $6.3 billion, the incident is the largest crypto exchange theft on record, above the roughly $1.5 billion taken from Bybit in 2025.

Not every withdrawal route is back. Binance has not given a date for full restoration, and the remaining assets reopen only as each one passes its checks. INJ, PLASMA, NEAR and LTC were still waiting on 8 November, after HYPE and APT returned. Until Binance publishes its final post-mortem, the full account of how the attackers got in remains its own initial findings, not an independently verified record.

Last verified 9 November 2026.