Binance has started restoring withdrawals after hackers stole about $6.3 billion from the exchange on October 29, the largest cryptocurrency theft on record.
Reopening is an important step in the exchange’s recovery.
But the first few hours showed how much confidence users have lost. Binance recorded $3.64 billion in net outflows within nine and a half hours of restoring withdrawals, as customers moved far more money off the platform than they put in.
David Adubiina
What happened at Binance?
On October 29, attackers drained about $6.3 billion in cryptocurrency from Binance’s hot wallets. Blockchain intelligence firm TRM Labs tracked about $6.36 billion moving out of the exchange’s wallets across 10 blockchains, with most of it gone within roughly 20 minutes.
One transfer alone moved 18,270 BTC, worth about $1.47 billion, out of Binance’s Bitcoin hot wallet.
Binance’s initial investigation suggested the attackers got in through a compromised laptop belonging to a DevOps engineer. That gave them access to a service container, which they used to submit unauthorised withdrawals.
The exchange later said it had found additional points of breach, suggesting the attack was more complex than first thought. It also said it had found no evidence that wallet private keys were leaked.
That detail matters. As cybersecurity expert Jayant Dave of Check Point put it: “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign. That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.”
Binance suspended withdrawals while it investigated. It initially said deposits were unaffected, though it later paused deposits on some networks as a precaution.
TRM Labs and Chainalysis both linked the attack to TraderTraitor, a North Korean state-backed hacking group, and the FBI confirmed the attribution on October 31. The same group was behind the roughly $1.5 billion Bybit hack in 2025, which helped make that year the worst on record for crypto theft.
Binance reopens withdrawals, and $3.64 billion walks out
Binance began restoring withdrawals at 06:00 UTC on November 1, starting with 15 networks and assets, including Bitcoin, Ethereum, USDT, USDC, BNB and XRP. All 15 were live by early afternoon. Other networks will follow as they pass security checks, and Binance warned users to expect delays and longer processing times because of heavy traffic.
Then the money started moving.
Between 06:00 and 15:30 UTC, customers withdrew about $4.65 billion and deposited $1.01 billion, CNBC reported. That left $3.64 billion in net outflows, about 2.1% of the $171 billion in assets shown in Binance’s October 28 proof of reserves.
Most of the withdrawals came in the first few hours, and Binance says volumes have since stabilised while deposits remain substantial. Still, the numbers show a clear message from some users: they’d rather hold their funds elsewhere. Restoring withdrawals is one part of Binance’s recovery. Convincing people to keep their money on the exchange is another.
Has Binance replaced the stolen funds?
There’s an important difference between replacing the stolen assets and getting the stolen money back.
Stablecoin issuers and blockchain partners have frozen between $2.7 billion and $3 billion of the stolen assets, depending on the tracker. TRM Labs counts about $2.7 billion, Elliptic about $2.85 billion, and Binance itself about $3 billion. Most of that is USDT and USDC frozen by Tether and Circle. Frozen funds can’t be moved, but they haven’t been returned, and a large share of the stolen crypto is still in the attackers’ hands.
Subscribe for free to continue reading this article
Subscribe SubscribeAlready have an account? Log in
