{"id":"binance-crypto-theft-oct-2026","category":"breach","status":"live","title":"Binance reopens withdrawals in phases after US$6.3 billion crypto theft","tldr":"Binance is expanding withdrawals after a US$6.34 billion theft. It now reports 98% of affected tokens replenished and says it will cover losses. Customers should check their exact asset and network in Binance’s official app or website.","summary":"Attackers stole approximately US$6.34 billion in cryptocurrency from Binance’s online wallets on 29 October, disrupting customer withdrawals. Binance’s initial investigation report describes a months-long campaign involving fake recruitment interviews, malware and misuse of an internal AI tool. It says identified entry points are closed and affected systems rebuilt or replaced. The investigation remains open, with independent review pending. Binance reports approximately US$2.85 billion frozen or intercepted; this is not confirmed recovery. Its 3 November report says 98% of affected tokens were replenished as of 31 October, although its 2 November notice still said 95%; it does not explain the difference. Binance says it will bear the losses and is buying the remaining less-liquid assets. More withdrawals are scheduled to reopen progressively from 3 November, subject to checks for each asset and network. Deposits remain open. Binance has not announced full restoration of withdrawals.","action":"Open Binance’s official app or website directly and check withdrawal availability for your exact asset and network. Follow its official announcements for replenishment and reimbursement updates; Binance warns that withdrawals may take longer during the rollout. Contact Binance Support through the official service if access remains unavailable.","product":"Binance cryptocurrency exchange","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["binance","crypto","theft","withdrawals","north-korea"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Incident Update (2026-10-30)","url":"https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7","by":"Binance","date":"2026-10-30"},{"kind":"advisory","title":"Security Incident Update #2 (2026-10-30)","url":"https://www.binance.com/en-TR/support/announcement/detail/d3306d9dca5243548c813b605e1d1751","by":"Binance","date":"2026-10-30"},{"kind":"advisory","title":"Security Incident | Recovery Update #4: Withdrawals Resume in Phases (2026-11-01)","url":"https://www.binance.com/en-GB/support/announcement/security-incident-recovery-update-4-withdrawals-resume-in-phases-2026-11-01-73911fb819b240f88b88256bdd318eda","by":"Binance","date":"2026-11-01"},{"kind":"post","title":"Binance confirms Bitcoin network withdrawals have reopened","url":"https://x.com/binance/status/2116777408074600621","by":"Binance","date":"2026-11-01"},{"kind":"post","title":"Binance confirms selected Ethereum and BNB Smart Chain withdrawals have resumed","url":"https://www.binance.com/en-ZA/square/post/383502274147124","by":"Binance","date":"2026-11-01"},{"kind":"advisory","title":"North Korea Responsible for $6 Billion+ Binance Attack","url":"https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack","by":"FBI","date":"2026-10-31"},{"kind":"news","title":"Binance links $6.3 billion crypto theft to compromised DevOps laptop","url":"https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/","by":"BleepingComputer","date":"2026-10-30"},{"kind":"news","title":"Binance resumes bitcoin, ether withdrawals after covering bulk of stolen $6.3 billion","url":"https://ca.investing.com/news/stock-market-news/binance-resumes-bitcoin-ether-withdrawals-after-covering-bulk-of-stolen-63-billion-4920047","by":"Reuters","date":"2026-11-01"},{"kind":"news","title":"Binance reopens Bitcoin withdrawals after $6.3B hack, says 95% restored","url":"https://crypto.news/binance-reopens-bitcoin-withdrawals-after-hack/","by":"crypto.news","date":"2026-11-01"},{"kind":"advisory","title":"29 October 2026 Binance Security Incident: Initial Findings and Response Update","url":"https://www.binance.com/en/square/post/384312159834579","by":"Binance","date":"2026-11-03"},{"kind":"advisory","title":"Security Incident | Recovery Update #6: Withdrawals Reopen for More Assets (2026-11-03)","url":"https://www.binance.com/en/support/announcement/detail/2d83c325ab6e49c6bd6c5de8803b11a6","by":"Binance","date":"2026-11-03"},{"kind":"advisory","title":"Security Incident | Recovery Update #5: October 31st PoR Snapshot Now Fully Verifiable by Users as ZK Proof Generated (2026-11-02)","url":"https://www.binance.com/en/support/announcement/detail/185bd9a4717f44088b3be70287b8237f","by":"Binance","date":"2026-11-02"}],"started":"2026-10-29","closed":null,"created":"2026-11-01T11:22:49.309Z","updated":"2026-11-03T18:54:07.992Z","cve_notes":[],"timeline":[{"at":"2026-11-03","added":"2026-11-03T18:54:07.992Z","kind":"vendor-revised","text":"Binance now puts the impact at approximately US$6.34 billion, with US$2.85 billion frozen or intercepted. Its initial report says 98% of affected tokens were replenished as of 31 October, without explaining why its 2 November notice still reported 95%.","url":"https://www.binance.com/en/square/post/384312159834579","by":"Binance","patch":null},{"at":"2026-11-03","added":"2026-11-03T18:54:07.992Z","kind":"vendor-revised","text":"Binance published initial findings describing a campaign involving fake recruitment interviews, malware and misuse of an internal AI tool to reach wallet-signing systems. It says identified entry points are closed and affected systems rebuilt or replaced, but investigation and independent review remain unfinished.","url":"https://www.binance.com/en/square/post/384312159834579","by":"Binance","patch":null},{"at":"2026-11-03","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"Binance scheduled phased withdrawals for additional assets across nine networks from 04:00 UTC on 3 November, including RLUSD on Ethereum and XRP, and USDC on Sui. Availability remains subject to checks for each asset and network; deposits remain open.","url":"https://www.binance.com/en/support/announcement/detail/2d83c325ab6e49c6bd6c5de8803b11a6","by":"Binance","patch":null},{"at":"2026-11-02","added":"2026-11-03T18:54:07.992Z","kind":"other","text":"Binance completed the proof for its 31 October reserves snapshot, allowing customers to verify backing for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It plans a snapshot covering more tokens on 4 November, with the proof expected 40–50 hours later.","url":"https://www.binance.com/en/support/announcement/detail/185bd9a4717f44088b3be70287b8237f","by":"Binance","patch":null},{"at":"2026-11-01","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"Binance also confirmed withdrawals for ETH, USDT and USDC on Ethereum, and BNB, USDT and USDC on BNB Smart Chain. Other withdrawal routes remained subject to security checks.","url":"https://www.binance.com/en-ZA/square/post/383502274147124","by":"Binance","patch":null},{"at":"2026-11-01","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"Binance confirmed that Bitcoin withdrawals on the Bitcoin network had reopened in the first phase.","url":"https://x.com/binance/status/2116777408074600621","by":"Binance","patch":null},{"at":"2026-11-01","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"Binance scheduled phased withdrawals across 15 networks, subject to checks for each asset and network. It said approximately 95% of the affected amount had been replenished, with less-liquid tokens making up the remainder.","url":"https://www.binance.com/en-GB/support/announcement/security-incident-recovery-update-4-withdrawals-resume-in-phases-2026-11-01-73911fb819b240f88b88256bdd318eda","by":"Binance","patch":null},{"at":"2026-10-31","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"The FBI attributed the theft to North Korea’s TraderTraitor actors and said investigators had observed them converting stolen assets.","url":"https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack","by":"FBI","patch":null},{"at":"2026-10-30","added":"2026-11-01T11:22:49.309Z","kind":"vendor-revised","text":"Binance reported additional points of compromise and said the investigation remained open. It had allocated more than US$6.34 billion to cover losses; approximately US$3 billion in stolen assets had been frozen, with recovery still pending.","url":"https://www.binance.com/en-TR/support/announcement/detail/d3306d9dca5243548c813b605e1d1751","by":"Binance","patch":null},{"at":"2026-10-30","added":"2026-11-01T11:22:49.309Z","kind":"disclosed","text":"Binance identified a potentially compromised engineer’s laptop as an initial lead and suspended withdrawals. Its updated notice clarified that deposits remained operational.","url":"https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7","by":"Binance","patch":null},{"at":"2026-10-29T20:05Z","added":"2026-11-01T11:22:49.309Z","kind":"other","text":"Binance says attackers compromised its online wallets and stole cryptocurrency worth approximately US$6.3 billion.","url":"https://www.binance.com/en-TR/support/announcement/detail/d3306d9dca5243548c813b605e1d1751","by":"Binance","patch":"na"}],"url":"https://hard.fyi/live/binance-crypto-theft-oct-2026/","json":"https://hard.fyi/api/live?id=binance-crypto-theft-oct-2026"}