Binance reopens withdrawals in phases after US$6.3 billion crypto theft
Binance is expanding withdrawals after a US$6.34 billion theft. It now reports 98% of affected tokens replenished and says it will cover losses. Customers should check their exact asset and network in Binance’s official app or website.
Open Binance’s official app or website directly and check withdrawal availability for your exact asset and network. Follow its official announcements for replenishment and reimbursement updates; Binance warns that withdrawals may take longer during the rollout. Contact Binance Support through the official service if access remains unavailable.
What’s happening
Attackers stole approximately US$6.34 billion in cryptocurrency from Binance’s online wallets on 29 October, disrupting customer withdrawals. Binance’s initial investigation report describes a months-long campaign involving fake recruitment interviews, malware and misuse of an internal AI tool. It says identified entry points are closed and affected systems rebuilt or replaced. The investigation remains open, with independent review pending. Binance reports approximately US$2.85 billion frozen or intercepted; this is not confirmed recovery. Its 3 November report says 98% of affected tokens were replenished as of 31 October, although its 2 November notice still said 95%; it does not explain the difference. Binance says it will bear the losses and is buying the remaining less-liquid assets. More withdrawals are scheduled to reopen progressively from 3 November, subject to checks for each asset and network. Deposits remain open. Binance has not announced full restoration of withdrawals.
- What
- Breach
- Affects
- Binance cryptocurrency exchange
- Fixed in
- Nothing to patch
- Since
- 29 Oct 2026
Timeline
- Vendor revised
Binance now puts the impact at approximately US$6.34 billion, with US$2.85 billion frozen or intercepted. Its initial report says 98% of affected tokens were replenished as of 31 October, without explaining why its 2 November notice still reported 95%.
- Vendor revised
Binance published initial findings describing a campaign involving fake recruitment interviews, malware and misuse of an internal AI tool to reach wallet-signing systems. It says identified entry points are closed and affected systems rebuilt or replaced, but investigation and independent review remain unfinished.
- Update
Binance scheduled phased withdrawals for additional assets across nine networks from 04:00 UTC on 3 November, including RLUSD on Ethereum and XRP, and USDC on Sui. Availability remains subject to checks for each asset and network; deposits remain open.
- Update
Binance completed the proof for its 31 October reserves snapshot, allowing customers to verify backing for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. It plans a snapshot covering more tokens on 4 November, with the proof expected 40–50 hours later.
- Update
Binance also confirmed withdrawals for ETH, USDT and USDC on Ethereum, and BNB, USDT and USDC on BNB Smart Chain. Other withdrawal routes remained subject to security checks.
- Update
Binance confirmed that Bitcoin withdrawals on the Bitcoin network had reopened in the first phase.
- Update
Binance scheduled phased withdrawals across 15 networks, subject to checks for each asset and network. It said approximately 95% of the affected amount had been replenished, with less-liquid tokens making up the remainder.
- Update
The FBI attributed the theft to North Korea’s TraderTraitor actors and said investigators had observed them converting stolen assets.
- Vendor revised
Binance reported additional points of compromise and said the investigation remained open. It had allocated more than US$6.34 billion to cover losses; approximately US$3 billion in stolen assets had been frozen, with recovery still pending.
- Made public
Binance identified a potentially compromised engineer’s laptop as an initial lead and suspended withdrawals. Its updated notice clarified that deposits remained operational.
- UpdateNothing to patch
Binance says attackers compromised its online wallets and stole cryptocurrency worth approximately US$6.3 billion.
Sources
- Security Incident Update (2026-10-30)Binance · 30 Oct 2026
- Security Incident Update #2 (2026-10-30)Binance · 30 Oct 2026
- Security Incident | Recovery Update #4: Withdrawals Resume in Phases (2026-11-01)Binance · 1 Nov 2026
- Binance confirms Bitcoin network withdrawals have reopenedBinance · 1 Nov 2026
- Binance confirms selected Ethereum and BNB Smart Chain withdrawals have resumedBinance · 1 Nov 2026
- North Korea Responsible for $6 Billion+ Binance AttackFBI · 31 Oct 2026
- Binance links $6.3 billion crypto theft to compromised DevOps laptopBleepingComputer · 30 Oct 2026
- Binance resumes bitcoin, ether withdrawals after covering bulk of stolen $6.3 billionReuters · 1 Nov 2026
- Binance reopens Bitcoin withdrawals after $6.3B hack, says 95% restoredcrypto.news · 1 Nov 2026
- 29 October 2026 Binance Security Incident: Initial Findings and Response UpdateBinance · 3 Nov 2026
- Security Incident | Recovery Update #6: Withdrawals Reopen for More Assets (2026-11-03)Binance · 3 Nov 2026
- Security Incident | Recovery Update #5: October 31st PoR Snapshot Now Fully Verifiable by Users as ZK Proof Generated (2026-11-02)Binance · 2 Nov 2026