The Binance hack withdrawals reopening marks a critical test for the world’s largest cryptocurrency exchange, which began restoring customer withdrawals on Sunday, three days after attackers drained about $6.3 billion from its hot wallets in the largest crypto theft on record.
Binance, which paused withdrawals after the October 29 breach, said it had covered about 90 to 95 percent of the stolen funds using its own reserves and its Secure Asset Fund for Users, known as SAFU, and that users would not bear the loss. The company said it had set aside more than $6.34 billion to cover affected assets.
Bitcoin withdrawals were the first to reopen, followed by major networks including Ethereum, BNB Smart Chain, XRP, and others, in a phased rollout. Binance warned users could face temporary delays because of high volume, and said more assets and networks would open progressively after remaining security checks.
What happened in the Binance hack
According to Binance and blockchain security firms, attackers compromised Binance hot wallets, the internet-connected wallets used for day-to-day customer transactions, and drained roughly $6.3 billion worth of token assets across ten or eleven blockchains in under four hours on October 29.
Binance later linked the breach to an authorisation connected to a Binance hot wallet and to a compromised DevOps laptop and other entry points, according to company statements and security reporting. The company said no private wallet keys were leaked.
The FBI has attributed the theft to North Korea’s TraderTraitor group, a state-linked hacking operation, saying it was responsible for the theft of more than $6 billion in virtual assets from Binance. The theft is about four times the roughly $1.5 billion the same group took from the Bybit exchange in February 2025, making it by far the largest cryptocurrency theft ever recorded.
Blockchain tracing firms including Chainalysis, Elliptic, and TRM Labs put the total stolen at between $6.36 billion and $6.43 billion, slightly above Binance’s own $6.3 billion figure. The FBI said the attackers are now converting stolen funds into Ethereum before moving them through decentralised finance protocols and instant swap services.
How Binance covered the losses
Binance co-chief executives Yi He and Richard Teng said in a recovery update that the company’s hot wallets were compromised, resulting in a loss of approximately $6.3 billion worth of token assets, and that Binance would absorb the financial impact, not its users.
The money came from three places, according to reporting on the recovery: Binance’s own treasury, its SAFU emergency fund, and its Futures Insurance Fund. SAFU, established in 2018 from a cut of trading fees, held 15,000 Bitcoin on Friday, and 7,499 Bitcoin, worth about $584 million, were moved from the fund on Saturday as part of the replenishment. Binance said it would refill SAFU to about $1 billion.
Partners also froze about $3 billion of the stolen funds, according to Binance, including about $1.56 billion in Tether’s USDT stablecoin and about $800 million in Circle’s USDC stablecoin. Freezing stablecoins is possible because their issuers can block addresses, but the attackers have been working around freezes by using automation and decentralised protocols on networks such as Tron, according to Chainalysis.
Binance also published a new Proof of Reserves snapshot taken after the top-up, showing that customer assets for ten major tokens were fully backed. The company said a full zero-knowledge proof would take about 40 to 50 hours to generate, with completion expected by Tuesday, November 3.
Billions leave as withdrawals reopen
The reopening itself became a second headline. Binance said that since November 1, users had withdrawn about $4.6 billion and deposited roughly $1 billion, for net outflows of about $3.6 billion, according to reporting on Monday. Other reports put gross withdrawals at about $4.7 billion over the weekend.
Binance said the outflows, while significant, represented only about 2 percent of its $171 billion in assets, and that the exchange remained able to meet withdrawal demand. The figures illustrate both the scale of customer anxiety after a record breach and the scale of Binance itself: even a multi-billion-dollar outflow is a small fraction of its total holdings.
For the wider crypto market, the incident raises familiar questions. Hot wallets are convenient for fast withdrawals, but they are also the most exposed part of an exchange’s infrastructure. Cold wallets, kept offline, are safer but slower to access. Exchanges must balance speed, cost, and security, and the Binance breach shows how quickly a failure in that balance can become a multi-billion-dollar event.
Binance hack withdrawals: what comes next for users
- Phased reopening: More networks and tokens will reopen as security checks are completed; Binance has not given a date for full restoration.
- Proof of reserves: A full zero-knowledge proof is expected by Tuesday, November 3, allowing users to independently verify backing.
- Less liquid tokens: The remaining 5 to 10 percent of losses involves less liquid tokens that Binance is still acquiring through market and over-the-counter channels.
- Investigations: The FBI investigation and blockchain tracing efforts continue, with about $3 billion already frozen by partners.
Binance has stressed that deposits stayed available throughout the incident, and that users holding the ten fully backed tokens would be able to verify that their assets were backed at a minimum 1:1 ratio once the full proof was generated.
Whether customers return after withdrawing their funds will be the longer test. Crypto exchanges have survived major hacks before, but trust, once shaken, is slow to rebuild. The next few days, as the proof of reserves is published and the remaining networks reopen, will show whether Binance’s rapid replenishment was enough to restore confidence, or whether the record $6.3 billion theft marks a lasting turning point for the exchange and for crypto security standards.