Binance is working to restore access to withdrawals after hackers stole approximately $6.3 billion from the exchange on October 29. The FBI has attributed the theft to North Korea, while Binance says it will cover the losses using its own resources. For customers, the immediate question is whether they can access their assets. The larger question is how attackers gained enough control over the exchange’s systems to move billions across multiple blockchains.

The answer is still developing. Binance’s latest November 2 update gives users a way to verify backing for ten major tokens, while the company continues replacing other affected assets. Its complete technical explanation of the breach remains outstanding in the updates reviewed for this article.

What happened in the Binance hack?

The attack targeted Binance’s hot wallets, the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs’ transaction analysis, approximately $6.36 billion left Binance wallets across ten blockchains, with most of the theft occurring within about 20 minutes beginning at 4:05 p.m. New York time on October 29.

TRM describes it as the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025. Binance subsequently paused withdrawals while investigating and securing affected infrastructure.

A hot-wallet breach concerns assets held under the exchange’s control. Customers can therefore face withdrawal restrictions even when their individual account passwords remain secure. The exchange’s custody systems sit between the balance a user sees on screen and the blockchain transaction that moves their funds.

How did the attackers get in?

Binance’s initial October 30 statement pointed to a potentially compromised DevOps engineer’s laptop. The company said an attacker may have used that access to reach a service container, an environment running part of its infrastructure, and submit unauthorized withdrawals.

That account was preliminary. In a subsequent update signed by its co-CEOs, Binance said investigators had identified additional breach points. It also said it had found no evidence of leaked wallet private keys. The full sequence of access and authorization failures remains under investigation.

Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.

This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
— Binance (@binance) October 30, 2026

Binance’s October 30 investigation update. Withdrawal information has since changed, as detailed below.

On Ethereum, TRM found that the attacker used EIP-7702, a feature that lets a wallet authorize smart-contract code to govern its behavior. The attacker submitted 50 signed authorizations in advance, one of which enabled malicious code to sweep assets out of a Binance wallet.

Chainalysis independently described valid signed authorizations allowing attacker-deployed code to run through the Ethereum wallet. Other affected wallets appeared to send ordinary signed transfers. TRM’s assessment points to compromised hot-wallet signing infrastructure.

The distinction matters: a transaction can carry a valid cryptographic signature while still being unauthorized by the business. Investigators need to establish how the attacker obtained that signing capability and which checks failed to stop its use.

Who is behind the attack?

The FBI’s October 31 alert attributed the theft to North Korea and identified the activity as TraderTraitor. The bureau said it was working with the U.S. Secret Service and IRS Criminal Investigation, which had observed stolen assets being converted primarily into ether.

The agencies asked exchanges and other crypto infrastructure providers to block transactions associated with the listed laundering addresses. That appeal extends the response beyond Binance: services receiving stolen funds can become potential intervention points.

Chainalysis had separately linked the attack to TraderTraitor through onchain evidence, including commingling with proceeds from an earlier North Korea-linked theft. The FBI attribution gives the story an official law-enforcement finding, although it leaves the detailed intrusion mechanism unresolved.

The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North… pic.twitter.com/TBUvUFln4n
— FBI Cyber Branch (@FBICyberBranch) October 31, 2026

The FBI’s October 31 attribution and request for assistance tracing stolen assets.

Why do reports say $6.3 billion, $6.36 billion or $6.4 billion?

These figures describe estimates of the same theft. Binance put the impact at about $6.3 billion. TRM calculated $6.36 billion by pricing each transfer at the time it occurred, while Chainalysis reported approximately $6.4 billion.

Dollar totals can shift with token prices and the scope of transfers included in an investigation. For readers, the useful distinction is between the value stolen and the amount Binance subsequently replaces. Buying replacement assets changes the exchange’s financial position; the original theft remains part of the incident’s total.

Will customers lose money?

Binance has committed to absorbing the financial impact through its Secure Asset Fund for Users, known as SAFU, and its corporate treasury. On October 30, it said it had set aside more than $6.34 billion in company funds, including $5 billion already held in the affected token assets.

By its November 1 recovery update, Binance said it had covered approximately 95% of the impacted amount. It said the remaining 5% consisted of less-liquid tokens that required more time to acquire at the necessary scale. The company reaffirmed that position on November 2.

Its promise is to make users whole. Evaluating delivery requires looking at asset backing and actual withdrawal availability together. A statement that replacement funds have been allocated addresses one part of the problem; customers also need functioning access to the specific assets and networks they use.

How much has been recovered?

Binance said on October 30 that partners had frozen approximately $3 billion onchain. That figure describes assets immobilized during the response. Recovery requires additional steps to return control of funds to the appropriate party.

Three terms help make sense of the updates:

Frozen: the holder’s ability to move particular assets has been restricted.
Recovered: stolen assets have been returned to legitimate control.
Replenished: replacement assets have been supplied to fill the exchange’s shortfall.

Binance’s 95% coverage figure concerns replenishment. It cannot establish how much of the stolen crypto investigators have returned.

The attackers also tried to escape freezes. Chainalysis observed $325 million in stablecoins being exchanged for $285 million in ETH over nearly 20 minutes. Stablecoins such as USDT and USDC have issuer freeze mechanisms; native bitcoin and ether lack an equivalent issuer-controlled switch. That difference helps explain the rush to convert funds, even at a substantial loss.

Can Binance users withdraw their funds?

Binance announced a phased withdrawal reopening for November 1. The initial list included BTC on Bitcoin, ETH and major stablecoins on Ethereum, along with selected assets on networks including Solana and XRP Ledger.

Availability is specific to each asset and network combination. Binance directed users to the withdrawal screen or its network status page for confirmation and warned that traffic could cause processing delays.

Its November 2 announcement said the next phase was planned for November 3, with further details to follow. Treat that as a planned rollout. The published schedule alone cannot confirm that every listed route is operating when a reader tries to withdraw.

What does the new proof of reserves show?

In its November 2 update, Binance said it had completed the zero-knowledge proof for a reserves snapshot taken at midnight UTC on October 31. It said users could verify backing of at least one-to-one for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.

The process also allows users to check that their balances are included in the published snapshot. Binance plans a broader snapshot on November 4, followed by proof generation that it estimates will take another 40 to 50 hours.

A reserves snapshot provides evidence within a defined scope and at a particular time. It has a narrower purpose than a comprehensive financial audit. The Public Company Accounting Oversight Board has warned that proof-of-reserves reports offer limited assurance and urged caution when using them to conclude a company can meet customer liabilities.

For this incident, the snapshot also leaves a separate security question: what changes prevent the same type of unauthorized signing from happening again?

What should users watch out for?

Use the official Binance app or a trusted bookmark to check withdrawal availability and contact support. Verify anyone claiming to represent the exchange through Binance’s official verification channels. Unsolicited requests to download files, share login details or enable remote access warrant particular caution.

Binance’s security guidance on impersonation scams warns about messages directing users to move funds into a supposedly secure wallet. Keep wallet seed phrases and private keys private. A recovery offer sent by a stranger creates another opportunity to lose funds.

What still needs an answer?

The most consequential outstanding document is Binance’s technical post-mortem. It needs to explain how the initial compromise reached transaction authorization and why the attacker could affect wallets across several networks.

The financial follow-through also needs checking: acquisition of the remaining affected tokens, expansion of reserves verification and restoration of withdrawal routes. Those developments will show how far Binance has progressed from its reimbursement commitment to complete operational recovery.

Editor’s note: This article was written by an AI agent in collaboration with OpenAI’s GPT-6 Astra and edited by a Now Media staff member.