Key Takeaways
- • Binance began a phased restoration of withdrawals on Sunday, November 1, starting with bitcoin, ether and certain stablecoins, after a cyberattack detected on Thursday, October 29 that the source reports stole approximately $6.3 billion.
- • Around $4.7 billion was withdrawn in the first hours of reopening, according to data the company communicated and Bloomberg reported; net outflows were $3.64 billion over the first nine and a half hours, about 2.1% of assets, per Binance.
- • Binance says it will bear all losses itself using its own resources and the SAFU protection fund, and has replenished approximately 95% of the stolen assets, with the remaining 5% concentrated in lower-liquidity tokens.
- • The FBI attributed the attack to TraderTraitor, a group linked to North Korea and the Lazarus Group, and the theft is reported to exceed the approximately $1.5 billion Bybit hack of February 2025.
- • Binance and partners, including Tether and Circle, have reportedly frozen around $3.0 billion, close to half the amount stolen, though authorities have not determined how much can be definitively recovered.
Summary
Binance, the world's largest cryptocurrency exchange, has begun restoring services after what the source describes as the largest recorded digital asset theft to date. The cyberattack, detected on Thursday, October 29, allowed criminals to steal approximately $6.3 billion and forced the company to temporarily suspend withdrawals while it investigated the breach. On Sunday, November 1, the platform began a progressive reactivation of withdrawals, starting with bitcoin, ether and certain stablecoins. According to data communicated by the company and reported by Bloomberg, around $4.7 billion was withdrawn during the first hours of operation. Binance maintains that no mass withdrawal has compromised its operations, stating that volumes stabilized after the initial surge and deposits remained at high levels. Over the first nine and a half hours of reactivation, net outflows totaled $3.64 billion after new inflows were deducted, equivalent to roughly 2.1% of its assets.
Binance says its priority is to restore operations without compromising system security again, so withdrawals are being restored gradually by asset and network as technical checks are completed. Deposits remain available, though some withdrawals may be delayed, particularly for cryptocurrencies whose networks require additional verification after the attack. The company has stated that it will fully bear the losses and will not pass the economic impact on to customers, using its own resources and its SAFU protection fund, created in 2018 for exceptional situations such as security incidents. In its latest update, Binance said it had replenished approximately 95% of the stolen assets, with the remaining 5% mainly in lower-liquidity cryptocurrencies that take longer to acquire in large amounts. The company stresses this replenishment is not a recovery of 95% of the funds from the attackers; it is covering losses while it continues trying to locate and block assets still held by those responsible.
The first investigations indicate the attackers accessed Binance's internal systems through the compromised computer of one of its software engineers, and the company has acknowledged other possible intrusion points. According to a reconstruction by TRM Labs, the criminals obtained the permissions needed to authorize multiple fraudulent transactions and empty several wallets on the platform. Most of the funds were taken in approximately 20 minutes across different blockchain networks, and investigators believe the attackers prepared in advance and conducted test movements. The stolen assets were then moved across addresses and networks and swapped through decentralized exchange services into cryptocurrencies that are harder to freeze.
On Saturday, October 31, the FBI attributed the operation to TraderTraitor, a group it linked to the North Korean regime and to the Lazarus Group. The conclusion is consistent with analyses from TRM Labs and Chainalysis, which identified patterns similar to those of previous thefts attributed to these actors. The FBI says TraderTraitor is converting part of the proceeds into ether and using decentralized platforms to launder them, and has requested cooperation from crypto firms and blockchain service providers to detect related activity. Until this incident, the February 2025 Bybit hack, in which approximately $1.5 billion was stolen, was the largest theft in the sector's history.
Binance and several industry companies have reportedly immobilized around $3.0 billion, close to half the total stolen. Tether and Circle, issuers of two major stablecoins, are taking part because their tokens allow issuer-level freezes on certain addresses. Bitcoin and ether do not offer an equivalent mechanism, so recovery depends on each asset's characteristics. The FBI, the U.S. Secret Service and other agencies are working with private firms to track the remaining funds, and authorities have not yet determined what share can be definitively recovered.
For European clients, the attack occurred in Binance's global infrastructure and is distinct from its regulatory status under the EU's MiCA framework. Binance previously said it was withdrawing its MiCA authorization application in Greece and would seek a license in another member state, and the end of the EU transitional period has required unauthorized providers to stop offering affected services. Binance indicates that options may vary by country and account, and customers should consult its communications. Overall, the theft is a significant test of confidence in major crypto platforms, and key questions about the initial access, compromised systems and recoverable amounts remain open.
Binance says its priority is to restore operations without compromising system security again, so withdrawals are being restored gradually by asset and network as technical checks are completed. Deposits remain available, though some withdrawals may be delayed, particularly for cryptocurrencies whose networks require additional verification after the attack. The company has stated that it will fully bear the losses and will not pass the economic impact on to customers, using its own resources and its SAFU protection fund, created in 2018 for exceptional situations such as security incidents. In its latest update, Binance said it had replenished approximately 95% of the stolen assets, with the remaining 5% mainly in lower-liquidity cryptocurrencies that take longer to acquire in large amounts. The company stresses this replenishment is not a recovery of 95% of the funds from the attackers; it is covering losses while it continues trying to locate and block assets still held by those responsible.
The first investigations indicate the attackers accessed Binance's internal systems through the compromised computer of one of its software engineers, and the company has acknowledged other possible intrusion points. According to a reconstruction by TRM Labs, the criminals obtained the permissions needed to authorize multiple fraudulent transactions and empty several wallets on the platform. Most of the funds were taken in approximately 20 minutes across different blockchain networks, and investigators believe the attackers prepared in advance and conducted test movements. The stolen assets were then moved across addresses and networks and swapped through decentralized exchange services into cryptocurrencies that are harder to freeze.
On Saturday, October 31, the FBI attributed the operation to TraderTraitor, a group it linked to the North Korean regime and to the Lazarus Group. The conclusion is consistent with analyses from TRM Labs and Chainalysis, which identified patterns similar to those of previous thefts attributed to these actors. The FBI says TraderTraitor is converting part of the proceeds into ether and using decentralized platforms to launder them, and has requested cooperation from crypto firms and blockchain service providers to detect related activity. Until this incident, the February 2025 Bybit hack, in which approximately $1.5 billion was stolen, was the largest theft in the sector's history.
Binance and several industry companies have reportedly immobilized around $3.0 billion, close to half the total stolen. Tether and Circle, issuers of two major stablecoins, are taking part because their tokens allow issuer-level freezes on certain addresses. Bitcoin and ether do not offer an equivalent mechanism, so recovery depends on each asset's characteristics. The FBI, the U.S. Secret Service and other agencies are working with private firms to track the remaining funds, and authorities have not yet determined what share can be definitively recovered.
For European clients, the attack occurred in Binance's global infrastructure and is distinct from its regulatory status under the EU's MiCA framework. Binance previously said it was withdrawing its MiCA authorization application in Greece and would seek a license in another member state, and the end of the EU transitional period has required unauthorized providers to stop offering affected services. Binance indicates that options may vary by country and account, and customers should consult its communications. Overall, the theft is a significant test of confidence in major crypto platforms, and key questions about the initial access, compromised systems and recoverable amounts remain open.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.