Binance Reopens Withdrawals After $6.3 Billion Hack: What We Know

Binance, the world's largest cryptocurrency exchange, began restoring customer withdrawals on Nov. 1 after a $6.3 billion hack, and billions of dollars left the platform within hours. The exchange says it has replaced 95% of the stolen assets with its own money, while the FBI has attributed the theft to North Korea.

Below are the main questions customers and observers are asking, based on reporting by Bloomingbit, NewsCord and Cointelegraph.

What happened at Binance, and what has been restored?

Cointelegraph described the $6.3 billion theft as the largest crypto hack on record. The FBI said it happened on or about Oct. 29, 2026, according to NewsCord.

Binance said it began resuming withdrawals in phases at 6 a.m. UTC on Nov. 1. By 12:36 p.m. UTC, it said, all withdrawals in the first recovery round had restarted. Bloomingbit and Cointelegraph say the round covers 15 networks, while NewsCord describes it as 15 assets. Those include Bitcoin, Ether and Solana. Binance said it will add more assets and networks in stages as security checks are completed.

How much money has left since withdrawals restarted?

Binance said it processed about $4.6 billion in withdrawals and $1 billion in deposits, which left net outflows of about $3.64 billion. According to Bloomingbit, that equals roughly 2.1% of the $171 billion in assets the exchange has disclosed. Binance said withdrawals surged at first and then stabilized.

A different measure shows a larger figure. Cointelegraph reported that DefiLlama data recorded $5.8 billion in net outflows over the preceding 24 hours. That window is longer than the one Binance used. Cointelegraph said it had not received an immediate response from Binance. It also reported that most withdrawals were in USDT, followed by USDC and Bitcoin.

Who is blamed for the hack?

The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, according to NewsCord. Bloomingbit reported that the bureau named the North Korea-linked group TraderTraitor and said it announced the attribution on Oct. 31. The FBI said the group had been converting stolen assets into Ether. It expects them to be laundered further through decentralized finance and instant swap services.

President Donald Trump expressed doubt, telling reporters, “We don't know if it's North Korea,” according to NewsCord. He also said he was not concerned and that officials were still learning about the incident. Binance thanked the FBI for its support.

Are customers' losses covered?

Binance says so. Co-CEO Richard Teng said the exchange would absorb the financial impact, with the line “Binance will absorb the financial impact of the stolen funds, not our users.”

Cointelegraph reported that on Oct. 31 Binance had replaced 90% of the lost assets using its corporate treasury, its Secure Asset Fund for Users and its futures insurance fund. Binance later raised the figure to about 95%, according to Bloomingbit and NewsCord. Bloomingbit said balances of major assets, including Bitcoin, Ether, Tether, BNB, Solana, USD Coin and XRP, have been fully restored. For some less liquid tokens, the exchange is making additional purchases through over-the-counter channels.

Binance said the remaining 5% is harder to source at the needed scale because those assets are less liquid. NewsCord also reported that Binance worked with other crypto firms to freeze about $3 billion of the stolen assets.

What does this mean for Binance customers?

In practice, users of the platform can again move some assets off the exchange, but not everything yet. Binance warned of temporary delays or longer processing times because of heavy traffic, according to NewsCord. Additional assets and networks will return only as security checks finish.

The outflows are an early test of customer confidence, Cointelegraph said. Binance noted that the amount leaving is a small share of its total holdings. The exchange has not given a date for full restoration. It said it will publish a more detailed incident report once its internal investigation is complete.

Around Prague, based on reporting by bloomingbit, NewsCord, TradingView