Binance Reopens Withdrawals After $6.3 Billion Security Breach

Binance has begun restoring cryptocurrency withdrawal services following a major security breach that resulted in approximately $6.3 billion worth of digital assets being stolen from its platform. The exchange started reopening withdrawals in phases on Sunday, November 1, 2026, after temporarily suspending the service to investigate the incident and strengthen its security infrastructure. The first phase covered 15 cryptocurrency networks and assets, including Bitcoin, Ethereum, BNB, Solana, XRP and Dogecoin. Binance said the phased approach was necessary to ensure that affected systems were secure before allowing customers to move their funds freely again. The company also reassured users that it would absorb the financial impact of the stolen assets rather than pass the losses on to customers.

The reopening triggered significant withdrawal activity as customers rushed to regain access to their funds. Between 6:00 GMT and 15:30 GMT on Sunday, Binance processed approximately $4.65 billion in withdrawals and $1.01 billion in deposits, resulting in net outflows of $3.64 billion. According to the exchange, this represented approximately 2.1% of its reported $171 billion in total assets under management. Binance said withdrawal activity initially increased sharply but subsequently began stabilising, while deposits remained substantial. The figures suggest that although some customers chose to move their assets elsewhere, the initial withdrawal activity did not represent the departure of a majority of funds held on the platform.

The Federal Bureau of Investigation has attributed the attack to North Korean hackers associated with a cybercrime group known as TraderTraitor. The FBI said the group was responsible for stealing more than $6 billion in virtual assets from Binance around October 29, 2026. Investigators also reported observing the attackers converting stolen assets into Ethereum, with concerns that the funds could subsequently be moved through decentralised finance platforms and cryptocurrency-swapping services. Binance has been working with law enforcement agencies, blockchain analytics companies and cryptocurrency industry partners to trace and recover the stolen assets. The investigation remains ongoing, and authorities have not yet publicly established every detail of how the attackers gained access to the affected systems.

In response to the financial damage, Binance announced that it had set aside company resources to cover the affected assets. The exchange initially reported that approximately 80% of the stolen amount had been covered, later increasing that figure to 90% and then approximately 95%. According to its recovery update, the remaining 5% consists largely of less-liquid cryptocurrency tokens that are more difficult to purchase in the required quantities. Binance also stated that major assets, including Bitcoin, Ethereum, USDT, BNB, Solana, USDC and XRP, were fully backed. The company plans to publish an updated proof-of-reserves report using an October 31 snapshot to provide additional information about its holdings and customer-asset backing.

The incident represents another major test of confidence in the global cryptocurrency industry, particularly as exchanges face increasingly sophisticated cyberattacks. Binance’s decision to reopen withdrawals is an important step towards restoring normal operations, but the company still faces questions about the security weaknesses that allowed the attack to occur and the measures being introduced to prevent a repeat. The exchange has promised to release a detailed post-incident report after its investigation is completed. Meanwhile, customers and investors will be watching its withdrawal services, proof-of-reserves disclosures and recovery efforts closely. Although Binance says user funds will not bear the financial impact of the breach, the incident highlights the importance of exchange security, independent verification and responsible cryptocurrency storage.