On 29 October 2026, roughly $6.3 billion left Binance's hot wallets in about 20 minutes. It is the largest crypto theft on record — more than four times the size of the Bybit theft in February 2025, which held the record until then.
Two weeks on, withdrawals are back, most of the money has been replaced, and users have voted with their balances. But several questions are still open, and the full technical report has not yet been published. Here is the timeline, the recovery so far, and what users should actually do.
What happened on 29 October
Binance says unauthorised withdrawals hit its hot wallets on 29 October across ten blockchains, most of it within about 20 minutes. The exchange paused deposits and withdrawals, said user funds were safe, and promised to cover every loss from its Secure Asset Fund for Users (SAFU) and its own money.
Stablecoin issuers such as Tether and Circle, along with other partners, helped freeze around $3 billion on-chain, according to CNBC reporting cited by Tahawultech.
Binance's early investigation points to a compromised laptop belonging to a DevOps engineer, according to SecurityWeek reporting. Binance says it has found no evidence that private keys were stolen.
Investigators have attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus. Blockchain analytics firms TRM Labs and Chainalysis made that attribution with high confidence, and CNBC reported that the FBI identified the operation as TraderTraitor on 31 October. North Korea has denied responsibility.
Withdrawals resume in phases on 1 November
Binance began reopening withdrawals in phases on Sunday 1 November 2026, starting at 06:00 UTC. Phase one covered Bitcoin and the busiest networks, and by 12:36 UTC withdrawals had resumed on all 15 networks and assets in the first phase, according to Binance's own updates reported by Fizen and DatelineWire.
Demand was heavy at first. Binance processed about $4.65 billion in withdrawals and $1.01 billion in deposits in the early window on 1 November, for roughly $3.64 billion in net outflows, according to CNBC. That is about 2.1% of the assets Binance holds.
Binance co-founder Changpeng Zhao framed that number differently: he said it meant 98% of customers chose to stay. Both readings are true. Most users stayed, and a large minority moved a large amount of money on day one.
Recovery: about 95% covered
Binance says it will absorb the financial impact of the stolen funds, not its users. Co-CEO Richard Teng stated: "Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users."
The recovery figure rose at every update: about 90% on 31 October (Reuters), about 95% on 1–2 November (Binance Recovery Update #4), and about 98% on 4 November (The Defiant, cited by FinanceFeeds).
This article uses the 95% figure as the confirmed position as of 1–2 November, when withdrawals reopened. At 95% of $6.3 billion, the unreplaced remainder is roughly $315 million, mostly less-liquid tokens outside the top ten that Binance says it is buying through market and OTC channels. At 98%, the remainder would be roughly $127 million.
Binance says ten large assets are fully backed at 100%, including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, and that they can be checked on its proof-of-reserves page. It ran a zero-knowledge proof-of-reserves snapshot across 10 assets on 2 November, then expanded the snapshot to 44 tokens by 4 November.
One caveat matters. A proof-of-reserves check is a snapshot, not a full financial audit — it covers the listed assets at one point in time, not every liability. Binance has also said it plans to restore SAFU toward about $1 billion, but it has not given a firm refill date.
The bottom line
Binance lost about $6.3 billion on 29 October, reopened withdrawals in phases on 1 November, and says about 95% of the amount was covered by 1–2 November from company funds including SAFU. Users pulled a net $3.64 billion on the first day back — about 2.1% of assets — and most stayed.
The recovery is real, but it is not yet complete or independently audited. Until the full technical report and the completed proof of reserves are published, the right approach for users is caution, not panic: secure your account, diversify where you hold funds, and ignore anyone offering to "recover" your money for you.
Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency prices are volatile and you can lose money. Exchange security incidents are evolving situations — figures may change as investigations continue. Do your own research before making any investment decision.
Sources: Meyka, "Binance Recovery: 95% Assets Back, Withdrawals Open" (updated 10 Nov 2026); Tahawultech, "One laptop away: What the $6.3 billion Binance hack teaches every business" (9 Nov 2026); FinanceFeeds, "Binance Hack One Week On" (Nov 2026); Fizen, "Binance Hack Update: Withdrawals Back, 95% Covered" (2 Nov 2026); DatelineWire, "Binance Resumes Withdrawals After $6.3 Billion Hack"; CNBC via Meyka/DatelineWire.
إرسال تعليق