Binance plans phased withdrawals after $6.3B hack

Binance says it will reopen withdrawals in stages after hackers stole an estimated $6.3 billion from the exchange, a breach that the company says it will cover with its own funds. In a Sunday recovery update, Binance said the first phase was planned for Nov. 1, between 06:00 and 09:00 UTC. The company said deposits remained open and that trading services were not described as halted.

What is Binance reopening, and when?

The exchange said withdrawals would return progressively, with availability depending on security checks for each asset and network. The first phase covers Bitcoin, Ethereum, BNB, Solana, XRP, and several stablecoins, among other assets. Binance said it would add more as they passed readiness checks, and warned that traffic could cause delays.

Binance said withdrawals had been paused as a precaution while it contained the incident, assessed affected systems, and checked their security. The company said it would bear the financial impact of the stolen funds rather than pass the losses to users.

How much was stolen, and what has been recovered?

Binance estimated the loss at about $6.3 billion. The Associated Press report on the breach cited blockchain intelligence firm TRM, which said about $6.36 billion moved from Binance wallets across ten blockchains, mostly in roughly 20 minutes. Binance said about $3 billion had been frozen with partners.

In its Sunday update, Binance said it had replaced about 95% of the affected assets using company resources and purchases through market and over-the-counter channels. The remaining 5% involved less liquid tokens that take longer to source, the company said. Binance said key assets, including BTC, ETH, USDT, BNB and SOL, were fully backed.

What does Binance know about the attack?

Binance’s initial investigation pointed to a possibly compromised engineer’s laptop, which may have let an attacker access a service container and submit unauthorized withdrawals. But the company later said investigators had found additional points of breach. It reported no evidence that wallet private keys had leaked, and said the investigation was ongoing.

TRM told AP it assessed with high confidence that the attack was linked to TraderTraitor, a North Korean hacking unit. Binance said it was working with law enforcement and industry partners to trace the funds. The exchange has not yet published a full technical account of how the breach happened.

Sources and documents

• Sunday recovery update — binance.com
• Associated Press report on the breach — apnews.com