Crypto News: Binance Withdrawals After $6.3B Hack
Meta description: Binance resumed withdrawals after its $6.3 billion hack, processing billions in outflows on Sunday as customers tested whether their funds were safe.
Binance, the world’s largest cryptocurrency exchange, began restoring withdrawals on Sunday, November 1, 2026, in a major crypto news development three days after attackers drained about 6.3 billion dollars from its wallets in what analysts describe as the largest single theft on record. Within hours, customers moved billions of dollars off the platform, in a rush that became its own story. Binance said it processed about 4.6 billion dollars in withdrawals and about 1 billion dollars in deposits between 06:00 and 15:30 UTC on Sunday, a net outflow of about 3.6 billion dollars in nine and a half hours. Independent tracking by DefiLlama, covering a different 24-hour window, put net outflows even higher, at about 5.8 billion dollars. The exchange said the surge initially spiked and then slowed and began to stabilise, and that the outflows represented only about 2.1 percent of the roughly 171 billion dollars in customer assets it reports holding. That framing is important, because it is Binance’s central argument: the platform can handle the rush, the money is there, and the exodus, while large in absolute terms, is small relative to the size of the exchange.
The crypto news significance of the day, however, goes beyond the arithmetic. Withdrawals had been paused since Friday, after the hack, leaving customers unable to move their assets off the exchange while Binance rebuilt its withdrawal systems and replaced the stolen funds. Sunday was the first test of whether customers believed the exchange’s assurances. The answer, in the first hours at least, was that many did not want to wait to find out. They moved money to other wallets, other exchanges, and cold storage, even though Binance had said it would absorb the losses itself and that users would not bear the cost of the theft. Restoring balances on paper is one thing. Restoring confidence after a record breach is another, and Sunday’s outflows showed how wide that gap can be, even when an exchange says it has covered almost all of the stolen amount.
Binance co-chief executive Richard Teng announced the phased resumption in a post on X early on Sunday, saying the exchange was beginning a careful return to normal withdrawals in order to ensure services came back safely and securely, and repeating the commitment that Binance, not its users, would absorb the financial impact of the stolen funds. By 7:36 a.m. Eastern time, withdrawals had resumed for 15 digital currencies, including Bitcoin, Solana, and Ethereum, according to CNN’s account of the reopening. Binance said it would continue to restore additional assets and networks in phases as security checks were completed, prioritising Bitcoin, Ethereum, and major stablecoins before expanding access to other cryptocurrencies. That phased approach was deliberate, designed to avoid overwhelming systems that had just been rebuilt, but it also meant that not every customer could move every asset at once, and some users were warned to expect delays or longer processing times.
Crypto News: Billions Leave in the First Hours
The scale of the first day’s movement is best understood through the two sets of figures that circulated on Sunday, which measure different periods and should not be treated as interchangeable. Binance’s own update, covering 06:00 to 15:30 UTC, reported 4.65 billion dollars in withdrawals against 1.01 billion dollars in deposits, for a net outflow of about 3.64 billion dollars. DefiLlama’s tracking, covering the preceding 24 hours at a later observation point, reported about 5.8 billion dollars in net outflows, with funds continuing to leave after Binance’s initial update. Both figures point in the same direction, even if they differ in detail: a very large amount of money left the exchange quickly, and deposits, while substantial at about a billion dollars, did not come close to offsetting withdrawals. Binance said the largest share of withdrawals was in USDT, the Tether stablecoin, followed by USDC and Bitcoin, a pattern that suggests customers were moving both stable value and major cryptocurrencies off the platform, rather than simply converting one asset into another on the exchange itself.
That pattern matters for what it reveals about customer behaviour after a breach. In normal times, a large exchange sees constant flows in both directions, as traders deposit funds to trade and withdraw profits or rebalance portfolios. After a hack, the balance shifts, because the incentive to keep funds on the platform falls sharply, while the incentive to move them somewhere perceived as safer rises. The fact that deposits remained substantial, at about a billion dollars in Binance’s window, shows that not everyone left, and that some customers were still willing to use the exchange even on the day withdrawals resumed. But the net direction was unmistakable, and the size of the outflow, in billions rather than millions, showed that the decision to leave was not confined to a small group of nervous traders. It was a broad, if not universal, response to a breach that had shaken confidence across the market.
Binance’s response to the outflow was to emphasise proportion rather than absolute size. About 3.6 billion dollars is a very large sum in any ordinary context, but as a share of about 171 billion dollars in reported customer assets, it is about 2.1 percent, according to the exchange’s own calculation. That argument is designed to reassure remaining customers and the wider market that the exchange is not facing a run that threatens its solvency, and that the withdrawal system is functioning as intended. The exchange also said that withdrawal activity initially surged and then slowed, which, if sustained, would suggest that the initial rush was driven by pent-up demand from the days when withdrawals were paused, rather than by a continuing loss of confidence. Whether that stabilisation holds over the coming days, as more assets and networks are restored and as more customers gain access, will be the real test. A single day’s figures, however dramatic, do not settle the question of long-term confidence.
The bitcoin price and the wider cryptocurrency market also provide context for the outflow story. Bitcoin had fallen to a six-week low of about 76,368 dollars after the hack, as markets reacted to the theft and to the uncertainty about what it meant for the largest exchange in the industry. By the time withdrawals resumed, Bitcoin had recovered to above 77,000 dollars, suggesting that the initial market shock had steadied, even if it had not fully reversed. Ether, which had fallen more than 3 percent to a two-month low of about 2,178 dollars after the hack, was also part of the story, because a large share of the stolen funds had been converted into Ether by the attackers, and because Ether was among the assets whose withdrawals were restored in the first phase. The cryptocurrency news cycle on Sunday was therefore not just about outflows. It was about whether the market as a whole could absorb a record theft, a record outflow, and a phased reopening, without a second, deeper shock.
Cryptocurrency News: How the $6.3 Billion Hack Happened
To understand why customers moved so quickly, it is necessary to recall what happened on Thursday, October 29, when the hack itself took place. According to blockchain analysts, attackers drained about 6.3 billion dollars from Binance’s hot wallets in roughly 20 minutes, across ten different blockchain networks, in a sequence that was automated and carefully prepared. The blockchain intelligence firm TRM Labs put the total at about 6.36 billion dollars, including 18,270 Bitcoin worth about 1.47 billion dollars, more than 200,000 Ether, and billions of dollars in stablecoins. The attack began at about 4:10 p.m. Eastern time, according to reporting based on the analysts’ findings, and most of the money was gone within about 20 minutes. That speed, and the fact that the attackers used the exchange’s own systems to order the transfers, is what made the breach so alarming, even by the standards of an industry that has seen many large hacks.
Binance’s own account of the breach points to a compromised laptop belonging to a development and operations engineer, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The company said it found no evidence that wallet private keys were compromised, although it later said it had found additional points of breach, so the full picture is still coming together. That distinction matters for the technical debate that will follow, because it suggests the attackers did not need to steal the deepest secrets of the wallets. They needed only to hijack the approval process that sits in front of them, and then use that control to order Binance’s own wallets to empty themselves. Other exchanges will be auditing those approval systems urgently, and regulators will want to know why the controls that were supposed to stop unauthorised withdrawals did not stop this one. The fact that the attackers had apparently prepared for at least 36 hours in advance, making small test withdrawals from the morning of Wednesday, October 28, adds to the concern, because it suggests a patient, well-resourced operation rather than an opportunistic attack.
Attribution for the hack has focused on North Korea. Both TRM Labs and Chainalysis said they had high confidence that the attack was carried out by actors working for North Korea, and TRM Labs identified the group as TraderTraitor, linked to the wider Lazarus network. On Saturday, the Federal Bureau of Investigation said TraderTraitor, described as cyber actors sponsored by North Korea since at least 2020, were responsible for the theft, and said the actors were converting the stolen currencies mainly into Ethereum. That official attribution, coming a day after the hack and a day before withdrawals resumed, gave the story a geopolitical dimension that goes beyond a single exchange’s security failure. North Korea routinely denies such allegations, and attribution in cyber cases is rarely a matter of absolute proof in a courtroom sense, but the convergence of two independent firms and the FBI on the same group, with the same methods seen in previous large thefts, gives the assessment considerable weight. The previous record theft, the 1.5 billion dollars taken from Bybit in February 2025, was also attributed by the FBI to TraderTraitor, and analysts have noted similarities in transaction patterns and methods between the two incidents.
The scale of the Binance theft dwarfs that previous record. At about 6.3 billion dollars, it is more than four times the Bybit theft, and analysts have described it as the largest single theft on record, not just in cryptocurrency but in financial crime more broadly. That framing matters, because it moves the story beyond the usual world of exchange hacks and into the territory of major financial crime, with consequences for markets, regulators, and ordinary account holders. Last year, attackers stole 2.9 billion dollars worth of cryptocurrency in nearly 150 attacks, according to TRM Labs, and the Binance theft alone is more than double that annual total. For an industry that has spent years arguing that it is maturing into a mainstream financial system, a record heist of this size is a serious setback, and the outflow on Sunday was, in part, a market verdict on whether that maturity claim still holds.
Bitcoin Price and the Recovery Effort: 95 Percent Replaced
Binance’s central reassurance throughout the crisis has been that customers will not bear the loss, and that the exchange has replaced almost all of the stolen assets. On Saturday, Binance said it had replaced 90 percent of the assets lost in the hack, using funds from its corporate treasury, its Secure Asset Fund for Users, known as SAFU, and its futures insurance fund. By Sunday, that figure had risen to about 95 percent, according to the exchange’s recovery update. SAFU itself was set up in 2018 with about 1 billion dollars, and this hack is more than six times that size, which is why Binance has emphasised that it is drawing on company funds as well as the SAFU reserve. The exchange has also said it set aside about 6.34 billion dollars of company funds internally to cover the losses, a step designed to reassure customers that their balances would not be wiped out by the theft. Whether that cover is sufficient, and how quickly the remaining 5 percent is replaced, will be watched closely, because the promise that users are covered holds only as long as Binance keeps it.
Alongside the replacement effort, Binance and its industry partners have worked to freeze what they can of the stolen funds. The exchange said it had worked with partners to freeze about 3 billion dollars in affected assets, while TRM Labs put the frozen figure at about 2.7 billion dollars. Tether said it had frozen nearly 1.57 billion dollars, and Circle froze more than 800 million dollars. Those freezes matter because frozen stablecoins cannot be spent, even if they remain technically in the attackers’ wallets, and they represent the main tool the industry has for clawing back funds after a theft of this kind. Even with those freezes, however, the attackers still controlled roughly 2.4 billion dollars worth of Bitcoin and Ether, according to TRM Labs, and that remainder is the hard part of the recovery effort. It may take months of tracing, legal action, and international cooperation to recover even a fraction of it, and it depends on the cooperation of every operator in the chain, across different legal systems and blockchains.
The bitcoin price today, the ethereum price today, and the xrp price today are all part of the same market story, because the hack touched all three assets and more. Bitcoin fell to a six-week low after the theft, Ether fell to a two-month low, and XRP was among the first assets moved, with about 233 million dollars in XRP taken in the opening minutes of the attack, according to reporting based on the analysts’ findings, and about 296 million dollars in XRP in the earliest phase described by other accounts. Those price movements reflect a loss of confidence as much as a direct financial impact. If the world’s largest exchange can lose 6.3 billion dollars in 20 minutes, investors ask, how safe is any platform? The question is not academic, and it is why Sunday’s outflows matter beyond Binance itself. They are a test of whether customers believe that the industry’s security, custody, and insurance arrangements are sufficient, or whether they will increasingly prefer to hold assets themselves, in wallets they control, rather than trusting an exchange to hold them.
What happens next will unfold on several tracks at once. The first is the phased restoration of withdrawals, which will continue as Binance completes security checks for additional assets and networks, and which will show whether the initial outflow stabilises or accelerates as more customers gain access. The second is the investigation, led by the FBI and the Secret Service in the United States, with cooperation from industry firms and regulators in other jurisdictions, which will try to establish exactly how the engineer’s laptop was compromised, how the attackers gained access to the service container, and whether any other points of intrusion remain open. The third is the recovery effort, which will test whether the freeze strategy can actually return money, and whether Binance’s cover fund is sufficient to make every customer whole. The fourth is the policy debate, which the sheer size of the theft will inevitably accelerate, giving fresh weight to arguments for stricter controls on exchanges, for better protection of approval systems, and for faster cross-border cooperation when stolen funds move. And the fifth is the market verdict, expressed in prices, in outflows, and in the decisions of millions of customers about where to keep their assets.
For now, the facts that matter are clear enough. A record 6.3 billion dollars was taken from Binance in about 20 minutes on October 29. Two leading blockchain firms and the FBI blame North Korea’s TraderTraitor group with high confidence. About 3 billion dollars has been frozen, about 2.4 billion dollars in Bitcoin and Ether remains under the attackers’ control, and Binance says it has replaced about 95 percent of the stolen assets and will absorb the loss itself. Withdrawals resumed in phases on Sunday, November 1, for 15 currencies, and customers responded by withdrawing about 4.6 billion dollars and depositing about 1 billion dollars in the first nine and a half hours, for a net outflow of about 3.6 billion dollars, with independent tracking putting the 24-hour net outflow higher, at about 5.8 billion dollars. Binance says the surge has slowed and is stabilising, and that the outflow is a small share of its total assets. Whether that stabilisation holds, and whether confidence returns, will determine whether Sunday is remembered as a difficult but manageable day for the world’s largest exchange, or as the moment when its customers began to leave in earnest.
Source: BBC