Overview
Binance said it will restart customer withdrawals in phases beginning on Sunday, following a major security breach that led to the loss of more than $6 billion in digital assets. The exchange plans to restore services selectively and only after conducting security and stability checks on each cryptocurrency network it re-enables.
Phased restoration
The first phase is scheduled to run from 2 p.m. to 5 p.m. Singapore time on November 1, with additional assets and chains brought back online in subsequent steps. Binance stated it will sequence the restorations according to customer withdrawal demand observed over the prior week, opting to reopen services gradually rather than simultaneously reactivating all withdrawals.
Scope of the theft and recovery efforts
The attacker(s) made off with assets that included Bitcoin, Ether and dollar-backed stablecoins USDT and USDC. Binance said it has replaced approximately 90% of the stolen cryptocurrencies and reiterated that customers will not be held financially responsible for the losses.
Co-CEO Richard Teng said the exchange could cover the shortfall using cryptocurrency reserves accumulated from operating revenue. Fellow co-CEO Yi He added that Binance’s annual revenue would be sufficient to absorb the financial impact.
Attribution and ongoing investigation
U.S. authorities, including the FBI, attributed the attack to a North Korean hacking group identified as TraderTraitor. The FBI linked that group to a separate incident that resulted in a $1.5 billion theft from cryptocurrency exchange Bybit in 2025.
Investigators are examining a potentially compromised software engineer’s laptop among other possible entry points. Binance reported that it has found no evidence that private wallet keys were exposed.
Market posture and balance sheet detail
Bitcoin traded near $77,700 on Sunday, roughly 5% below its Thursday high prior to the attack, while major cryptocurrencies generally showed limited price movement. Binance holds approximately $135 billion in assets, according to DefiLlama, a figure that the company says is substantially higher than the roughly $29 billion reported for rival OKX.
Binance also maintains its Secure Asset Fund for Users, an emergency reserve established in 2018 and typically kept near $1 billion to protect customers during exceptional incidents.
Broader security concerns
The event has increased scrutiny on security practices across the cryptocurrency industry, with particular concern about hacking techniques. Binance and observers noted worries that bad actors are increasingly using artificial intelligence as a tool for reconnaissance and social engineering, intensifying the challenge of defending major platforms and services.
Summary of status
Withdrawals will resume in a controlled, phased manner beginning on November 1 during a specified window, with prioritization based on recent customer demand. Binance reports substantial recovery of stolen assets, maintains that customers will not bear losses, and is cooperating with investigators probing possible points of compromise.