Binance Hack Drains $6.3 Billion as Withdrawals Resume on November 1

On November 1, 2026, Binance started phased resumption of withdrawals beginning around 06:00–09:00 UTC after the October 29 hack that drained roughly $6.3 billion from its hot wallets. The Binance hack, which hit about 10 blockchains in roughly 20 minutes starting at 20:05 UTC, stands as the largest crypto theft recorded. Blockchain analytics firms TRM Labs and Chainalysis, along with the FBI, attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit also linked to the Lazarus Group.

Details of the Binance Hack and Initial Response

The attackers compromised a DevOps or engineer laptop to gain access to a service container and execute unauthorized withdrawals. No evidence emerged of private key exposure, though investigators later identified additional breach vectors. Binance immediately suspended withdrawals while deposits continued without interruption. The exchange worked with partners to freeze approximately $3 billion, including around $2.7 billion in stablecoins, and stated it would cover all user losses through its own funds and the SAFU reserve, which exceeded $6.34 billion and stood 90–95 percent replenished by November 1.

TRM Labs valued the stolen assets at approximately $6.36 billion at the time of transfer. The amount surpasses the previous record of about $1.5 billion taken from Bybit in February 2025. Funds were converted primarily to ETH and laundered through decentralized finance protocols and instant swap services. Binance updated its Proof of Reserves and began the phased reopening with BTC, ETH, USDT, USDC, BNB, SOL, and XRP across 15 networks, prioritized by user demand after security verification.

Background on TraderTraitor and Market Context

TraderTraitor has been connected to earlier large-scale thefts, including the Bybit incident and a $387–388 million breach at Bitget in September 2026. North Korea-linked actors have conducted multiple crypto operations over recent years to obtain funds for state programs. The group employs sophisticated techniques that combine social engineering, supply-chain compromise, and rapid on-chain movement to obscure trails.

Binance confirmed the incident did not involve widespread private key leakage and focused its internal review on endpoint security and container access controls. Law enforcement agencies received transaction data for ongoing tracing efforts. The FBI issued alerts regarding identified addresses and encouraged exchanges to implement blocks where possible. Historical patterns show that such state-sponsored operations often convert stolen assets quickly through multiple mixing services before final conversion to fiat or other stores of value.

Phased Withdrawal Rollout and Next Steps

Binance indicated that additional networks and assets would open progressively once further security checks complete. The company plans to release a detailed post-incident report covering the timeline, technical findings, and remediation measures. Recovery efforts continue in coordination with law enforcement and blockchain analytics partners, though full reclamation of laundered funds remains uncertain given the speed of the initial transfers.

Users are advised to monitor official announcements for network-specific reopening schedules and to review account security settings. The event prompted renewed discussion among exchanges about endpoint protection standards and the limits of hot-wallet architectures during rapid, high-volume attacks. Ongoing monitoring of the identified addresses continues as part of broader industry cooperation.