Binance, the world's largest cryptocurrency exchange, began restoring customer withdrawals in phases on Sunday, November 1, 2026, following a record-breaking $6.3 billion cyberattack that forced a temporary freeze on transfer services. The platform stated that it has already replaced 95% of the stolen digital assets using company reserves and pledged that affected users will not bear any of the financial losses.
How Binance is restoring withdrawal services
The exchange suspended all deposit and withdrawal activity on Thursday, October 29, after attackers breached its security systems and drained billions in digital assets from hot wallets across multiple blockchains. Deposits remained active throughout the disruption, but withdrawals were halted to allow technical teams to contain losses and run security checks.
On Sunday morning, Binance initiated a gradual reopening of withdrawal services across 15 network groups. The phased rollout enables the platform to conduct risk checks on a network-by-network basis before re-enabling asset transfers. Key facts about the recovery process include:
Asset coverage: Binance has set aside over $6.34 billion from its corporate treasury and reserves to make users whole, covering 95% of affected holdings so far.
Remaining tokens: The remaining 5% consists of less liquid cryptocurrencies that require more time to source in market volume without distorting prices.
Supported networks: Initial access covers major tokens including Bitcoin, Ether, BNB, Solana, XRP, and Dogecoin, as well as stablecoins USDT and USDC.
Processing speeds: The exchange warned users to expect potential processing delays due to heavy traffic volumes as accounts regain access.
Investigation points to North Korean state-backed hackers
Federal law enforcement agencies quickly identified state-sponsored cybercriminals as the primary suspects behind the breach. According to the FBI, the attack was executed by TraderTraitor, a North Korean hacking unit also known as the Lazarus Group. Investigators observed the perpetrators converting stolen tokens primarily into Ethereum before attempting further laundering through decentralized exchanges and instant swap services.
Binance's preliminary investigation revealed that attackers initially compromised a DevOps engineer's laptop, gaining unauthorized access to a service container that allowed illicit withdrawal requests. Binance Co-Chief Executive Officer Richard Teng noted that multiple individuals carried out the operation using sophisticated techniques, including self-destruct mechanisms to obscure their digital footprint.
Collaboration among law enforcement agencies, private intelligence firms, and asset issuers has enabled investigators to trace and freeze between $2.7 billion and $3 billion of the stolen funds. US President Donald Trump stated that federal authorities are actively investigating the situation, noting that the administration will engage directly with North Korea if state involvement is definitively confirmed.
Financial impact and market reaction
The $6.3 billion heist stands as the largest security incident in cryptocurrency history, eclipsing the previous record set during a $1.5 billion breach of the Bybit exchange in 2025—an attack also attributed to North Korea by federal authorities.
The scale of the theft caused immediate volatility across digital asset markets. Bitcoin fell by more than 3% following news of the breach, briefly touching a six-week low near $76,000. Major alternative tokens, including Ethereum and Binance's native BNB token, experienced similar price pressure. Leveraged traders were hit particularly hard, with total market liquidations surpassing $628 million within a single hour, primarily affecting long positions.
What happens next for Binance and crypto investors
Binance has stated that it will publish a comprehensive incident report detailing the breach once internal and external investigations conclude. Technical teams continue working to source the remaining less liquid assets needed to complete full compensation for all affected accounts.
For the wider crypto industry, the incident underscores ongoing vulnerabilities in exchange infrastructure and hot wallet management. While Binance's decision to absorb $6.3 billion in losses using corporate reserves has helped stabilize market sentiment, regulators and industry analysts will be watching closely to see how exchanges strengthen DevOps security, container isolation, and multi-signature withdrawal verification against advanced state-sponsored threats.
Top analysts identify Datadog, Nvidia, and SpaceX as long-term buys despite market volatility from elections and ongoing concerns over AI spending costs.
