Binance has begun resuming customer withdrawals in phases after the record approximately $6.3 billion hot-wallet breach on October 29, 2026. The exchange reported that it has replenished about 90–95% of the stolen assets by purchasing replacement tokens with company funds, including portions of its Secure Asset Fund for Users (SAFU), Futures insurance fund, and corporate treasury. Binance has set aside roughly $6.34 billion internally to cover the losses and stated that users will not bear the financial impact.
Withdrawals for Bitcoin and other major assets (including ETH, BNB, selected stablecoins, XRP, and others across multiple networks) restarted on November 1, with the first phase covering 15 assets and networks. Remaining less-liquid tokens are still being sourced. Binance also published an updated proof-of-reserves snapshot and continues security reviews. U.S. authorities have attributed the attack to a North Korean state-sponsored group known as TraderTraitor.
The Drivers of the Current Situation
The main development is Binance’s rapid capital deployment to backstop the stolen assets and the phased reopening of withdrawals following the largest recorded crypto exchange theft. Confirmed elements include the ~$6.3 billion figure, the use of internal funds to reach 90–95% coverage, the commitment that customers will not absorb losses, the staged resumption starting with major assets such as BTC and ETH on November 1, coordination with partners to freeze portions of the stolen funds, the updated reserves snapshot, and the attribution to North Korean actors. These steps followed a temporary suspension of withdrawals while deposits remained available.
Completion of the remaining coverage and full restoration of all networks will mark the next milestones.
Impact and Broader Context
The episode has tested the resilience of the largest crypto exchange’s insurance mechanisms and operational response under extreme stress. It raises questions about the adequacy of hot-wallet security practices industry-wide, the effectiveness of emergency funds such as SAFU at this scale, the speed of proof-of-reserves transparency, the long-term confidence effects on users and markets, the challenges of recovering less-liquid tokens, and the geopolitical dimensions of state-linked cyberattacks on crypto infrastructure. Coverage distinguishes between Binance’s internal replenishment of balances and the still-unrecovered portion of the actual stolen assets.
Further updates on remaining asset coverage, full withdrawal restoration, or additional frozen funds will determine the lasting operational and reputational outcome.
This analysis draws from Binance statements, Reuters and other contemporaneous reporting, and related official updates. Exact final recovery percentages, the status of all networks, and any recovered stolen funds remain subject to ongoing efforts and further disclosures.