DUBAI – Global crypto exchange Binance announced plans to restart withdrawals today, on November 1, amid claims of nearly 95% of affected assets being recovered.
The unprecedented cyberattack jolted the cryptocurrency industry as hackers reportedly siphoned off between $6.3 billion and $6.36 billion in digital assets within minutes. The massive breach overshadows February 2025 Bybit hack, in which approximately $1.5 billion was stolen, setting a new record for the largest cryptocurrency theft ever reported.
As news of breach emerged, Binance suspended cryptocurrency withdrawals, triggering concerns among traders and investors about the safety of their funds. Deposits, however, continued operating. The exchange pledged that customers would not be forced to absorb the financial losses, announcing that the missing assets would be replaced using company resources.
More than $6.34 billion was allocated toward covering the incident, with financing drawn from Binance’s corporate treasury, its Secure Asset Fund for Users (SAFU) and part of the futures insurance fund. The company reported rapid progress over the weekend.
On October 30, Binance said it had already covered around 80% of affected assets, with more than $5 billion available in corresponding cryptocurrencies. The next day, the figure had climbed to roughly 90%, with full backing restored for major tokens, including Bitcoin, Ethereum, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash.
In its fourth recovery update, released around November 1, Binance reported that approximately 95% of the shortfall had been recovered. The outstanding 5% primarily involved cryptocurrencies with limited market liquidity, requiring additional purchases through trading venues and over-the-counter transactions.
The exchange also released proof-of-reserves snapshots as part of its efforts to strengthen customer confidence.
While Binance made substantial progress in replacing customer assets, investigators are also attempting to stop the hackers from moving their stolen cryptocurrency.
Approximately $3 billion in compromised digital assets, particularly stablecoins such as USDT and USDC, were reportedly frozen through coordinated action involving token issuers, law enforcement agencies, blockchain intelligence firms and other partners. Unlike certain stablecoins, cryptocurrencies such as Bitcoin and Ethereum generally cannot be frozen centrally, making direct recovery considerably more challenging.
Importantly, Binance’s reported 95% financial coverage does not mean that 95% of the stolen funds have been recovered from the attackers. Instead, the exchange has used its own reserves and financial resources to replenish customer holdings while investigators pursue the stolen assets separately.
Blockchain investigators found that the stolen funds were rapidly transferred across nearly 10 blockchain networks, including Bitcoin, Ethereum, Solana and Tron. Most of the suspicious transactions reportedly occurred within just 20 minutes, allowing the attackers to move enormous amounts of cryptocurrency before security measures could contain the damage.
Binance initially placed financial impact at $6.3 billion, while blockchain analytics firm TRM Labs estimated that the total value of compromised assets approached $6.36 billion. However, authorities have not conclusively established the precise method used to penetrate the exchange’s systems.
Meanwhile, Federal Bureau of Investigation formally attributed the multibillion-dollar cyberattack to North Korea’s state-sponsored TraderTraitor hacking operation. FBI said the group was responsible for stealing more than $6 billion in cryptocurrency from Binance around October 29.
TraderTraitor, also tracked as Jade Sleet, UNC4899 and Slow Pisces, has been associated with the notorious Lazarus Group, a North Korean-linked cyber operation accused of carrying out several high-profile cryptocurrency attacks. US investigators previously connected TraderTraitor to the $1.5 billion Bybit hack in February 2025.
Binance Withdrawals Update for Millions of Users after assets suspension amid Hacking
