Sign in Subscribe
Crypto News

Binance Hack Update: Withdrawals Are Back and 95% of the US$6.3 Billion Is Covered

Three days after the biggest crypto theft on record, Binance reopened withdrawals, says it has covered 95% of the loss from its own funds, and saw 2.1% of assets leave. Here is what changed since Thursday night and what is still unanswered.

Quinn Dao

· 7 min read
Share
Binance Hack Update: Withdrawals Are Back and 95% of the US$6.3 Billion Is Covered

Quick answer: Binance reopened withdrawals in phases from 06:00 UTC on 1 November 2026, and by 12:36 UTC all 15 networks and assets in the first phase were live again. The exchange says it has covered about 95% of the roughly US$6.3 billion stolen on 29 October using its own funds, including its SAFU reserve, while about US$3 billion stays frozen. Users pulled a net US$3.64 billion in the first day, about 2.1% of its assets, and the theft has been attributed to North Korea's TraderTraitor group.

Key takeaways

  • Withdrawals are back. Binance restored them in phases from 1 November, starting with BTC, ETH, USDT, USDC, BNB and XRP on the busiest networks.
  • 95% covered. Binance says company funds, including SAFU, now cover about 95% of the impact. The last 5% is less liquid tokens it is still buying.
  • Users mostly stayed. Net outflows were US$3.64 billion on day one, 2.1% of assets. CZ wrote that "98% choose to stay".
  • North Korea named. Blockchain analysts TRM Labs and Chainalysis tie the theft to TraderTraitor, and CNBC reported the FBI attributed it to the same group.
  • Still missing: a full technical post-mortem and the full proof-of-reserves report Binance has promised.

On Thursday night we covered the Binance hack as it happened. Three days later the picture is clearer: the exchange is open again, most of the hole is filled, and the attacker has a name. Here is what changed, checked against Binance's own posts and reporting by CoinDesk and CNBC, as of 2 November 2026.

Can you withdraw from Binance again?

Yes, for most major assets. Binance began restoring withdrawals in phases at 06:00 UTC on 1 November, starting with bitcoin, ether, USDT, USDC, BNB and XRP on the most requested networks. In an update on X, Binance said that by 12:36 UTC withdrawals had resumed for all 15 networks and assets in the first phase, and that volumes declined and stabilised after an initial spike.

Later phases depend on each blockchain passing its own security and stability checks, and Binance has not given dates for them, CoinDesk reported. If a token you hold is not yet open, check Binance's official withdrawal updates rather than third-party channels.

How did Binance cover the loss?

From its own balance sheet. A Binance spokesperson told CoinDesk the exchange "will bear the financial impact of the stolen funds" and has covered about 95% of the impacted amount, up from 90% in its previous update, using company funds including its Secure Asset Fund for Users (SAFU). The remaining 5% is tokens outside the top ten, which Binance says it is buying through market and OTC channels because they are less liquid.

  • Fully backed balances: Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are 100% backed and can be checked on its proof-of-reserves page.
  • Still frozen: about US$3 billion, mostly USDT and USDC frozen by Tether and Circle. Frozen is not the same as recovered.
  • What TRM Labs counted as stolen: 18,270 BTC (about US$1.47 billion), 200,630 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, plus XRP, SOL and USDT on other chains.

Did users leave Binance after the hack?

Some did, fewer than many expected. Binance processed US$4.65 billion in withdrawals and US$1.01 billion in deposits between 06:00 and 15:30 UTC on 1 November, a net outflow of US$3.64 billion, CNBC reported. Against US$171 billion in total assets on its 28 October proof of reserves, that is about 2.1%.

Co-founder Changpeng Zhao wrote on X that "98% choose to stay", adding that trust is earned by what you do in hard times.

Who was behind the Binance hack?

North Korea, according to the investigators. Blockchain analytics firms TRM Labs and Chainalysis attributed the theft to TraderTraitor, a North Korean group also tracked as Lazarus, and CNBC reported that the FBI identified the operation as TraderTraitor. We could not find a formal FBI or IC3 notice on the Binance theft as of 2 November. The same group was blamed by the FBI for the US$1.5 billion Bybit hack in February 2025.

The technical cause is still under investigation. Binance's first finding pointed to a compromised DevOps engineer's laptop that reached a service container and submitted unauthorized withdrawals, with no private key leaked. A full post-mortem has been promised but not yet published.

What should you do now?

  • Binance users: your balances are covered according to Binance. Withdraw only if you planned to, and use the official app or binance.com, never a link from a message.
  • Watch for phishing. Fake "compensation", "airdrop" and "verify your account after the hack" pages are already circulating after every big theft. No exchange or wallet will ask for your recovery phrase.
  • Fizen wallet users: nothing changes. The Fizen wallet is non-custodial, so your funds sit at your own address under your own keys and were never on Binance.

The bigger lesson has not changed since Thursday. Binance could cover US$6 billion because it is one of the richest companies in crypto; most platforms could not. Fizen is building the stablecoin neobank for people on the move on a self-custody wallet: you hold your keys and your USDT, and the same app gets you online abroad with a travel eSIM in 150+ countries. Read how the Fizen wallet works.

Frequently asked questions

Are Binance withdrawals working again?

Yes. Binance restored withdrawals in phases from 06:00 UTC on 1 November 2026, and all 15 networks and assets in the first phase were live by 12:36 UTC. Other assets reopen as each chain passes security checks.

Did Binance users lose money in the hack?

Binance says no. It says it has covered about 95% of the US$6.3 billion impact from its own funds, including SAFU, and is buying the remaining less liquid tokens.

How much money left Binance after the hack?

Binance reported US$4.65 billion in withdrawals and US$1.01 billion in deposits on 1 November, a net outflow of US$3.64 billion or about 2.1% of its assets.

Who hacked Binance?

Blockchain analysts TRM Labs and Chainalysis attribute the theft to North Korea's TraderTraitor group, and CNBC reported the FBI identified the same group.

Is the Fizen wallet affected by the Binance hack?

No. The Fizen wallet is non-custodial, so funds sit at your own wallet address under your keys and were never held on Binance.

Your keys, your stablecoins

Fizen is a self-custody wallet: you hold the keys to your USDT, not an exchange. The same app gets you online abroad with a travel eSIM in 150+ countries.

Get the Fizen app

Terms and conditions

  • Information only. This article summarises a developing news story from public statements and news reports as of 2 November 2026. Figures may change. It is not financial, legal, tax or investment advice, and not an offer or sale of any product.
  • For readers in the United States. This is information only, not an offer or sale, and not advice. Fizen products and services are not offered to US Persons.
  • Independent, with one disclosure. Fizen is not affiliated with Binance or the other companies named here. Tether has made a strategic investment in Fizen. Facts are as stated in the sources listed below.
  • Image. Banner uses the Binance logo (Wikimedia Commons, public domain) for news identification. Binance is a trademark of its owner.

Sources

Developing story. Checked against Binance's posts, CoinDesk, CNBC and CNN on 2 November 2026.

Read more