Binance, the world’s largest cryptocurrency exchange, has begun letting customers withdraw their funds again, three days after hackers stole about 6.3 billion dollars’ worth of digital assets from its wallets. Withdrawals resumed in phases early on Sunday, 1 November 2026, starting with 15 digital currencies including Bitcoin, Solana and Ethereum, and the exchange said it would restore additional assets and networks in stages as security checks were completed. The reopening is the first real test of whether customers still trust the platform after what analysts describe as the largest financial robbery on record, and the first numbers suggest a rush for the exits that then began to calm.
By 10:30 a.m. Eastern Time on Sunday, Binance said it had processed around 4.6 billion dollars in withdrawals and 1 billion dollars in deposits, according to CNN’s reporting of the company’s figures. Nine and a half hours after withdrawals reopened, the exchange reported a net outflow of 3.64 billion dollars, the result of about 4.65 billion dollars in withdrawals against 1.1 billion dollars in deposits, according to Reuters and The Wall Street Journal. That net outflow represented 2.1 percent of the company’s total assets under management, which Binance put at 171 billion dollars as of 28 October, based on its latest proof-of-reserves data. The percentages matter more than the headline billions: a 2.1 percent outflow is a serious stress test, but it is not, on these figures, a run that emptied the exchange.
Binance co-chief executive Richard Teng announced the phased resumption on X early on Sunday, saying the company was taking a careful approach to ensure services returned safely and securely, and repeating the company’s central pledge: “Binance will absorb the financial impact of the stolen funds, not our users.” That pledge is now the measure against which the exchange will be judged, and it depends on a distinction customers should understand clearly. Covering losses with company money is not the same as recovering the stolen coins, and neither is the same as proving, in full, that every customer’s balance is backed one-for-one at all times.
What the Binance withdrawals resumption shows so far
The pattern of the first day fits what market watchers expected. There was an initial spike in withdrawals, concentrated in the first couple of hours, followed by a fall to what Binance described as stabilising levels, with deposit volumes remaining substantial. Binance founder and former chief executive Changpeng Zhao, writing on X, pointed to the same pattern, noting that 12 hours after withdrawals resumed, the net outflow was 2.1 percent, with most of it occurring in the first couple of hours, and adding, in his words, that 98 percent of users chose to stay. That 98 percent figure is a company founder’s claim drawn from the exchange’s own data, not an independently audited finding, and it should be reported as such. What the published flow numbers do support is narrower but still meaningful: after an early surge, withdrawals slowed and deposits continued at a scale above one billion dollars, which is not the behaviour of a customer base that has unanimously lost confidence.
Prices told a similar story of a shock followed by a partial recovery. After hitting a six-week low on Friday, Bitcoin recovered slightly through the weekend to trade above 78,000 dollars on Monday, according to Reuters, while Ether, which had hit a two-month low on Friday, also recovered a little, to about 2,287 dollars. Those prices are still well below the levels seen before the hack, and a single weekend’s recovery does not erase the loss of confidence, but they do not show a market in free fall either. For an exchange with 335 million registered users globally, according to Reuters, the difference between a stabilising outflow and an accelerating one is the difference between a crisis managed and a crisis deepening, and on the first day’s figures the outflow stabilised.
The phased design of the resumption also matters. Binance said the rollout would prioritise tokens based on the past week’s user demand, starting with Bitcoin, Ether and certain stablecoin and Dogecoin-related assets, and that customers should expect possible delays during the initial stages. A phased return is slower for customers waiting on less-traded assets, but it is also a deliberate risk control: restoring everything at once, before security reviews are complete, would invite a second incident. Customers whose assets were not in the first 15 currencies were therefore asked to wait, and the exchange has not given a firm date for every remaining asset, saying only that restoration would continue as checks were completed.
The hack itself, and the 95 percent coverage claim
The theft took place on or around 29 October 2026, when hackers drained about 6.3 billion dollars from Binance-controlled wallets. Binance suspended withdrawals on Friday, 30 October, while its teams conducted security checks, worked with law enforcement and partners, and monitored risks. The Wall Street Journal reported that the hackers broke into a Binance engineer’s laptop, among other breaches, a detail that, if confirmed in the company’s promised post-incident report, would point to a human and systems failure rather than a single flaw in blockchain code. Binance has said it will publish a post-incident report once its investigation is complete, and until then the precise attack path should be treated as reported rather than established.
About 3 billion dollars of the stolen sum was frozen within a short time of the breach by stablecoin issuers including Tether and Circle, along with other crypto firms, acting in coordination with or at the direction of law enforcement, according to The Wall Street Journal and other reporting. That freeze is possible because stablecoins are issued by companies that can block specific tokens; it is not possible in the same way for Bitcoin and Ether, which have no issuer to freeze them. Roughly 3.3 billion dollars therefore remained under the hackers’ control in assets that cannot simply be switched off, a split that explains much of what followed.
Binance said it had covered about 95 percent of the stolen amount, using company money to buy replacement tokens, and that it had set aside around 6.34 billion dollars of company funds to cover the losses. The remaining 5 percent, the company said, consists of assets that are less liquid in the market and take longer to source at the required scale. Earlier, the company said it held 5 billion dollars of the 6.3 billion it was fronting in the same cryptocurrencies that were stolen, and was purchasing the remaining 1.3 billion dollars through market channels. The distinction between “covered” and “recovered” deserves emphasis: Binance says it will pay itself back with the frozen funds once they are released, but frozen stablecoins are not yet returned money, and the unfrozen Bitcoin and Ether remain, for now, with the thieves.
For readers following this story from earlier coverage, the sequence is worth keeping straight: the FBI’s attribution of the theft to North Korea’s TraderTraitor unit (https://usnbreaking.com/fbi-blames-north-korea-for-6-3-billion-binance-hack-the-largest-crypto-theft-on-record/) came first, and this article covers the next chapter, the resumption of withdrawals and the first outflow figures, rather than repeating the attribution itself. A related lesson from another recent case, in which authorities moved to seize more than a billion dollars linked to a cross-border laundering network (https://usnbreaking.com/thailand-moves-to-seize-over-1-billion-linked-to-a-cross-border-scam-laundering-network/), is that freezing and seizing crypto assets is often easier to announce than to complete, because court orders, issuer cooperation and the movement of funds across chains all take time.
The FBI attribution, and what it does not settle
On Saturday, 31 October, the Federal Bureau of Investigation said North Korea was responsible for the theft of more than 6 billion dollars in virtual assets from Binance, identifying the operation as TraderTraitor, a North Korean state-sponsored unit the FBI has linked to the Lazarus Group. The FBI said it had observed TraderTraitor actors converting stolen assets primarily into Ethereum, and warned that the assets were expected to be further laundered through decentralised finance platforms and instant-swap services. It published a list of cryptocurrency addresses currently or previously holding assets tied to the breach and urged exchanges, analytics firms and financial institutions to block transactions connected to them. The FBI issued its statement jointly with the United States Secret Service and the Internal Revenue Service’s Criminal Investigation division, and private analytics firm TRM Labs had earlier attributed the theft to TraderTraitor with what it described as high confidence.
Attribution, however, is not the same as accountability. No suspect has been named, no arrest has been announced and no indictment has been unsealed in connection with this theft, and attribution alone recovers nothing. President Donald Trump added a further note of uncertainty on Saturday, saying it remained unclear whether North Korea was involved, a remark that sits awkwardly alongside the FBI’s statement and that readers should not flatten into agreement. The honest position is that the FBI, the Secret Service, IRS Criminal Investigation and TRM Labs point in the same direction, while the President publicly questioned that conclusion, and while North Korea itself has not been reported as accepting responsibility. Both the strength of the official attribution and the existence of that public doubt belong in the same article, because omitting either would mislead.
There is also a practical limit to what blocking addresses can achieve. Once stolen assets are converted into Ether and moved through decentralised platforms and instant-swap services, they can be split, swapped and re-routed in ways that make address-blocking a game of catch-up. The FBI’s warning is therefore best read as a mitigation measure and a signal to the industry, not as a promise that the money will be recovered. The history of the TraderTraitor unit reinforces that caution: the FBI previously blamed the same unit for the then-record 1.5 billion dollar theft from the Bybit exchange in February 2025, a case in which attribution did not translate into full recovery either.
Why the next test is proof, not promises
The question Binance now faces is not whether it can survive a weekend of withdrawals, but whether it can prove, to customers and regulators, that its coverage claim is real and durable. Proof of reserves, the snapshot Binance cited for its 171 billion dollar assets figure, is a point-in-time disclosure, not a full audit of liabilities, and critics of the crypto industry have long argued that reserves without a matching, independently verified statement of what an exchange owes its customers can flatter the picture. Binance has not, in the reporting relied on here, published a full independent audit of the hack’s impact alongside its coverage claim, and customers are entitled to ask for one, along with the promised post-incident report, before treating the episode as closed.
Regulators will also be watching the phased resumption for a different reason. Binance says it does not accept United States customers, and it is based, in effect, in the United Arab Emirates, but its customers, its frozen stablecoins and its banking and law-enforcement contacts span many jurisdictions. A theft of this size, attributed by the FBI to a state-sponsored unit, will draw questions in every one of those jurisdictions about custody practices, about how an engineer’s laptop could become a route into billions of dollars of customer assets, and about whether the industry’s reliance on freezing stablecoins is a safety net or a single point of failure that only works for some assets some of the time.
For ordinary users, the practical lessons are less abstract. Assets held on an exchange are exposed to the exchange’s security, whatever the underlying blockchain promises about decentralisation. Stablecoins can be frozen, which helps victims after a theft but also means the issuer holds a power over those tokens that Bitcoin and Ether holders do not face. And a company’s promise to absorb losses is only as strong as the company’s balance sheet and its willingness to publish evidence for it. None of that means customers who stayed on Binance after Sunday acted irrationally: the first day’s flows, the stabilising pattern and the continued deposits all suggest many made a considered judgement that the exchange would honour its pledge. It does mean that judgement should be revisited as evidence arrives, rather than settled by a single weekend’s numbers.
For now, the accurate summary is this. The largest crypto theft on record happened on 29 October. The FBI blamed North Korea’s TraderTraitor unit on 31 October. Withdrawals resumed in phases on 1 November, 95 percent of the loss is said to be covered by company funds, and 3.64 billion dollars left the exchange in net terms in the first hours before flows stabilised. Whether that sequence becomes a story of a crisis absorbed or a story of a trust broken will depend on the post-incident report, on an independent accounting of the coverage claim, and on whether any of the stolen funds are actually recovered rather than merely replaced. Until then, the resumption of withdrawals is a milestone, not a verdict.
Sources
USN reviewed reporting from multiple outlets for this story. Read more from CNN, Reuters and The Wall Street Journal.