The short version
What happened on 29 October
The main drain took about 20 minutes on the evening of 29 October 2026, after smaller, discreet test withdrawals earlier that day. The targets were Binance's hot wallets, the online wallets an exchange uses for day-to-day withdrawals. Binance says most customer assets sit in cold wallets, which were not touched. The money moved out across ten networks. Independent estimates of the total are close to Binance's own figure: TRM Labs counted $6.36 billion in outflows, Elliptic $6.43 billion, and Chainalysis estimates ranged from a preliminary $5.912 billion to about $6.4 billion.
On the entry point, Binance's account is specific: a compromised DevOps engineer's laptop gave the attackers access to a service container used to submit unauthorized withdrawal transactions. Binance later said investigators had found additional points of breach beyond that laptop. Attribution came fast. TRM Labs and Chainalysis both pointed to TraderTraitor, a North Korea-linked group, with high confidence, and on 31 October the FBI made it official with a cyber alert titled "North Korea Responsible for $6 Billion+ Binance Attack."
The recovery, day by day
29 October 2026
After smaller, discreet test withdrawals earlier in the day, attackers drain about $6.3 billion from Binance hot wallets across ten networks in roughly 20 minutes. Binance suspends withdrawals; deposits stay open. Bitcoin falls about 3 to 5% on the day and BNB about 8%.
30 October 2026
Binance publishes its first recovery update: more than $6.34 billion of company resources set aside, about 80% of the stolen assets already covered, with $5 billion of it already held in the same tokens that were taken. For context, the last pre-hack proof of reserves snapshot (1 October, 55 assets) had shown BTC at 100.35%, USDT at 103.88%, and total reserves of about $165 billion.
31 October 2026
The FBI publishes its cyber alert attributing the theft to North Korea's TraderTraitor group. Binance reports replenishment at about 90% and publishes a fresh proof of reserves snapshot (31 October, 10 major assets) showing thinner margins, including BTC at 100.04%. Binance says future withdrawals will route through new wallet addresses.
1 November 2026
Withdrawals reopen in phase one: 15 networks, Bitcoin first. Replenishment reaches about 95%. Binance commits to restoring the SAFU fund to around $1 billion after its partial deployment in the recovery.
2 November 2026
The zero-knowledge proof for the 31 October reserves snapshot is completed, so holders of those 10 tokens can verify their own balances. Fiat withdrawals reopen for USD, AED, VND, PHP, and IDR. Binance issues a scam advisory, warning that fraudsters are exploiting the phased reopening schedule.
3 November 2026
Phase two withdrawals open, covering more than 100 asset and network combinations across nine networks. Binance says withdrawals have normalized. Reuters tallies about $4.72 billion in net customer withdrawals since the reopening, roughly 3% of platform assets, while Binance's own figures show hourly deposits overtaking withdrawals from early on 3 November.
4 November 2026
Binance reports about 98% of the stolen assets replenished. A new proof of reserves snapshot is taken, this time covering 44 tokens. Trade press notes withdrawals are still not fully reopened, despite the normalized description the day before.
5 November 2026
A third batch of withdrawals opens, including AAVE and UNI. The full zero-knowledge proof for the 44-token snapshot is still being generated, and the audit time and verification fields on Binance's public proof of reserves page remain blank.
Frozen is not the same as recovered
Two different pots of money get conflated in most coverage, and the distinction matters. The first pot is the replenishment: Binance's own money, used to make customer balances whole again. That reached about 98% by 4 November, per Binance's recovery updates. The second pot is the stolen crypto itself. About $2.8 billion of it (Chainalysis's count as of 3 November; Binance says about $3 billion) has been frozen on chain with help from Tether, Circle, and other issuers. Frozen means the attacker cannot move it. It does not mean Binance has it back, and no issuer has said when or whether those funds will be returned. TRM Labs estimates the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion, beyond the reach of any issuer freeze.
There is also an outflow story running underneath the recovery. Binance reported $3.64 billion in net outflows on the first day withdrawals reopened, and Reuters put net customer withdrawals at about $4.72 billion by 3 November, roughly 3% of platform assets. Across a wider window (1 to 3 November), Binance's own figures showed $10.97 billion withdrawn against $5.695 billion deposited, with hourly deposits overtaking withdrawals from 03:00 UTC on 3 November. DefiLlama's seven-day tally still showed about $11.83 billion in cumulative net outflows as of 5 November. In plain terms: users are testing the exits, and money is also coming back. Both things are true at once.
What this means if you hold funds on Binance
- Your balance should be whole. Binance says the stolen assets were replaced from company funds, not from customer deposits, and no losses were passed to users. About $127 million in less liquid tokens was still being sourced as of 4 November, so if you hold an obscure token, check its withdrawal status specifically.
- Withdrawals are reopening in batches, not all at once. If a withdrawal is unavailable for your asset or network, that matches the phased schedule Binance has been publishing since 1 November. A third batch opened on 5 November.
- You can verify part of the reserves yourself. The zero-knowledge proof for the 31 October snapshot (10 major assets) was completed on 2 November. The wider 44-token snapshot from 4 November still had no completed proof as of 5 November, and Binance's reserves page showed blank verification fields for it.
- Expect scams. Binance itself issued an advisory warning that fraudsters are exploiting the reopening schedule with fake support messages and phishing. Binance will not contact you first to 'restore' a withdrawal. Only use the official app and site.
- The structural lesson is unchanged. Binance absorbed a $6.3 billion theft better than any exchange in history could have a few years ago, and that is genuinely reassuring. It is still a custodian holding your keys. Keep trading balances on the exchange if you must, and keep savings in a wallet you control.
Sources
Recovery percentages, snapshot ratios, and reopening batches are from Binance's own Recovery Updates (30 October to 5 November 2026) and are attributed to Binance where they appear above. Analyst figures are attributed to their firms (TRM Labs, Chainalysis, Elliptic, DefiLlama). Independent reporting we relied on:
- CoinDesk: Potential multi-billion Binance hack hitting crypto markets (29 October 2026)
- USA Today: Binance hack and crypto wallet explainer (30 October 2026)
- Le Monde: Binance hack, what we know about the largest cryptocurrency theft in history (30 October 2026)
The Visit Binance link is an affiliate link. CryptosBeginner may earn a commission if you sign up through it, at no extra cost to you. This article is educational content, not financial advice.
Frequently asked questions
How much was stolen in the Binance hack?
About $6.3 billion. Binance's own incident reporting puts the figure at about $6.34 billion. Independent estimates are in the same range: TRM Labs counted $6.36 billion in outflows across ten networks, Elliptic put it at $6.43 billion, and Chainalysis estimates ran from a preliminary $5.912 billion to about $6.4 billion. It is the largest single crypto theft on record.
Did Binance users lose money in the hack?
According to Binance, no. The exchange set aside more than $6.34 billion of company money, drawn from its corporate treasury, a partial deployment of the SAFU emergency fund, and part of its futures insurance fund, and says it had replaced about 98% of the stolen assets by 4 November 2026. The unreplaced remainder is roughly $127 million in less liquid tokens that Binance says it is still sourcing. About $2.8 billion of the stolen crypto was frozen on chain, but frozen funds have not been returned to Binance, and that is separate from the replenishment Binance funded itself.
Can I withdraw from Binance now?
Withdrawals began reopening in phases on 1 November 2026: a first batch of 15 networks, fiat withdrawals on 2 November, a second phase covering more than 100 asset and network combinations on 3 November, and a third batch on 5 November. As of 5 November, withdrawals were still reopening in batches rather than fully restored for every asset and network. Binance said on 3 November that withdrawals had normalized, while trade press reported on 4 November that they were not fully reopened. Check the withdrawal status for your specific asset and network in the app.
Who carried out the Binance hack?
The FBI published a cyber alert on 31 October 2026 attributing the attack to TraderTraitor, a North Korea-linked hacking group. Blockchain analytics firms TRM Labs and Chainalysis reached the same attribution independently, both with high confidence. Binance says the attackers got in through a compromised DevOps engineer's laptop, which gave access to a service used to submit unauthorized withdrawal transactions, and that investigators later found additional points of breach.