Binance Cyberattack: Withdrawals Resume After $6.3 Billion Cryptocurrency Breach

11:20

Binance has begun restoring cryptocurrency withdrawals following a major cyberattack that resulted in the theft of approximately $6.3 billion in digital assets, marking a significant step in the exchange’s efforts to stabilize its services and reassure customers.

The recovery process, launched on November 1, 2026, is being implemented gradually, with access restored according to individual cryptocurrency networks and the completion of security assessments. The company says it has already replaced approximately 95% of the stolen assets and intends to cover the remaining losses using its own financial resources.

Withdrawal Services Gradually Return

The world's largest cryptocurrency exchange temporarily suspended deposits and withdrawals after detecting suspicious activity involving its digital asset wallets on October 29.

The decision was taken to contain the incident, assess the extent of the damage and strengthen security measures before allowing customers to move their funds again.

Under the recovery plan, Binance is reopening withdrawal services in stages. The initial phase covers 15 blockchain networks, including Bitcoin, Ethereum, Solana, BNB Chain and several other major networks.

The exchange warned that customers could experience temporary delays as transaction volumes increase during the restoration process. Additional cryptocurrencies and networks are expected to become available once the necessary technical and security checks have been completed.

Binance Commits to Covering the Financial Losses

In an effort to reassure its international customer base, Binance confirmed that it would absorb the financial consequences of the stolen assets rather than transfer the burden to users.

The company reported that approximately 95% of the affected funds had been replenished by November 1. The remaining 5% consists largely of less liquid cryptocurrencies that require additional time to acquire in sufficient quantities.

Binance has also acknowledged the assistance of other cryptocurrency companies in tracking suspicious transactions and freezing assets associated with the attack. According to the exchange, industry cooperation has helped immobilize approximately $3 billion in stolen funds.

The company plans to release a comprehensive report once its internal investigation has been completed.

FBI Attributes the Attack to North Korean Hackers

The security incident has also attracted the attention of American law enforcement authorities. The Federal Bureau of Investigation (FBI) attributed the theft to TraderTraitor, a cybercriminal group linked to North Korea.

Investigators reported that the attackers were converting stolen cryptocurrencies, primarily into Ethereum, as part of efforts to move the assets through the digital financial ecosystem.

The FBI has called on cryptocurrency businesses and other private-sector organizations to identify and block transactions connected to the addresses used by the suspected perpetrators.

The attribution adds an international security dimension to the incident, highlighting the growing challenges facing cryptocurrency platforms as cybercriminal networks develop increasingly sophisticated methods of targeting digital financial infrastructure.

Billions in Withdrawals Put Binance Under Market Scrutiny

The reopening of withdrawal services has provided an early indication of customer activity following the breach.

During the first nine and a half hours after withdrawals resumed, Binance processed approximately $4.65 billion in withdrawals, compared with around $1.01 billion in deposits. This resulted in net outflows of approximately $3.64 billion.

Although the figures reflect substantial demand for access to customer funds, Binance said withdrawal activity began stabilizing following the initial surge.

The incident nevertheless raises broader questions about cybersecurity, operational resilience and customer confidence across the cryptocurrency industry. For Binance, the immediate challenge is not only to complete the recovery of affected assets but also to demonstrate that its security infrastructure can withstand future attacks.

The exchange's gradual restoration of services represents an important operational milestone, although the full investigation and remaining recovery measures are still underway.