Binance Withdrawals Resume After $6.3 Billion Hack

Binance customers waited three days to get at their crypto. On Sunday, the doors opened, and billions of dollars walked out. Still, the rush was smaller than some had feared.

Binance withdrawals restarted in phases early Sunday, Nov. 1, after a hack late Thursday that the exchange puts at about $6.3 billion, the largest crypto theft on record. We covered the attack itself, including how it happened and how it compares with past heists, in our Binance hack explainer. Here's what changed over the weekend and what it means if you have money on the platform.

Which Binance withdrawals are working

Binance is reopening one network at a time. The first window ran from 6 a.m. to 9 a.m. UTC Sunday, according to CoinDesk, and covered:

• Bitcoin (BTC)
• Ether (ETH)
• Tether (USDT) and USD Coin (USDC) on the busiest networks
• BNB and XRP

Reuters said the first phase covered 15 tokens in all, dogecoin among them, chosen by how much users had asked for them over the past week. Other assets come later, and only after each blockchain clears its own security and stability checks.

The rollout isn't uniform. On Sunday morning, Binance's network status page showed a patchwork of normal, partially suspended and fully suspended entries, TechCrunch reported. Bitcoin was still listed as partially suspended at one point, while ether deposits were normal. Binance also told users to expect delays and slower processing because of traffic.

How much money left Binance

This was the number everyone was watching, because it shows whether customers still trust the exchange. Binance said that between 6 a.m. and 3:30 p.m. UTC it processed $4.6 billion in withdrawals and $1.0 billion in deposits. That's a net outflow of about $3.6 billion, which Binance put at 2.1% of the assets it holds.

Reuters reported the net figure as $3.64 billion and said Binance described withdrawals as stabilizing after an early spike. Binance reported $171 billion in total assets under management as of Oct. 28.

Not everyone agrees on the math. Analytics site DefiLlama showed outflows of $4.36 billion. A Binance spokesperson told Reuters that figure is inaccurate because it doesn't account for funds the exchange moved into its own new hot wallet.

For a platform with 335 million registered users, losing about 2% of assets in a day after a record hack is a big number but not a bank run. The next few days will say more than the first one.

Who's paying for the stolen crypto

Binance keeps repeating one line: "Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users."

By Sunday it said it had replaced about 95% of the stolen assets, up from 90% a day earlier, by buying replacement tokens. The remaining 5% sits in less liquid tokens outside its top 10 holdings, which take longer to buy in size through market and over-the-counter trades, CoinDesk reported. Binance says balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed.

The money came from three places, according to Reuters: Binance's Secure Asset Fund for Users (SAFU), a roughly $1 billion bitcoin reserve kept for emergencies like this, part of its futures insurance fund, and its corporate treasury. Co-CEO Yi He said half of SAFU was used, and the company says it will refill the fund to about $1 billion. In all, Binance says it set aside about $6.34 billion.

About $3 billion of the stolen funds is frozen, mostly USDT and USDC, which their issuers can lock. Bitcoin and ether can't be frozen the same way.

FBI names North Korea's TraderTraitor

The other big development came Saturday. The FBI said a North Korean state-sponsored group known as TraderTraitor was behind the attack, and that agents had watched the group convert stolen assets into ether, with "further laundering" expected, Reuters reported. Blockchain analytics firms TRM Labs and Chainalysis had already pointed to the same unit.

President Donald Trump struck a different note later Saturday. "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," he told reporters. North Korea has long denied using cyber units for theft.

Co-CEO Richard Teng has called the breach a "complex attack" that involved a compromised laptop and malicious software built to erase traces of its activity. Binance founder Changpeng Zhao, who was pardoned by Trump last year after his U.S. conviction for anti-money-laundering failures, publicly thanked U.S. law enforcement for helping track and freeze funds.

What Binance users should do now

A few practical points, based on what Binance has said:

1. Check the official network status page before withdrawing. A coin can be open on one network and suspended on another.
2. Expect slow processing. A delay isn't necessarily a failure, so avoid resubmitting the same withdrawal repeatedly.
3. Watch for scams. Big hacks bring fake "refund" and "recovery" messages. Binance says losses won't be passed on to users, so treat any message asking for your login or seed phrase to "recover" funds as phishing.
4. Look for the proof-of-reserves report. Binance has promised a fuller report showing it holds what it owes customers, plus a detailed incident report once its investigation ends.

The theft is also part of a bigger pattern. Attackers stole $2.9 billion in crypto across nearly 150 incidents last year, according to TRM Labs, and this single hack is more than double that. Whether Binance can buy back the last 5% and publish reserves that satisfy skeptics will decide whether Sunday's $3.6 billion exit stays a one-day number.