USD
Binance Prepares to Reopen Withdrawals After $6.36 Billion Hack
Exchange moves to reopen after the largest hack in crypto history
TL;DR
- Binance expects to resume cryptocurrency withdrawals within 45 hours after the $6.36 billion hack.
- The exchange reserved more than $6.34 billion separately from roughly $3 billion in frozen assets to cover the losses.
- Binance is buying replacement tokens before issuing updated proof of reserves, while its investigation has uncovered additional breach points.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Binance said on Oct. 30 that it remains on track to reopen cryptocurrency withdrawals within 45 hours after approximately $6.36 billion was stolen across 10 blockchains a day earlier in what TRM Labs described as the largest crypto hack in history. Deposits are operating normally, while withdrawals remain paused as Binance completes security checks and overhauls its withdrawal infrastructure.
The exchange has committed to cover all losses through company resources and its Secure Asset Fund for Users, or SAFU. It has reserved more than $6.34 billion in company funds and is buying replacement tokens before publishing updated proof of reserves.
Hack Unfolds Across 10 Blockchains
The attack began on Oct. 29, 2026, at 20:05 UTC, according to TRM Labs, with most of the stolen assets leaving Binance-associated wallets during a roughly 20-minute window. TRM valued the total theft at approximately $6.36 billion using asset prices at the time of each transfer.
Ethereum accounted for the largest portion of the losses. The network saw $3.79 billion in affected assets, including 200,630 ETH and 185 other tokens. Those tokens included 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. Bitcoin outflows totaled 18,270 BTC, valued at about $1.47 billion.
TRM said another wave of transfers reached Avalanche and Polygon at around 23:05 UTC. Investigators traced preparations for the operation back at least 36 hours, including small Tornado Cash withdrawals, deployment of attack code and rehearsals before the main theft. Five Binance wallets also transferred 233.46 million XRP to a single attacker address during activity on the XRP Ledger.
On Ethereum, TRM said the attacker used EIP-7702 delegations to make a Binance hot wallet execute attacker-controlled code. At 20:20 UTC, the operator submitted 50 pre-signed authorizations. One matched the wallet's transaction count and activated a sweeper contract controlled by the attacker.
Three minutes and 24 seconds later, one sweep moved 167,464 ETH and 63 tokens, including 1.615 billion USDT. The delegation stayed active and enabled six additional sweeps as more assets entered the wallet. A separate smart account controlled by the compromised wallet contained 823 million USDC, which Circle later froze.
Transactions on other blockchains used ordinary valid signatures. TRM assessed that the attacker likely gained access to Binance's hot-wallet signing infrastructure across multiple chains.
Billions Frozen as Binance Starts Recovery
Asset freezes began quickly after the attack. Binance said late on Oct. 29 that the verified value frozen had reached $2.54 billion, after earlier public figures included $1.8 billion. The figure subsequently climbed to roughly $3 billion as token issuers, networks and industry partners restricted additional stolen assets.
TRM's tally included $2.67 billion in stablecoins and about $30 million secured on Arbitrum. Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. First Digital also confirmed that it froze FDUSD involved in the attack. Arbitrum's Security Council removed 8,426 ETH and 74.6 million ARB from the attacker's control.
The attacker had already sold about 325 million USDT through market makers and intent-based contracts for roughly 122,300 ETH. Another 60 million USDT was deposited into Aave before 19,762 WETH worth about $44.6 million was borrowed between 20:58 and 21:01 UTC. Aave subsequently froze affected markets as a precaution.
Binance suspended withdrawals while security checks and asset freezes were underway. Deposits were also temporarily suspended early on Oct. 30 before returning to normal. Binance later said outbound transfers stopped once withdrawals were paused.
The exchange initially said withdrawals could resume within 48 hours while it revamped the withdrawal service and related addresses. That estimate was later shortened to 45 hours.
Investigation Expands Beyond Laptop Theory
By early Oct. 30, Binance's preliminary investigation had pointed to a potentially compromised DevOps engineer's laptop. The exchange said the compromise may have allowed an attacker to enter an internal service container and submit unauthorized withdrawal transactions, but it found no evidence that wallet private keys had leaked.
Co-CEO Richard Teng later pushed back against the idea that one employee's access alone caused the theft. He said the breach involved “a more complex attack process” rather than a single “one-click” action and added that Binance's investigation had not attributed responsibility to any individual.
Binance subsequently said investigators had uncovered “additional points of breach,” making clear that the compromised-laptop theory did not explain the entire attack. The exchange said it continued gathering evidence with law enforcement.
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence. Chainalysis CEO Jonathan Levin also assessed that TraderTraitor likely carried out the theft, while the FBI previously attributed the $1.5 billion Bybit hack in February 2025 to the same group.
Chainalysis later said the attackers appeared to be using automation to launder the stolen funds. Its investigators observed thousands of transactions in a short period, with assets repeatedly moving between addresses and sometimes returning to wallets used earlier in the sequence.
On-chain investigator ZachXBT also said funds from the Binance hack and an earlier Bitget exploit had been commingled at the same address after moving through THORChain, which he said indicated the same actor was likely behind both incidents.
Binance Funds Losses and Moves Toward Reopening
By the morning of Oct. 30, Binance said it remained on track to resume withdrawals within 45 hours. Deposits were operating normally, and the exchange said user funds were safe.
“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected,” Binance said.
The exchange then detailed how it planned to restore its balance sheet. Binance said it had reserved more than $6.34 billion in company funds, with $5 billion already held in the exact tokens affected by the hack. The remaining shortfalls were being filled through exchange and over-the-counter purchases.
“Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels,” Binance said.
Importantly, that $6.34 billion allocation excludes assets that have already been frozen or otherwise protected. About $3 billion remained frozen, meaning Binance is funding replacement assets separately while law enforcement, issuers and industry partners continue trying to recover the stolen crypto.
Some replacement purchases could take longer because of low liquidity in certain tokens and OTC settlement times, Binance said.
Co-CEO Yi He said Binance was buying altcoins in quantities matching those stolen as it prepared an updated proof of reserves. She said the purchases were being made both through OTC transactions and exchanges, while SAFU and Binance's company holdings also contained substantial Bitcoin and Ether reserves. Another update is expected after the replacement purchases are completed.
Founder Changpeng Zhao separately pointed to additional company resources, including more than $1 billion worth of SPCX shares linked to Binance's earlier $500 million investment around Elon Musk's Twitter acquisition. Zhao later clarified that he was not saying Binance planned to sell the SpaceX stake.
Binance said it had begun recovering affected assets and continued working with law enforcement, token issuers, blockchain intelligence firms and industry partners to trace and freeze more funds. The exchange plans to publish updated proof of reserves after its replacement purchases and remediation work are completed.
This article has been refined and enhanced by ChatGPT.
