Binance began restoring withdrawals on Sunday, November 1, about three days after a hack that the FBI says cost the exchange more than $6 billion. The company says it has replenished roughly 95% of the affected assets and has completed a new proof-of-reserves check. If you hold coins on Binance or any other exchange, the useful question is what those promises actually cover, and what they leave open.
What happened, briefly
According to Decrypt, the FBI said North Korean hackers it calls TraderTraitor carried out the theft on or about October 29, 2026. Blockchain analytics firms TRM Labs and Chainalysis had reached the same conclusion a day earlier. The Block reports that onchain investigators say the attackers exploited Binance's internal systems and wallet-signing mechanisms, which makes this the largest known crypto exploit on record.
Reports put the stolen total at slightly different figures: more than $6 billion from the FBI, $6.3 billion from CoinDesk and TRM, and $6.4 billion from Reuters. All describe the same event.
Binance says it first suspected a compromised laptop belonging to a DevOps engineer. It has since found more points of breach, but says it found no evidence that wallet private keys were leaked.
Two promises, and what each one means
The reimbursement pledge. CEO Richard Teng wrote that Binance "will absorb the financial impact of the stolen funds, not our users." According to Reuters, as reported by Decrypt, Binance says it has raised $6 billion from its corporate treasury, an insurance fund and its SAFU emergency fund. The Block reports that about 95% of the affected assets have been replaced with the company's own funds. The remaining 5% is in less-liquid tokens that Binance is still working to acquire.
This is a promise from a company, backed by money it says it has set aside. It is not deposit insurance run by a government. The 5% gap shows that recovery was still in progress when the exchange reopened.
The proof of reserves. The Block says Binance completed a new zero-knowledge proof-of-reserves snapshot. Users holding BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can check for themselves that their balances are backed 1:1. Co-CEO Yi He said generating the full proof takes about 40 to 50 hours after each snapshot.
The check is useful because you can verify your own balance instead of trusting a statement. Its limits are also clear from the facts:
- It is a snapshot. Binance's previous report, dated October 28, showed $171 billion in assets. The hack came the next day. A clean report describes one moment, not future safety.
- It covers listed assets. The new proof names ten. If you hold something else, this particular check does not speak to it.
- It checks backing, not security. It says whether assets exist to match balances. It does not say whether the systems that move those assets can be breached.
Timeline at a glance
| Date (2026) | What happened |
|---|---|
| October 28 | Date of Binance's latest proof of reserves before the hack: $171 billion in assets |
| On or about October 29 | Hack of more than $6 billion; withdrawals suspended; Tether and Circle freeze stolen stablecoins |
| October 31 | FBI names TraderTraitor; Binance takes a new reserves snapshot |
| November 1 (Sunday) | Phased withdrawals begin at 1 a.m. ET; all 15 first-phase networks and assets live by 7:36 a.m. ET; $4.649 billion withdrawn and $1.01 billion deposited in the first nine and a half hours |
| November 2 (Monday) | Fiat withdrawals restored in several currencies, including U.S. dollars; zero-knowledge proof completed for 10 assets; about 95% of affected assets replenished |
| Tuesday and Wednesday | Binance expects to restore more networks and assets on Tuesday and to run another reserves snapshot on Wednesday |
What the withdrawal numbers say
Binance said the first-day net outflow of about $3.64 billion equalled 2.1% of its $171 billion in reported assets. It also said volumes were stabilising after an initial spike. DefiLlama data cited by The Block shows 24-hour net outflows falling to about $3.29 billion, down from a peak near $7 billion.
Treat the wallet-tracking figures carefully. CoinDesk, citing DefiLlama, reported that more than $6 billion left Binance-linked wallets in 24 hours. It added that such figures can include transfers between Binance's own wallets. Meanwhile, rival exchanges OKX and Bybit saw net inflows of about $450 million and $134 million during the reopening, according to Decrypt.
The risk that stays when coins sit on an exchange
When you leave coins on an exchange, you are trusting its security, its finances and its honesty at once. In this case the money was stolen from the exchange's own systems, not from individual customers. Users still could not withdraw for days while the exchange reviewed its infrastructure.
That delay is the main cost of exchange custody. Even when losses are covered, you cannot move your funds until the company says so. Self-custody removes that dependency but replaces it with your own responsibility for keeping a recovery phrase safe and avoiding phishing.
CoinDesk framed the wider debate this way: are exchanges less secure than banks, or just harder to protect once attackers get inside? The Block quoted StoneX analysts saying the response by stablecoin issuers, DeFi protocols and Binance was faster and better coordinated than anything the industry had managed before. Decrypt notes that Circle and Tether can blacklist addresses to stop their tokens moving. Reuters reported that Circle froze more than $1.1 billion in USDC, a figure that grew from the roughly $823 million first reported. That helps with stablecoins, but it does not apply to every asset.
The attackers' methods also reach ordinary people. Binance's chief security officer, Jimmy Su, told Decrypt in 2025 that North Korean operatives contacted employees daily on LinkedIn, sometimes using fake job interviews to deliver malware. Fake offers and fake "official" messages are a standard route for scammers.
What this means for you
- Verify the proof yourself. If you hold one of the ten listed assets on Binance, use the official proof-of-reserves tool to confirm your balance is included, and check again after the next snapshot.
- Know what you hold where. Write down which coins sit on which exchange. Check whether each is covered by that exchange's proof of reserves.
- Separate what you need quickly from what you do not. Money you may need on short notice is hurt most by a suspension. This is a risk question, not a signal to buy or sell anything.
- Turn on every account protection. Use an authenticator app or security key, withdrawal address allowlists and anti-phishing codes where offered.
- Distrust urgent messages. Expect fake emails, texts and social posts about "withdrawal problems" or "compensation." Open the exchange only by typing the address or using your saved bookmark.
- If you consider self-custody, learn how recovery phrases work first, and test with a small amount. Nobody can reset a lost phrase for you.
- Keep records. Save statements and transaction histories from any exchange. You will need them for tax reporting and for any dispute.
FAQ
Are my coins on Binance safe now?
Binance says it has replaced about 95% of the affected assets and will absorb the loss rather than users. It also says it found no evidence that wallet private keys leaked. The remaining 5% was still being acquired, and the company was still reviewing its security. No exchange can promise zero risk, so the safer approach is to understand your exposure rather than assume it away.
What does proof of reserves actually prove?
It shows that an exchange holds assets matching customer balances at the time of the snapshot. For Binance's latest proof, users of ten listed assets can verify their own balances are backed 1:1. It does not prove the exchange's systems are secure, and it does not cover later events. Binance's previous report was dated October 28, the day before the hack.
Were stolen funds recovered?
Partly. Binance's CEO said on Friday that about $3 billion had been located or frozen with industry partners. The Secret Service said a significant portion was frozen within minutes. Chainalysis reported that the hackers were laundering funds across chains, so recovery is ongoing and incomplete.
Sources
- Decrypt: FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals
- The Block: Binance completes latest proof of reserves as it works to restore assets, withdrawals after record hack
- Decrypt: Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million
- CoinDesk: Why stealing billions from a crypto exchange can be harder to stop than a bank theft
Photo: Bastian Riccardi / Pexels
I'm an Italian creator who builds apps, games and websites. I run Crypto Radar Daily with the help of AI tools: every article starts from the sources linked above, and I check what goes out. I'm not a doctor, a lawyer or a financial adviser. Spotted a mistake or have an idea? Write to me.
Instagram @spartaco_94_My websiteWrite to meAbout this blog