Binance has started reopening customer withdrawals in phases, with bitcoin first, after a hack of roughly $6.3 billion that CoinDesk describes as a record. If you keep coins on the exchange, two questions matter now: is my balance intact, and how do I get at it safely? A third one is easy to overlook. Confusion like this is exactly what scammers use, so the fake "withdrawal help" messages may be a bigger danger to you than the hack itself.
What happened, in plain terms
According to Decrypt, the theft began on a Thursday afternoon US Eastern time. Attackers moved funds out of Binance's hot wallets (the internet-connected wallets an exchange uses for day-to-day withdrawals) across about 10 blockchains. Most of the money left within roughly 20 minutes.
Chainalysis and TRM Labs put the total near $6.4 billion, while Binance itself says $6.3 billion. Decrypt notes this is more than four times the previous record, the $1.5 billion Bybit theft in February 2025.
The attack hit Binance's own systems, not the blockchains. Co-CEO Richard Teng said the first findings pointed to a compromised laptop belonging to a DevOps engineer. That gave the attacker access to a service container used to submit unauthorized withdrawals. Teng later said the incident involved "additional points of breach" and was more complex than one employee's permissions. Binance has found no evidence that wallet private keys leaked.
TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korean state-linked group. According to The Block, TRM said several features of the attack resemble earlier incidents tied to North Korean hackers. Binance has not named a culprit itself.
Is your balance safe?
Binance's position is that customers lose nothing. CoinDesk reports that the exchange is absorbing the losses through corporate funds, futures reserves and its SAFU emergency fund, which keeps user balances whole. In a separate report, CoinDesk says Binance claims it has already replaced 90% of the stolen crypto. Teng's message to users was: "Your money is safe, and we're covering every loss."
The Block and Decrypt both say Binance has set aside more than $6.34 billion. About $5 billion of that is already held in the same kinds of tokens that were taken, and the exchange is buying the remaining $1.3 billion or so on the market and over the counter. The Block adds that this buying could take longer because of thin liquidity and settlement delays.
These are Binance's own statements, and the follow-through is what counts. Here are the figures reported so far:
| Item | Reported figure | Who reported it |
|---|---|---|
| Size of the theft | About $6.3 billion (Binance) to $6.4 billion (Chainalysis, TRM Labs) | The Block, Decrypt |
| Funds Binance has set aside | More than $6.34 billion | The Block, Decrypt |
| Already held in the affected tokens | About $5 billion | The Block |
| Still being bought | About $1.3 billion | The Block |
| Frozen by industry partners (not part of the reserve) | About $3 billion | The Block |
| Still controlled by the attacker | Around $3.3 billion (Elliptic estimate) | Decrypt |
| Share of stolen crypto replaced | 90% (Binance's claim) | CoinDesk |
The frozen funds and the money still loose
Stablecoin issuers can blacklist addresses, and several did. Tether's CEO Paolo Ardoino said it froze over $1.57 billion in USDT. Circle confirmed more than $800 million in USDC was frozen. Ripple's co-CEO Yi He said Ripple froze roughly $200 million, and World Liberty Financial worked with BitGo and others to freeze about $27 million in stablecoins plus $2 million in its own tokens, according to The Block.
Not everything can be frozen. Decrypt reports the attacker still holds more than 420,000 ETH and 18,270 BTC, along with other tokens, and has been moving funds through Tron and other networks. That does not change the promise to customers, since Binance says it is covering losses itself. It does mean the hacker has not been cut off from the money.
How the phased reopening works
CoinDesk reports that withdrawals are coming back in stages, with bitcoin first. The pieces we have do not list the order for other coins, so check the status of the specific asset you hold inside your account rather than assuming it is live.
According to Decrypt, Binance paused withdrawals to rebuild and retest its systems and is running a full security review. It aimed to restore withdrawals by Sunday and to publish a complete proof of reserves by Monday. Deposits kept working throughout. A proof of reserves is a published statement showing that an exchange holds the assets it owes customers. Look for it and for any independent commentary on it, because it is a better test than any slogan.
What this means for you: a practical checklist
You do not have to act in a panic. Binance says balances are intact, and a rush to the exit is when mistakes happen. Here is a calm order of operations.
- Open the app or site yourself. Use the official app you already have installed or a bookmark you made earlier. Do not click a link from an email, text or social media post.
- Check that your balance looks right. If something looks wrong, contact support through the official in-app channel only.
- Check your coin's withdrawal status. Bitcoin comes first, so other assets may still be paused. Waiting a little is normal.
- If you withdraw, copy the destination address carefully. Check the first and last characters and the network. Many people send a small test amount first, which is a sensible habit with any large transfer.
- Do not make new deposits you do not need. Deposits are open, but there is no reason to add money until you are comfortable with what has been published.
- Review account security. Use a unique password, app-based two-factor authentication and, where offered, withdrawal address whitelisting.
- Look for the proof of reserves. Read what independent analysts say about it, not only what Binance says.
Whether to keep funds on an exchange or in your own wallet is a personal decision about convenience and risk. This hack is a reminder that holding coins on an exchange means trusting that company's security.
Phishing: the scams to expect
When an exchange pauses withdrawals, people are anxious and looking for instructions. That is the moment fraudsters send messages that look official. The Block reported a separate case this week in which hackers hijacked about a dozen DeFi websites registered with Name.com and stole around $138,000. It shows that a familiar-looking web address is not proof of safety.
Be suspicious of any message that:
- tells you to "verify your account" or "confirm your wallet" to unlock withdrawals;
- offers compensation or a refund if you click a link or fill in a form;
- comes from a "support agent" who contacted you first, on social media or in a messaging app;
- asks for your password, a two-factor code or a recovery phrase;
- creates urgency, such as "act within 24 hours or lose your funds."
Binance says no wallet private keys were leaked, and it says it is covering losses itself. So there is no legitimate reason for anyone to ask you to pay a fee or send crypto to "recover" your balance. No real support team needs a code that proves you are logging in.
The wider picture
Decrypt says markets stayed fairly steady: bitcoin fell about 4% to around $76,400 on Friday. Analysts quoted there credit a larger, more mature market. TD Cowen said the breach exposed risks in exchange custody and cybersecurity but did not undermine the underlying usefulness of digital assets or blockchains.
On regulation, Decrypt reports that CFTC Chairman Michael Selig told CNBC the breach "proves our exact point" about the rules his agency proposed earlier this month, arguing that offshore exchanges need US oversight. The Block also notes that President Trump said officials are looking into the hack. Binance says it is cooperating with law enforcement worldwide, including the FBI and the US Secret Service.
FAQ
Is my money on Binance safe after the hack?
Binance says yes. It says customer assets were never touched and that it will cover every loss from company funds and its SAFU reserve, with more than $6.34 billion set aside. Those are the exchange's own commitments, so watch for the proof of reserves and independent analysis.
When can I withdraw from Binance?
Withdrawals are reopening in phases, according to CoinDesk, and bitcoin was first. Decrypt reports that Binance aimed to restore withdrawals by Sunday. If your coin is not live yet, check again inside the official app.
How do I avoid Binance phishing scams?
Only log in through the official app or a bookmark you saved yourself. Ignore unsolicited messages about compensation or account verification, and never share passwords, two-factor codes or recovery phrases. If you are unsure whether a message is real, skip it and check your account directly.
Sources
- CoinDesk: Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack
- CoinDesk: Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach
- The Block: Binance says it has $6.34 billion ready to cover hack losses
- Decrypt: Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History
Photo: Roger Brown / Pexels
I'm an Italian creator who builds apps, games and websites. I run Crypto Radar Daily with the help of AI tools: every article starts from the sources linked above, and I check what goes out. I'm not a doctor, a lawyer or a financial adviser. Spotted a mistake or have an idea? Write to me.
Instagram @spartaco_94_My websiteWrite to meAbout this blog