Binance targets November 1 to begin phased withdrawal restarts after absorbing a $6.3 billion hack — the largest theft in cryptocurrency history. The exchange has set aside $6.34 billion from three internal sources: its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, ...
"We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%." — Richard Teng, Co-CEO, Binance
Binance targets November 1 to begin phased withdrawal restarts after absorbing a $6.3 billion hack — the largest theft in cryptocurrency history. The exchange has set aside $6.34 billion from three internal sources: its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and corporate treasury. Customer balances in 10 major tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC — are reported fully backed at 1:1.
The recovery operation is being conducted under active FBI and U.S. Secret Service investigation, with the bureau attributing the attack to TraderTraitor, a North Korean state-linked hacking group previously responsible for the $1.5 billion Bybit theft in February 2025. Approximately $3 billion has been frozen on-chain, with Tether freezing $1.567 billion in USDT and Circle freezing approximately $823 million in USDC within hours of the breach.
A new Proof of Reserves snapshot was published at 00:00 UTC on October 31. The accompanying zero-knowledge proof — which allows individual users to verify their balances are included — requires 40 to 50 hours of computation and is expected by November 3.
The breach occurred on October 29, 2026. According to Binance and third-party analysis from TRM Labs, the attack originated from a compromised DevOps engineer's laptop, which gave the attacker access to a service container used to submit withdrawals. Co-CEO Richard Teng later clarified that the intrusion involved a more complex chain of access than a single set of credentials.
Preparation began at least 36 hours before execution. The attacker deployed and tested code on two wallets, rehearsed on a third, and routed test funds back to itself. Four hours later, the same code hit a Binance hot wallet. According to SecureWorld, approximately $3.3 billion left two Ethereum hot wallets between 20:24 and 21:04 UTC — a 40-minute window. Binance wallets on nine additional chains, using different key types and signing schemes, sent funds to attacker-controlled addresses through ordinary signed transfers.
TRM Labs' assessment: the attacker gained the ability to make Binance's hot-wallet signing system sign transactions of its choosing. Binance has not yet published its full technical post-mortem, stating it will do so once the investigation is complete.
Total estimated impact: $6.3 billion across 10 blockchain networks. This exceeds the previous record — the $1.5 billion Bybit hack of February 2025 — by more than four times.
Binance committed to absorbing the full financial impact rather than passing losses to users. According to Teng's October 30 video statement, the exchange reserved more than $6.34 billion from three pools:
| Source | Description | Status | |--------|-------------|--------| | SAFU | Emergency insurance fund holding ~15,000 BTC (~$1B), converted from USDC in February 2026 | Partially deployed | | Futures Insurance Fund | Covers liquidation shortfalls; Binance moved only the excess above required risk thresholds | Partially deployed | | Corporate Treasury | Direct company funds | Primary source |
Of the $6.34 billion reserved, approximately $5 billion is already held in the same cryptocurrencies that were stolen — BTC, ETH, USDT, BNB, SOL, USDC, XRP, and others — covering roughly 80% of the loss. The remaining 20% must be acquired through open-market purchases and over-the-counter (OTC) trades.
The exchange committed to restoring SAFU to approximately $1 billion after the recovery is complete. The Futures Insurance Fund retains sufficient capital to meet its risk-management requirements, according to Binance.
Withdrawals have been suspended since October 29. Binance targets November 1, 2026 for the phased restart. The reopening will proceed one token at a time, with each token undergoing security verification before its withdrawal channel is activated.
Key parameters of the restart:
The 10 fully backed tokens (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, ZEC) are expected to lead the reopening queue. Withdrawals for less-liquid tokens — where Binance is still acquiring replacement inventory — will follow as replenishment is completed.
As of October 31, total asset coverage stood at 90%. The remaining 10% gap consists primarily of long-tail tokens with lower liquidity, requiring additional time to source.
Binance published a new Proof of Reserves (PoR) snapshot at 00:00 UTC on October 31, 2026. The snapshot confirms that the exchange's 10 largest user assets are fully backed.
The verification system uses two components:
The zero-knowledge proof generation requires 40 to 50 hours of computation. Binance estimates availability by November 3. Until the ZK proof is published, the PoR snapshot relies on attestation rather than independent cryptographic verification.
This is a notable stress test for the PoR system. Exchange proof-of-reserves frameworks have been a subject of industry debate since the FTX collapse in November 2022. The current incident provides the first real-world test of whether a PoR system can maintain credibility during a major security event.
The FBI formally attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, on October 30. The same group was identified as responsible for the $1.5 billion Bybit hack in February 2025.
Frozen assets total approximately $3 billion — roughly 48% of the stolen amount:
| Entity | Amount Frozen | Asset | |--------|--------------|-------| | Tether | $1.567B | USDT | | Circle | ~$823M | USDC | | Other on-chain freezes | ~$610M | Various | | Total | ~$3B | — |
The FBI and U.S. Secret Service are actively investigating. Recovery of frozen funds is now a legal and diplomatic process. According to ComplexDiscovery, "getting it back becomes a legal project" — frozen on-chain assets require court orders, cross-border cooperation, and potentially years of proceedings.
CZ (Changpeng Zhao), Binance co-founder, publicly thanked Tether and Circle for the rapid freezes. The speed of stablecoin issuer response — hours, not days — has become a de facto emergency mechanism in the crypto industry, though it also highlights the centralized control points in ostensibly decentralized infrastructure.
BNB: Fell 8.7% to approximately $680 within hours of the disclosure on October 29. As Binance's native token, BNB trades as a proxy for confidence in the exchange. It was the worst performer among top-10 cryptocurrencies on the day. By October 31, BNB had partially recovered to $705.10. The token's market capitalization has declined 35% year-over-year.
Bitcoin: Dropped below $77,000 on October 29, according to Bloomberg and The Block. The decline reflected broader market sentiment rather than a direct BTC exposure, as Bitcoin's protocol was not compromised.
Equities: Coinbase (COIN) shares fell 12% on October 30. Robinhood declined approximately 9%. Strategy (formerly MicroStrategy) also dropped 12%.
Competitive dynamics: Wall Street analysts, including those at Standard Chartered, identified potential beneficiaries of a Binance user migration. Coinbase, Bullish, and Hyperliquid were cited as likely recipients of displaced trading volume. Notably, decentralized exchanges had already been gaining market share before the attack. Hyperliquid's HYPE token moved counter to the broader market, rising while most exchange tokens fell.
Standard Chartered's analysis projected that DEX volumes could accelerate as users reassess custodial risk.
The Binance hack's $6.3 billion figure dwarfs all previous incidents:
| Incident | Year | Amount | Outcome | |----------|------|--------|---------| | Binance | 2026 | $6.3B | Self-funded recovery in progress | | Bybit | 2025 | $1.5B | Covered from own funds; operations continued | | FTX | 2022 | ~$8B (misappropriation) | Collapsed; Chapter 11 bankruptcy | | Mt. Gox | 2014 | ~$500M | Collapsed; creditors waited 10+ years | | Binance | 2019 | $40M | Covered by SAFU; no user losses |
The pattern that emerges: exchanges that maintain sufficient reserves and insurance mechanisms survive. Those that do not — FTX, Mt. Gox — collapse. Binance's 2019 hack ($40M, covered by SAFU) was the precedent that led to the current emergency fund structure.
The critical difference between Binance 2026 and FTX 2022 is solvency. FTX could not cover withdrawals because customer funds had been misappropriated. Binance claims it can cover the full $6.3 billion from existing reserves and corporate funds. Whether users accept that claim depends on the Proof of Reserves verification due November 3.
Binance's recovery operation is unprecedented in scale. No exchange has previously attempted to self-fund a $6.3 billion loss in 72 hours. The phased withdrawal restart on November 1, if executed without incident, would mark the first time an exchange of this magnitude has resumed operations after a multi-billion-dollar breach.
Three verification milestones determine whether the recovery succeeds: the phased withdrawal process beginning November 1, the publication of the zero-knowledge proof by November 3, and the full replenishment of the remaining 10% of stolen assets across less-liquid tokens.
The incident has reignited the debate over centralized custody in crypto. Stablecoin issuers' ability to freeze $1.8 billion in hours demonstrates both the utility and the centralization risk embedded in digital asset infrastructure. The FBI investigation, attribution to a state-sponsored actor, and the scale of frozen assets suggest the legal recovery process will extend well beyond the operational restart.
For users, the immediate question is practical: whether Binance's withdrawals function normally starting November 1, and whether the November 3 proof-of-reserves verification confirms what the exchange has claimed. Everything else — competitive dynamics, regulatory implications, the law-enforcement timeline — follows from those two data points.