***
Table Of Content
- What happened during the $6.3 billion Binance cryptocurrency hack?
- How has Binance managed to replace 90% of the stolen assets?
- Who is suspected of carrying out the record-breaking cryptocurrency theft?
- What does the Binance hack mean for customers and cryptocurrency security?
- When will Binance restore withdrawals, and what happens next?
Binance announced on October 31 that it had allocated more than $6.34 billion to replace the stolen assets, drawing on corporate reserves, its emergency protection fund and futures insurance resources. Ten major cryptocurrencies, including Bitcoin, Ethereum, XRP and Tether, are now fully backed, according to the company.
The attack affected the exchange’s online wallets, prompting an immediate suspension of withdrawals. Binance said approximately $3 billion in stolen assets had been frozen through cooperation with law enforcement and blockchain intelligence companies. Withdrawals are expected to resume on November 1, subject to security checks.
What happened during the $6.3 billion Binance cryptocurrency hack?
The cyberattack occurred on October 29 at approximately 20:05 UTC, when unauthorized actors gained access to Binance’s hot wallets and transferred digital assets valued at approximately $6.3 billion.
Hot wallets are cryptocurrency storage systems connected to the internet, allowing exchanges to process customer transactions quickly. Their online accessibility, however, makes them potential targets for sophisticated cyberattacks.
Binance initially identified a compromised employee laptop as a possible entry point. Subsequent investigations uncovered additional security breaches, suggesting the operation involved more than one vulnerability.
Co-chief executive Richard Teng described the incident as a complex attack involving sophisticated techniques designed to conceal evidence.
The attackers reportedly used malicious software capable of deleting traces of their activity, complicating efforts to reconstruct the sequence of events.
Binance immediately suspended withdrawals, restricted compromised infrastructure and strengthened internal security controls.
The $6.3 billion theft substantially exceeds the approximately $1.5 billion stolen from the Bybit exchange in February 2025, making it potentially the largest cryptocurrency exchange hack on record.
How has Binance managed to replace 90% of the stolen assets?
Binance has replenished approximately 90% of the affected cryptocurrency holdings by combining emergency reserves, insurance resources and funds from its corporate treasury.
The exchange announced on October 31 that it had allocated more than $6.34 billion to cover the financial impact of the attack.
Part of the funding comes from the Secure Asset Fund for Users (SAFU), an emergency reserve established in 2018 to protect customers during exceptional incidents.
Binance is also drawing on its futures insurance fund and corporate financial resources.
According to the company, ten cryptocurrencies are now fully backed: Bitcoin, Ethereum, Tether, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash.
The remaining 10% consists primarily of less-liquid tokens that are more difficult to purchase quickly in sufficient quantities.
Binance is acquiring replacement assets through cryptocurrency markets and over-the-counter transactions.
The company emphasized that replenishment is being financed by its own resources rather than by transferring losses to customers.
Who is suspected of carrying out the record-breaking cryptocurrency theft?
Investigators are examining possible links between the Binance attack and a North Korean state-backed hacking organization commonly known as the Lazarus Group or TraderTraitor.
Two blockchain intelligence companies have reported evidence suggesting the group’s involvement, although the attribution has not been conclusively established through a publicly announced law enforcement finding.
Lazarus has previously been associated with major cryptocurrency thefts, including the $1.5 billion attack against Bybit in February 2025.
American authorities attributed that earlier incident to North Korean cyber operatives.
Such groups have reportedly used social engineering, compromised employee devices and malicious software to access cryptocurrency platforms and digital wallets.
Binance said its investigation revealed multiple potential points of compromise rather than a single straightforward intrusion.
Meanwhile, the US Secret Service is working with private-sector specialists to identify suspects and trace stolen assets.
Approximately $3 billion has already been frozen, according to Binance.
North Korea has consistently rejected accusations that it conducts state-sponsored cryptocurrency thefts, and responsibility for the latest attack remains under investigation.
What does the Binance hack mean for customers and cryptocurrency security?
The attack raises serious questions about the security of centralized cryptocurrency exchanges, particularly their dependence on internet-connected wallets and internal access controls.
For Binance customers, the immediate concern is whether their holdings remain fully backed and whether normal withdrawal services can resume safely.
The exchange says it will absorb the financial losses and has already replenished its holdings of ten major cryptocurrencies.
However, replenishing reserves does not automatically mean that all operational risks have been eliminated.
Security specialists must still determine how attackers accessed the affected systems and whether additional vulnerabilities remain.
The incident also demonstrates the limitations of relying solely on private keys and conventional wallet security when employee devices or internal infrastructure may be compromised.
Binance has published an updated proof-of-reserves snapshot to provide greater transparency about customer asset backing.
The company expects the accompanying cryptographic verification to become available on November 3.
For the wider cryptocurrency industry, the breach could increase pressure for independent security audits, stronger operational controls and more transparent reserve reporting.
When will Binance restore withdrawals, and what happens next?
Binance expects to resume customer withdrawals on Sunday, November 1, 2026, provided its remaining security assessments are completed successfully.
The exchange suspended withdrawals following the attack to prevent further unauthorized transfers and allow security teams to investigate compromised systems.
Other unaffected platform services have remained operational, according to the company.
Before reopening withdrawals, Binance must verify the integrity of its infrastructure, strengthen access controls and confirm that identified vulnerabilities have been addressed.
The company has also promised to replace the remaining 10% of stolen assets, although it has not announced a definitive completion date.
Its updated proof-of-reserves system is expected to allow customers holding ten major cryptocurrencies to verify that their assets are backed at least one-to-one.
Meanwhile, investigators will continue tracing stolen funds and examining evidence potentially linking the attack to organized cybercriminal groups.
The reopening of withdrawals will represent an important operational milestone, but the longer-term challenge will be restoring customer confidence and demonstrating that similar security failures can be prevented.
