A week after the biggest crypto theft on record, Binance has started letting customers take their money out again, and many of them did exactly that.
The exchange began restoring withdrawals in phases on Sunday, November 1, after freezing deposits and withdrawals when hackers stole $6.3 billion in crypto from its wallets. By mid-afternoon UTC, it had processed $4.65 billion in withdrawals against $1.01 billion in deposits, for net outflows of about $3.64 billion.
Here is what we know, based on reporting from TechCrunch and CNBC, plus practical steps for anyone with an account on any exchange.
How the reopening worked
Binance restarted withdrawals at 6 a.m. UTC on Sunday, beginning with 15 networks and assets in a first phase. CNBC reported that all of them were live by 12:36 p.m. UTC, while testing continued for the remaining networks and assets.
TechCrunch noted that on Sunday morning, Binance’s network status page showed a mix of normal, partially suspended and fully suspended services, and the company warned users to expect “temporary delays or longer processing times due to traffic volume.”
“Resuming withdrawals is a major milestone, but our work continues,” Binance said.
How big were the outflows?
Between 6 a.m. and 3:30 p.m. UTC, Binance said, users withdrew $4.65 billion and deposited $1.01 billion. The resulting $3.64 billion in net outflows equalled about 2.1% of its roughly $171 billion in total assets, based on its proof-of-reserves data as of October 28, according to CNBC.
The exchange said withdrawal volumes declined and stabilised after an initial spike. Binance founder Changpeng Zhao wrote on X that “98% choose to stay!” and said most of the outflows came in the first couple of hours.
Who pays for the stolen funds?
Binance has said it will absorb the loss. “Binance will bear the financial impact of the stolen funds,” the company said, according to TechCrunch. “These losses will not be passed on to users.”
It said it has now covered about 95% of the stolen assets, up from 90% in an earlier update. The remaining 5% consists of less liquid tokens that take longer to buy in the quantities required.
Stablecoin issuer Circle told CNBC it had coordinated with law enforcement to freeze more than $1.1 billion in USDC associated with the incident.
Who was behind it?
The FBI attributed the attack to a North Korean group known as TraderTraitor, and said the group was converting the stolen assets mainly into Ethereum, with further laundering likely, TechCrunch reported. Binance said it will publish a more detailed incident report once its investigation is complete.
What any exchange user can do now
Whether or not you use Binance, a hack this size is a good prompt to review your own security. None of this is financial advice, and it can’t guarantee safety, but these basics reduce common risks:
- Use an authenticator app or hardware security key for two-factor login, rather than SMS codes where possible.
- Turn on withdrawal address allowlists, so funds can only be sent to addresses you have approved in advance.
- Watch for phishing. Big incidents attract scammers posing as support staff or “recovery services.” Never share passwords, seed phrases or two-factor codes, and type the exchange’s web address yourself.
- Check official channels only for status updates, such as the exchange’s verified status page and accounts.
- Learn the difference between custodial and self-custody storage. Funds held on an exchange depend on that exchange’s security; self-custody puts the responsibility on you, including keeping your recovery phrase safe offline.
- Expect delays during recovery periods and avoid rushing transactions you haven’t double-checked.
What to watch next
Key questions now are whether the remaining networks reopen smoothly, whether Binance sources the last 5% of affected assets, how much more stolen crypto investigators can freeze, and what the promised incident report reveals about how the breach happened.
The bottom line
Binance has cleared a major hurdle by reopening withdrawals and covering most of the stolen funds, but the record hack is a reminder that security in crypto depends on both the platforms and the people using them.
Image: Cryptocurrency logos by voytek pavlik via Wikimedia Commons, Public Domain Mark 1.0
