Binance Covers $6 Billion of $6.3 Billion Stolen in Hack as Withdrawals Resume November 1, 2026

Binance, the world’s largest cryptocurrency exchange, says it has covered $6 billion of the $6.3 billion stolen from its platform in what officials have described as the largest digital heist on record, and it has begun restoring customer withdrawals in phases from Sunday, November 1, 2026. The update marks a major step in the exchange’s recovery effort after a hack that the United States Federal Bureau of Investigation has blamed on a North Korean state-sponsored unit.

The exchange said it used company money to buy replacement tokens for the stolen assets, rather than passing the loss on to customers. Binance has repeatedly said it would bear the financial impact of the funds stolen in the hack, and the latest update shows most of that bill has now been met, even as a smaller, harder-to-replace remainder is still being worked through.

What Binance Has Covered So Far

Binance said on Saturday that it had already covered $6 billion of the impacted amount, after earlier reporting that it had covered around 90 percent of the stolen funds. The company said it has set aside around $6.34 billion of company funds internally to cover the losses, a figure that covers both the tokens already replaced and the work still under way on the remainder.

The remaining amount, now less than 10 percent of the total, consists of assets that are less liquid and may take longer to source in the required amounts, according to Binance. That distinction matters for customers waiting on smaller or thinner-traded tokens, because replacing those assets cannot always be done at the same speed as buying large, liquid tokens such as bitcoin and ether.

The remaining amount, now less than 10 percent of the total, consists of assets that are less liquid and may take longer to source in the required amounts, according to Binance.

Binance has also been working with industry partners to freeze some of the affected assets, with about $3 billion located as of Friday. Freezing stolen funds does not by itself return them to customers, but it can limit how much of the haul attackers are able to move or cash out while recovery efforts continue.

Withdrawals Resume in Phases

Binance said it would resume withdrawals on Sunday, with the first phase starting between 0600 and 0900 GMT and covering 15 cryptoassets. The first phase includes bitcoin, ether, BNB, Solana, XRP and dogecoin, along with other major tokens, giving most customers access to their best-known holdings first.

A phased return is a common approach after a major security incident, because it lets an exchange test its systems under real load and deal with any problems on a smaller set of assets before opening withdrawals more widely. For customers, the key question now is how quickly later phases follow and whether less-liquid tokens are restored on a similar timetable.

• Phase one of withdrawals starts Sunday, November 1, between 0600 and 0900 GMT.
• The first phase covers 15 cryptoassets, including bitcoin, ether, BNB, Solana, XRP and dogecoin.
• About $3 billion in affected assets had been located with industry partners as of Friday.
• Binance has taken a new proof-of-reserves snapshot as of 0000 GMT on October 31.

Where the Recovery Money Came From

The money spent buying replacement tokens came from using part of Binance’s $1 billion Secure Asset Fund for Users, known as SAFU, a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and the company’s own corporate treasury, the exchange said on X.

Co-chief executive Yi He said on Saturday that 50 percent of the SAFU funds would be used, while the company committed to replenishing the fund to return it to about $1 billion. That commitment is important because SAFU is meant to be a standing safety net: using it in a crisis is its purpose, but leaving it depleted would weaken protection against any future incident.

Binance also said it had taken a new snapshot of assets held on its platform as of 0000 GMT on October 31, as part of its proof-of-reserves process. Proof-of-reserves snapshots are designed to show that an exchange holds the assets it says it holds on behalf of customers, and fresh snapshots after an incident are closely watched by traders deciding whether to keep funds on a platform.

Who Was Behind the Hack

The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack, a finding covered in the FBI’s attribution of the Binance hack to North Korea’s TraderTraitor unit. North Korea has repeatedly been linked by Western officials to large cryptocurrency thefts, which investigators say are used to fund state programmes despite international sanctions, a pattern also visible in North Korea’s latest missile testing activity.

Binance co-chief executive Richard Teng has described the breach as a complex attack, and Yi He said it involved a compromised laptop and malicious software designed to delete evidence of its activity. That description points to a targeted intrusion rather than a simple password failure, and it raises questions for the wider industry about how exchanges protect the devices and credentials used by staff with access to sensitive systems.

What to Watch Next

The next milestones are the completion of later withdrawal phases, the sourcing of the remaining less-liquid tokens, and the replenishment of the SAFU fund to about $1 billion. Traders will also watch for the full proof-of-reserves publication and for any further updates on frozen assets, since those steps will shape confidence in the exchange after the largest theft in its history. For now, the central facts are clear: $6 billion of the $6.3 billion has been covered, withdrawals are resuming in phases, and a smaller remainder is still being sourced.