Binance has begun restoring cryptocurrency withdrawals after suspending the service for about 48 hours following a security breach that affected an estimated $6.3 billion in digital assets.
The exchange reopened withdrawals in phases on Sunday, November 1, after completing security checks and replenishing about 95% of the affected assets.
The incident, which Binance initially linked to a compromised DevOps engineer’s laptop, has been described as one of the largest cryptocurrency thefts on record.
The exchange company has said it will cover the losses with its own resources and will not pass them on to customers.
How Hackers Gained Access to Binance’s Systems
Binance’s investigation traced the beginning of the attack to June 2026, when hackers compromised an engineer’s computer through a tampered installation of Homebrew, a software package manager commonly used by developers. The engineer had downloaded the modified software while attempting to install an AI coding tool.
Although Binance detected the suspicious activity, replaced the affected device, and changed the compromised credentials, the incident still exposed information about the engineer’s responsibilities and other members of the development team.
Then, in September, the attackers used this information to target another employee through a fraudulent recruitment process. They contacted the engineer through a legitimate job-hunting platform, impersonated company executives, and invited the employee to participate in technical interviews.
During the second interview, the employee was instructed to download a coding assignment containing a malicious software repository. But installing the files compromised the engineer’s work computer and gave the attackers another entry point into Binance’s internal systems.
By October 20, the hackers had used the compromised computer and an internal AI tool to gain control of two additional engineers’ devices. This gave them access to credentials and permissions associated with Binance’s wallet development infrastructure.
The FBI has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, although the North Korean government has rejected the allegations, describing the accusation as politically motivated. But Binance is continuing its investigation and has said it will publish a detailed post-incident report after the facts have been fully verified.
Binance Restores Withdrawals in Phases
Binance began the first phase of withdrawal restoration between 6:00 a.m. and 9:00 a.m. UTC on November 1. The company said services would return progressively depending on the network and asset involved, while some cryptocurrencies could continue to show partial or full withdrawal restrictions.
The phased approach followed enhanced security reviews of affected services and checks on the withdrawal infrastructure, with the company also warning users to expect temporary delays as it dealt with higher traffic during the restoration.
For some of the services that were restored, Bitcoin withdrawals on the Bitcoin network, alongside with ether and some dollar-backed stablecoins on Ethereum. Other assets remained partially suspended as the exchange continued its checks.
Exchange Replenishes Most Affected Assets
Binance said it had replenished approximately 95% of the affected assets by the time withdrawals resumed, up from 90% in its previous update.
The remaining 5% consists largely of less liquid tokens that Binance said take longer to source in the required quantities, especially as the exchange company has been purchasing the outstanding assets through market and over-the-counter channels.
Binance has also said it set aside about $6.34 billion to cover the losses, with the replenishment including company resources and a partial deployment of its Secure Asset Fund for Users, known as SAFU. The company also said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed at 1:1.
Customers Withdraw Billions After Services Return
The restoration has also triggered significant withdrawals from the cryptocurrency exchange company.
Binance processed about $4.65 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours after withdrawals reopened, resulting in a net outflow of approximately $3.64 billion.
By Monday, its customers had withdrawn a net $4.72 billion, representing roughly 2.8% of assets held on the platform. Binance also reported that $2.7 billion had flowed back into the exchange.
On the one end, the figures show that customers moved substantial amounts of cryptocurrency after withdrawals became available again. On the other end, it was reported that the outflows had still not triggered widespread panic across the broader crypto market.
For now, Binance says it is focused on completing the recovery of the remaining affected assets, restoring normal withdrawal services, and strengthening its security controls following the breach.
