Binance users pulled nearly $3.8 billion off the exchange in roughly 10 hours after it began a phased restart of withdrawals on November 1, 2026, following an October 29 security breach that drained approximately $6.3 billion from its hot wallets.
The incident is widely seen as the largest theft in crypto history. Binance paused all withdrawals the same day as the breach and later began bringing services back for major assets.
What happened at Binance
On October 29, attackers emptied Binance hot wallets of approximately $6.3 billion. Hot wallets are connected to the internet so an exchange can process withdrawals quickly, while cold wallets remain offline. That connectivity makes hot wallets a target.
Binance froze nearly $3 billion of the affected assets and worked with stablecoin issuers Tether and Circle on recovery efforts. Stablecoin issuers can freeze tokens at the contract level, potentially locking stolen funds held in those tokens.
The breach was traced to a compromised laptop belonging to a DevOps engineer, according to the account of the incident. There was no leakage of private keys. Binance confirmed that deposits stayed active and unaffected throughout the incident.
Reopening and the rush of withdrawals
When withdrawals resumed on November 1, Binance made the biggest assets available first, including Bitcoin, Ethereum, USDT, USDC and BNB. Users responded quickly. Within about ten hours of the reopening, withdrawals totaled between $3.8 billion and $4 billion, according to the research findings, with the original report putting the figure at nearly $3.8 billion.
Loss coverage and reserves
Binance has pledged to cover the losses itself. The exchange said it would draw on its Secure Asset Fund for Users (SAFU), its futures insurance and its corporate treasury, with no costs passed on to customers.
Binance said it had replenished around 95% of the affected assets by early November. It also plans to publish an updated Proof of Reserves to help restore customer confidence.
North Korea connection
The FBI and blockchain analytics firms have linked the attack to TraderTraitor, a hacking group from North Korea. The same group was previously tied to the February 2025 Bybit breach, which saw around $1.5 billion stolen. The Binance incident is roughly four times larger.
What to watch
Binance processed billions in outflows within hours of reopening, while its claim of roughly 95% replenishment gives that ability some context. Still, nearly $3.8 billion leaving in ten hours shows that trust took a real hit. The research describes the market reaction as volatile, with the outflow reflecting ongoing trust issues.
The next markers to watch are the updated Proof of Reserves, whether the remaining frozen assets are recovered, and whether outflows slow over the coming days.
