Binance hack: $6.3bn in assets hit, withdrawals resume — and $3.64bn flows out on the first day back
Binance, the world's largest cryptocurrency exchange, resumed withdrawals on Sunday 1 November 2026 after suspending all transactions following a hack that hit about $6.3 billion worth of digital assets — described by the BBC as the largest hack in history. In its own figures, posted on X, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on Sunday, a net outflow of approximately $3.64 billion, which CNBC calculates as 2.1% of the exchange's $171 billion in total assets. Binance says it has covered around 95% of the stolen assets and will fully cover the losses. The FBI attributes the attack to TraderTraitor, a North Korean group also known as the Lazarus Group — an attribution this page carries as the FBI's position, not as an independently verified finding.
Checking in progress
This story is still being checked. Claims below are published as claims — never dressed as facts — and each one moves only when the evidence earns it.
- Collecting reportsDone
- Grouping the versionsDone
- 3Checking claims10 of 12 claims checked
- 4Human gateStill to come
10 of 12 claims checked so far · step 3 of 4: Checking claims
Key points
- The hack hit about $6.3bn in digital assets — the largest in history, per the BBC — and Binance suspended all transactions before resuming withdrawals in phases on Sunday 1 November.
- First day back, Binance's own figures: $4.649bn withdrawn, $1.01bn deposited between 06:00 and 15:30 GMT — a net outflow of about $3.64bn, or 2.1% of its $171bn in total assets (CNBC).
- Binance says it has covered around 95% of the stolen assets and will fully cover the losses, funding the replacement from its corporate treasury and insurance/emergency funds.
- Attribution is not settled on this page: the FBI blames North Korea's TraderTraitor/Lazarus Group — carried as the FBI's position, labelled Not yet verified. Pyongyang has now denied it directly — Kim Yo Jong, via KCNA: 'an absurd rhetoric and nothing new' (Reuters).
What happened
Binance is the world's largest cryptocurrency exchange, with hundreds of millions of registered users; the BBC notes it said in 2024 that it held more than $160 billion in assets in custody. A theft on this scale — about $6.3 billion — is roughly four times the $1.5 billion taken from Bybit in 2025, which the BBC reports was also attributed to the Lazarus Group.
Sunday's reopening was the first real test of confidence: customers withdrew billions within hours, but deposits also topped $1 billion in the same window, and Binance says the outflow spike faded as the day went on. Founder Changpeng Zhao wrote on X that '98% choose to stay' — the exchange's own framing of the same figures, carried here as its position.
Claim by claim
Why this label: The $6.3bn figure and the suspension are reported identically by the BBC and CNBC, both read in full in this pass, and match Binance's own account of the incident (hot wallets compromised, per its recovery updates reported by CNBC). The 'largest in history' framing is the BBC's.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: These are Binance's own figures, posted on X and reported identically by the BBC and CNBC, both read in full. CNBC adds the scale: the net outflow was 2.1% of Binance's $171 billion in total assets, based on its latest proof-of-reserves data as of 28 October. The flow figures are the exchange's own numbers, not an independent on-chain audit read for this page.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as Binance's own stated position and progress, reported by both the BBC and CNBC: the 95% coverage, the less-liquid remainder, the $6.34bn reserved and the funding sources are the company's account of its own response. Whether the replenishment is complete and independently audited is a separate question — see What we don't know.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Show all claims (9 more)
Why this label: This is the FBI's attribution, reported by the BBC and CNBC and, in Reuters' Monday report read in this run, supported in analysts' view by US blockchain firms TRM Labs and Chainalysis, who said the theft — the bulk of it in around 20 minutes late on Thursday — bore similarities to previous large attacks blamed on North Korea. It remains an accusation, not an independently verified finding: President Trump said on Saturday it remained unclear whether North Korea was involved (see the claim below), Pyongyang has for years denied using state-linked cyber units for theft and its Geneva mission and China embassy did not respond to Reuters' requests for comment, and Binance has not directly answered questions about the incident's potential links to North Korea. Pyongyang has since responded to the incident itself, via KCNA — see the denial claim added in the 23:02Z update below.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Why this label: Stated by the BBC, read in full: the breach struck Binance.com, and the US platform said it has not been affected.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The BBC presents this as a suggestion from early checks, not a confirmed cause. Binance's technical post-incident report had not been read for this page, so the entry point stays unconfirmed.
On the ladder: the evidence so far sits low — early, single or social sources. We publish the claim as a claim, never as fact.
Why this label: Verified as Trump's own words to reporters, in comments posted by a White House account on X, reported by Reuters in its Monday report read directly in full in this run. His doubt sits alongside the FBI's attribution above — the two US positions do not agree, which is why the attribution itself stays Not yet verified on this page.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: The $4.72bn cumulative figure is Binance's own, given by its spokesperson and reported by Reuters in its updated Monday report (read in full via syndication in this run) and independently by Bloomberg (net $4.7bn by Monday morning) — the same spokesperson figure from two independent reputable outlets. It is a later stage of the same running tally as Sunday's $3.64bn, so this claim is edited in place, not stacked. The total stays Disputed because DefiLlama's on-chain dashboard figure ($5.81bn for Sunday) still differs and the two publicly disagree about method; no newer DefiLlama cumulative figure was reported in the material read for this update.
On the ladder: credible sources conflict, so we show both workings. One side's own statement is that side's position — never proof.
Why this label: Verified as the companies' own stated positions and actions, reported by Reuters in its updated Monday report (read in full in this run): the USD-cash restoration and the partial-suspension status are Binance's own service position, Yi He's words are her own X post (also carried by The Guardian's business live coverage), and the USDC freeze figure is Circle's own statement. None of this independently verifies how the attack happened or who carried it out.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as Pyongyang's stated position on this incident: KCNA's wording is quoted identically by Reuters (Seoul, published 22:11Z on 2 November, read via syndication in full in this run) and carried by CNA. A denial is a position, not forensic evidence either way — the FBI's attribution above stays labelled Not yet verified. This is North Korea's first specific response to this incident; this page previously recorded that Pyongyang had not responded on it. The US-involvement hint is part of the same KCNA statement as carried by Cointelegraph (updated 01:39Z in this run's window); it is an insinuation offered without evidence and is carried only as part of Pyongyang's stated position.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as Elliptic's own analysis, reported by CoinDesk (read via search in this run) and carried in CNBC's tracing report (crawler #1124). The figures are Elliptic's tracking as of Monday 2 November, not a final accounting, and Elliptic puts the total stolen at $6.4 billion where Binance's own figure is about $6.3 billion — the frozen and still-controlled amounts above are Elliptic's, on its own total. Elliptic co-founder Tom Robinson said the transactions look like conventional software following instructions set by humans. This is tracing evidence about where the money went; it does not by itself settle who carried out the attack.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
Why this label: Verified as Binance's own announced schedule: Reuters reported the phase-two networks and the 04:00 GMT Tuesday start on Monday (its report read in full via live-browser recovery of the CNA copy in this run), and Cointelegraph (read via search in this run) reports the same schedule from Binance's latest recovery notice, including the progressive rollout and the prioritisation by user demand. This verifies what Binance has announced and scheduled — the reopening begins at 04:00 GMT and rolls out progressively, so availability for any given asset at any moment is Binance's live service position, which this page does not confirm asset by asset. Reuters' report does not list what remains suspended, and no date for a complete reopening has been announced; that stays in the don't-know list.
On the ladder: a claim earns Verified from primary evidence, or from two independent sources that do not copy each other.
What we know / what we don't know yet
What we know
- The scale of the theft (about $6.3bn), the suspension and phased resumption of withdrawals, and Sunday's flow figures — Binance's own numbers, reported identically by the BBC and CNBC.
- Binance's stated commitment to cover all losses, its reported ~95% coverage so far, and that Binance.US says it was not affected.
- Elliptic's tracing as of Monday 2 November: about $2.85 billion of the stolen funds frozen or seized and about $3.28 billion still under the attackers' control across more than 950 wallets, with no evidence found that AI directed the laundering (Elliptic via CoinDesk).
Show more (1)
- Binance's next restoration phase, on the company's own announcement: more assets reopen on BSC, ETH, SOL, XRP and SUI, plus some assets on Arbitrum, Optimism, TRX and Base, from 04:00 GMT on Tuesday (Reuters).
What we don't know yet
- Who actually carried out the attack — the FBI attributes it to North Korea's TraderTraitor group and TRM Labs and Chainalysis see similarities to earlier attacks blamed on North Korea, but President Trump says it is unclear whether North Korea was involved, Pyongyang has now denied this incident specifically — Kim Yo Jong, via KCNA, called the US assertion 'an absurd rhetoric and nothing new' and a 'grave political provocation' (Reuters) — but a denial is a position, not forensic evidence either way, and no independent forensic report had been read for this page.
- How the attackers got in — a compromised engineer's laptop is an early suggestion reported by the BBC, not a confirmed cause; Binance's technical post-incident report is still awaited.
- Whether the asset replenishment will be independently audited, and when the remaining networks and services fully reopen — a second phase of reopenings is scheduled from 04:00 GMT on Tuesday 3 November for more assets on nine named networks, rolling out progressively, but no date for a complete reopening of every asset and service has been announced.
Show more (2)
- The true cumulative size of the outflow — Binance's spokesperson puts the net figure at $4.72 billion since Sunday morning, while DefiLlama's dashboard put Sunday's outflows alone at $5.81 billion, and the two publicly disagree about the method.
- Which individual assets reopen on each network in Tuesday's phase — the announcement, as reported, names the networks, not a full asset-by-asset list.
Why it matters
A $6.3 billion theft from the world's largest crypto exchange is a stress test for the whole market: whether customers believe Binance's promise to absorb the loss is measured in exactly the flows seen on Sunday — $3.64 billion net out, but deposits still arriving. The FBI's North Korea attribution, if borne out, also makes this a sanctions and state-security story, not only a technology failure.
Background
Show the background timeline (4)
The Lazarus Group is blamed for the then-record $1.5 billion theft from the Bybit exchange (BBC).
Attackers compromise Binance's hot wallets; about $6.3bn in token assets is hit and Binance suspends all transactions, saying it will cover the losses and reserving more than $6.34bn (BBC; CNBC).
Binance reports about 90% of stolen assets covered; the FBI publishes wallet addresses it links to TraderTraitor and urges industry partners to block transactions involving them (CNBC; BBC).
Withdrawals resume in phases from 06:00 GMT; by 15:30 GMT Binance reports $4.649bn withdrawn and $1.01bn deposited — a net outflow of about $3.64bn — and coverage at around 95% (BBC; CNBC).
Update history
No silent edits. Every change is written here, with its time.
- Latest
Checking in progress — Binance announces phase two of withdrawal reopenings (crawler #1129): from 04:00 GMT on Tuesday 3 November, withdrawals reopen for more assets on BSC, ETH, SOL, XRP and SUI, and for some assets on ARBITRUM, OPTIMISM, TRX and BASE, rolling out progressively as security and readiness checks are completed (Binance's recovery notice, reported by Reuters — read in full via CNA in this run — and by Cointelegraph). Added as a new Verified claim: it verifies the announced schedule, not a completed reopening, and when every network and service fully reopens stays in the don't-know list. Audit catch before deploy: Cointelegraph's article also carried DefiLlama outflow figures that conflict with the tallies already labelled Disputed on this page — those figures were NOT added. Video check: no official Binance YouTube video of this notice was verified via oEmbed in this run, so the story continues without a video. This story carries no French or Arabic full text, so no full-text rebuild arose. The story stays in Checking.
Checking in progress — researchers' tracing figures added, and Pyongyang's denial completed (crawler #1123/#1124): blockchain analytics firm Elliptic says about $2.85 billion (44%) of the stolen funds has been frozen or seized while about $3.28 billion remains under the attackers' control across more than 950 wallets, moved through about 20 automated services in under three days, and it found no evidence AI directed the laundering (Elliptic via CoinDesk, read via search in this run; CNBC carries the same tracing). Added as a new Verified claim — Elliptic's own analysis, on its own $6.4 billion total. The denial claim has also been edited in place to carry the part of Kim Yo Jong's KCNA statement not previously on this page: her hint, offered without evidence, at possible US involvement (Cointelegraph). Attribution itself is unchanged and unsettled. Video check: no official-channel video of the Elliptic findings or the KCNA statement was verified via YouTube's oEmbed endpoint in this run, so the story continues without a video. This story carries no French or Arabic full text, so no full-text rebuild arose. The story stays in Checking.
Checking in progress — Pyongyang denies the Binance attribution (queue #1075): Kim Yo Jong, speaking through KCNA, called the US assertion that a DPRK-supported hacking organisation was involved 'an absurd rhetoric and nothing new' and 'a grave political provocation against the DPRK', and said the FBI is trying to brand the DPRK a 'cyber criminal state' (Reuters, Seoul, published 22:11Z, read via syndication in full in this run; CNA carries the same KCNA statement). A new claim carries the denial as North Korea's stated position; the FBI attribution stays labelled Not yet verified, and the don't-know item has been edited in place — when this page last updated, Pyongyang had not responded on this incident. Video check: the KCNA statement is a text statement and no official video of it was verified in this run, so the story continues without a video.
Show earlier updates (3)
Checking in progress — the outflow tally has moved (queue #935): Binance's spokesperson said on Monday customers have withdrawn a net $4.72bn since withdrawals resumed Sunday morning (about 2.8% of platform assets), with $2.7bn in inflows — Reuters' updated report, read in full in this run, cross-checked against Bloomberg's report of the same figure. The disputed outflow claim on this page is edited in place with the newer cumulative stage, not stacked; DefiLlama's higher dashboard figure keeps the total labelled Disputed. Also Monday: Binance restored US dollar cash withdrawals while most crypto withdrawals remain partially suspended on its website, Yi He posted that securing the environment comes before full resumption and rejected FTX comparisons, and Circle said it has frozen more than $1.1bn in USDC. The North Korea attribution stays Not yet verified. No official video was attached — the executives' video statements were posted on X, and no embeddable official Binance YouTube video of these developments was verified via oEmbed in this run.
Checking in progress — Reuters' Monday report (read directly in full) adds three material points: President Trump said on Saturday it remained unclear whether North Korea was involved, even as the FBI blamed TraderTraitor and TRM Labs and Chainalysis said the theft resembled earlier attacks blamed on North Korea; the outflow total is now disputed — Binance's net $3.64bn against DefiLlama's $5.81bn dashboard figure, with Binance saying DefiLlama's method misses its own hot-wallet deposits; and Binance says withdrawals were stabilising after the initial spike, with deposits 'substantial'. The North Korea attribution stays Not yet verified. No official video was attached — no embeddable official video about these developments was verified via YouTube's oEmbed endpoint in this run.
Story published in Checking state (queue #839/#840, one event). Basis: BBC and CNBC reports read directly in full. Scale, suspension, resumption and flow figures verified from Binance's own numbers as reported by both; the FBI's North Korea attribution is labelled Not yet verified.