Binance, the world’s largest cryptocurrency exchange, recently suffered a major hack in which roughly US$6.3 billion in crypto assets were stolen. Binance said in its latest update that it has replenished 95% of the stolen assets using its own funds, with the first phase of withdrawal services starting on Sunday (November 1) from 6 a.m. to 9 a.m.
Binance announced its latest progress on Saturday (October 31), stating that about 95% of the stolen assets have been replenished, while the remaining 5% involves less liquid tokens and will require more time to secure. The first phase of withdrawal services covers 15 cryptocurrencies, including Bitcoin, Ether, BNB, Solana, XRP, and Dogecoin. The company had previously pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and its own funds, and has already set aside more than US$6.34 billion.
As assets are gradually replenished, Binance has begun restoring withdrawal services in phases. The first phase allows withdrawals of cryptocurrencies such as Bitcoin, Ether, BNB, Solana, XRP, and Dogecoin, followed by the phased resumption of withdrawals on networks including Ethereum mainnet, BNB Smart Chain, and Base.
Despite the hack triggering net outflows of about US$3.6 billion, Binance’s market scale remains substantial. According to company data, as of October 28, the platform held about US$171 billion in assets under management, far exceeding second-ranked exchange OKX’s roughly US$29 billion. Vincent Liu, chief investment officer at quantitative research firm Kronos Research, said that a wave of withdrawals is expected in the short term, but as services resume, some funds may flow back.
Meanwhile, the U.S. Federal Bureau of Investigation (FBI) said on Sunday (November 1) that investigators, working with the U.S. Secret Service (USSS) and Internal Revenue Service Criminal Investigation (IRS-CI), traced blockchain transactions and found that shortly after the hackers made off with the funds, they quickly converted the loot into Ether (ETH). Some of the fund flows overlapped with wallets previously used by North Korean hackers, and even mingled with funds stolen from other exchanges, providing leads for investigators.
The FBI noted that the attack method matches the past operations of the North Korean hacker group TraderTraitor. The group is believed to be linked to the North Korean government-backed Lazarus Group and has long targeted cryptocurrency exchanges, DeFi protocols, and cross-chain bridges to steal assets.
https://t.co/pBJaht1UGV
— Binance (@binance) November 1, 2026
