Binance began restoring cryptocurrency withdrawals in phases on Sunday, November 1, after attackers drained about $6.3 billion from its hot wallets in what investigators describe as the largest cryptocurrency theft on record. The FBI attributed the attack to North Korea’s TraderTraitor operation on October 31.
The exchange’s latest recovery notice says the first withdrawal phase was scheduled for 06:00 to 09:00 UTC on November 1. Availability varies by asset and network, so a restored Bitcoin withdrawal does not mean every token or blockchain route is open. Binance says balances for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed.
The restart is an operational milestone, not a completed investigation. Binance has not yet published a full root-cause report, and its own account has widened from one compromised laptop to “additional points of breach.” The missing details matter because they will show how access to an engineer’s device became authority to move billions of dollars across multiple chains.
What Binance and the FBI have confirmed
Binance places the hot-wallet compromise at roughly 20:05 UTC on October 29. Its initial investigation pointed to a compromised DevOps engineer’s laptop that let an attacker reach a service container and submit unauthorized withdrawal transactions. A later update said investigators had found other breach points, without identifying them.
The exchange has said it found no evidence that wallet private keys leaked. That wording leaves an important distinction: attackers may not need to extract a private key if they can abuse the systems that request, approve or produce valid signatures. Binance has promised a technical postmortem after the investigation.
The FBI’s attribution is more definite than the early assessments from blockchain investigators. It identifies the activity as TraderTraitor and says the attackers are primarily converting stolen assets into ether before using decentralized-finance and instant-swap services for later laundering stages. The bureau asked node operators, exchanges, DeFi services and blockchain analytics companies to block transactions tied to the listed attacker addresses.
TraderTraitor is the same North Korea-linked activity cluster the FBI blamed for the $1.5 billion Bybit theft in February 2025. The Binance loss is more than four times that amount.
The transactions show a prepared cross-chain operation
TRM Labs traced about $6.36 billion from Binance-attributed wallets to attacker-controlled addresses across 10 blockchains. Most of the transfers happened in roughly 20 minutes. The affected networks included Bitcoin, Ethereum, XRP, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
The speed was preceded by visible preparation. TRM found three small Tornado Cash withdrawals funding an operator wallet beginning on October 28, a day before the main theft. It also identified signatures obtained in advance and executed in a burst. A separate TRM analysis says the attacker used 50 pre-signed authorizations on Ethereum and likely gained the ability to make Binance’s hot-wallet signing system approve transactions across chains.
On Ethereum, outside analyses from Galaxy Research and other blockchain specialists point to EIP-7702 account delegation. The mechanism can let an externally owned account temporarily behave like a smart-contract account. In this case, analysts say a Binance hot wallet was delegated to attacker-controlled code that swept assets on command. That does not mean EIP-7702 alone caused the breach; an attacker still needed a valid authorization, and the unanswered question is how Binance’s signing path produced it.
The cross-chain sequence is why a single compromised laptop is only the beginning of the explanation. A credible postmortem needs to identify the initial malware or social-engineering route, the service-container permissions, the signing and approval controls that were bypassed, the extra breach points, and why transaction limits or anomaly detection did not stop a 20-minute drain.
About $3 billion was frozen, but frozen is not recovered
Binance reported on October 30 that industry partners had frozen approximately $3 billion on-chain. TRM’s later asset-by-asset estimate put the frozen amount near $2.7 billion, including about $1.77 billion in USDT. The difference may reflect timing and valuation as issuers and networks took action.
Freezing an address prevents the holder from moving affected tokens under the relevant issuer or protocol’s controls. It does not automatically return the assets to Binance. Recovery can require cooperation among issuers, exchanges, law-enforcement agencies and courts, and native assets such as bitcoin cannot be frozen by a central issuer.
Binance says it will absorb the loss through its Secure Asset Fund for Users, insurance resources and corporate treasury. It had replenished most stolen assets before reopening withdrawals, while its recovery page says the ten named customer balances are now fully backed. Its proof-of-reserves snapshot can help users compare disclosed assets and liabilities, but it is not a substitute for the technical postmortem or an audit of the internal controls that failed.
What Binance users should check now
There is no public evidence that ordinary customer passwords or individual accounts were the route into this incident. Users should still treat the recovery period as a high-risk window for phishing and impersonation.
- Check withdrawal status inside the Binance app or by typing the official site address. Availability is being restored by asset and network. Do not trust a search ad, social-media reply or emailed “recovery” link.
- Review account and withdrawal history. Look for unfamiliar logins, API keys, withdrawal addresses or completed requests. Report anomalies through support reached from the signed-in app or official website.
- Do not move funds to a supposed safe wallet sent by support. A legitimate recovery process will not require a seed phrase, private key or remote-control session.
- Harden the account independently of the exchange breach. Use a passkey or phishing-resistant security key where available, remove unused API keys, restrict active keys by IP and permission, and enable Binance’s anti-phishing code for official emails.
- Verify the network before retrying a withdrawal. A token can exist on several networks, and phased reopening means one route may be live while another remains paused.
The next meaningful disclosure is Binance’s full technical report. Until it identifies the additional breach points and the signing-control failure, the public blockchain explains how the money moved more clearly than Binance has explained how the attackers obtained authority to move it.
