Binance, the world's largest cryptocurrency exchange, processed approximately $3.6 billion in net withdrawals by Sunday afternoon, November 1, after restoring withdrawal services following a record $6.3 billion theft from its digital wallets. The company had suspended withdrawals on Friday, October 30, after the breach occurred on Thursday, October 29. Binance co-CEO Richard Teng stated that the company would "fully absorb the financial impact of the stolen funds, not our users."
The Federal Bureau of Investigation (FBI) announced on Saturday, October 31, that North Korean state-sponsored cyber actors, identified as TraderTraitor, were responsible for the theft. The FBI stated that TraderTraitor has been active since at least 2020 and was also linked to a $1.5 billion Bybit hack in 2025. Blockchain analysis firms Chainalysis and TRM Labs also linked the Binance hack to TraderTraitor.
The hack, which involved digital assets across ten blockchains, is considered the largest cryptocurrency heist in history. Ethereum was the most affected blockchain, with $3.8 billion stolen, followed by Bitcoin at $1.5 billion. Binance's initial investigation suggested the breach might have originated from a compromised laptop belonging to a DevOps engineer, which allowed an attacker to access a service container and initiate unauthorized withdrawals. However, the company found no evidence of any wallet private key leaks.
Binance began a phased resumption of withdrawals on Sunday, November 1, prioritizing 15 digital currencies including Bitcoin, Solana, and Ethereum. The company reported processing around $4.6 billion in withdrawals and $1 billion in deposits by Sunday morning. This resulted in a net outflow of approximately $3.64 billion, representing 2.1% of Binance's total assets under management, which stood at $171 billion.
Binance stated it had replenished 90% of the stolen assets using its Secure Assets Fund for Users (SAFU), a reserve fund of approximately $1 billion in Bitcoin, along with its corporate treasury and Futures insurance fund. The remaining 10% of tokens are less liquid, requiring more time to acquire at the necessary scale. The company is working with law enforcement and industry partners to trace and recover the stolen assets, with approximately $3 billion of the stolen stablecoins already frozen. The FBI has urged other cryptocurrency exchanges and blockchain analytics companies to block transactions linked to the addresses used by TraderTraitor to prevent money laundering.