Binance, the world's largest cryptocurrency exchange by daily trading volume, began restoring user withdrawals on Sunday, 1 November 2026, following a historic cyberattack. Cybercriminals breached the platform on 29 October 2026, stealing over $6 billion (approximately €5.4 billion) in digital assets in what is believed to be the largest crypto heist in history. To contain the damage and protect the platform, the exchange had temporarily suspended all deposits and withdrawals. By Sunday morning, Binance launched its first withdrawal phase, opening operations for the Bitcoin ($BTC) network between 0600 and 0900 GMT. Company officials explained that tokens are being prioritised based on user demand data from the past week so every asset pair undergoes stability and security checks before access reopens.

To advertise here,

"First batch network now opened in phase one of withdrawals is $BTC bitcoin network," Binance announced on X.

"We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened," the company added.

How Binance plans to cover the $6.3bn customer losses

Binance has reassured crypto investors that customer accounts will not bear the financial brunt of the heist. The exchange announced it has set aside more than $6.34 billion from its corporate reserves and emergency funds—known as the Secure Asset Fund for Users (SAFU)—to cover all stolen assets. Company executives revealed that Binance has already used corporate cash to purchase tokens on the open market, successfully replenishing 90 percent of what was stolen. The remaining 10 percent consists of less liquid cryptocurrencies that take longer to source in required volumes.

"User funds remain safe. Binance will absorb the financial impact of the stolen funds, not our users," the exchange stated on X.

Meanwhile, swift action between Binance, blockchain networks, and major stablecoin issuers managed to freeze roughly $3 billion of the affected funds. Stablecoins are digital tokens pegged directly to traditional currencies like the US dollar. Key issuer Tether froze approximately $1.57 billion, while Circle blocked over $800 million, alongside additional asset blocks by other issuers. While freezing tokens stops hackers from transferring them, analysts note it does not instantly return the funds to Binance. Questions linger over whether emergency liquidity will prove sufficient without further corporate measures, though Binance has promised an updated proof-of-reserves statement alongside a comprehensive technical audit.

Inside the breach and the single laptop vulnerability

How did hackers infiltrate the world's most heavily fortified exchange? Preliminary internal findings point to a single compromised laptop belonging to a DevOps engineer. In technology firms, DevOps engineers build and maintain software infrastructure and deployment systems.

Using credentials accessed through this device, the intruder entered a service container and submitted unauthorised withdrawal transactions. Crucially, Binance confirmed that wallet private keys—the master cryptographic passwords safeguarding funds—were not stolen. Instead, the attacker hijacked operational permissions inside the administrative environment. Investigators have not yet confirmed whether the engineer's laptop was breached via phishing, malicious software, or stolen credentials.

Once inside, the cybercriminals targeted Binance's "hot wallets"—internet-connected digital wallets used for rapid daily transactions. Blockchain tracking revealed suspicious transfers, including 167,464 ether siphoned from a wallet identified as 'Binance 14', followed by another 28,006 ether from 'Binance 16'. The hackers utilized Ethereum's EIP-7702 authorization feature, a smart-contract mechanism that delegates account management. This allowed automated scripts to redirect funds across multiple blockchains, draining ether, bitcoin, stablecoins, and other digital assets in minutes.

FBI blames North Korean state hackers TraderTraitor

On Saturday, 31 October, the US Federal Bureau of Investigation (FBI) formally accused North Korea of executing the multi-billion-dollar attack.

"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the official FBI statement declared.

The FBI confirmed findings by private intelligence firms, including TRM Labs and Pangolin Intelligence, attributing the breach to TraderTraitor. TraderTraitor is a specialized Pyongyang-affiliated cyber collective linked to the infamous Lazarus Group. Lazarus gained global attention in 2014 after hacking Sony Pictures in retaliation for "The Interview", a Hollywood film mocking North Korean leader Kim Jong Un. TraderTraitor was also blamed for a massive $1.5 billion heist from the Bybit platform in February 2025.

Federal agents observed TraderTraitor converting stolen assets into Ethereum, expecting them to launder the proceeds through decentralized finance (DeFi) platforms and instant swap services. The FBI urged private crypto businesses to block all addresses linked to the thieves. Facing severe international sanctions over its nuclear weapons and missile programmes, North Korea frequently uses state-backed cyber thefts to finance its military ambitions.

Political skepticism and market panic

Despite the FBI's formal assessment, US President Donald Trump cast doubt on North Korea's involvement during comments to reporters at his Florida residence late Saturday.

"I'm not concerned. We're learning about it. We don't know if it's North Korea," President Trump remarked.

Trump has often pointed with pride to diplomatic summits held with Kim Jong Un during his presidency. For its part, Binance noted that perpetrator attribution remains preliminary and has not officially named any group.

News of the record heist caused widespread market panic on Friday. Bitcoin dropped nearly 5 percent to a six-week low of $77,646. Ethereum plunged nearly 6 percent to $2,238.76, while Binance's native token BNB crashed over 8 to 10 percent within 24 hours. Additionally, industry observers voiced concerns that rapid advancements in artificial intelligence could threaten cryptographic protocols and corporate IT security in the near future.

Critical lessons for everyday cryptocurrency investors

The Binance incident exposes vulnerabilities within centralized exchange platforms. Even when core blockchain networks remain fully secure, a single compromised employee device can provide administrative access to vast reserves of user funds.

The breach also highlights two contrasting sides of modern digital finance. Hackers can transfer billions across borders in minutes, yet stablecoin issuers can freeze vast sums quickly to limit damage.

Three major questions now face Binance and the wider cryptocurrency ecosystem:

  1. How much stolen money can ultimately be recovered?
  2. Can Binance fully restore its reserves without impacting long-term operations?
  3. How did a single operational environment obtain such extensive withdrawal permissions over exchange assets?

While Binance works to recover stolen funds, restoring public trust in centralised exchanges remains the crypto industry's greatest hurdle.