Binance to Resume Withdrawals Within 48 Hours After $6.3 Billion Hack

Binance plans to resume withdrawals within 48 hours after a pause taken for security checks. Co-founder and co-CEO Yi He stated: "Deposits are unaffected and continue to operate as usual. The team is working on improving the withdrawal service and address monitoring. We expect to start resuming withdrawals within the next 48 hours." She did not specify the exact timeline for full restoration.

Timeline

The attack began around 20:20 UTC on October 29, 2026, targeting Binance's main hot wallet on Ethereum. Approximately two hours later, at 22:30 UTC, the exchange acknowledged the exploit, suspended deposits and withdrawals, and initiated an investigation. In a subsequent update at 02:25 UTC on October 30, Binance estimated the stolen funds at approximately $6.3 billion – the largest hack in cryptocurrency history. Chainalysis estimates the damage at approximately $6.4 billion.

Where the funds went

The attacker withdrew funds from hot wallets on 10 networks. In Ethereum – $3.74 billion, in Bitcoin – 18,270.2 BTC at $1.47 billion, in TRON – $612.7 million USDT and 46.4 million TRX at $627 million. Solana, Arbitrum, and Avalanche lost $96 million, $32 million, and $24 million respectively. Ethereum and Bitcoin accounted for 83% of the total amount.

Freeze and North Korea theory

Partners, including Tether, Circle, Ripple, Paxos, Arbitrum, World Liberty Financial, and Binance itself, froze about $2.8 billion – nearly half, mostly stablecoins with blocking functionality. Analyst Dickson Wu estimates the attacker can still move BTC and ETH worth approximately $3.27 billion. Chainalysis, ZachXBT, and TRM Labs with high confidence link the attack to the North Korean group TraderTraitor, citing the mixing of Binance funds with the Bitget exploit address worth $388 million. Binance has not officially confirmed the attacker, and the investigation continues.

Cause and commitments

Binance traced the exploit to a compromised DevOps engineer's laptop: this provided access to internal infrastructure and allowed signing of transfers. No wallet private key leaks were found, and rights to the compromised address were revoked. The exchange is cooperating with law enforcement and blockchain analysts, promises to cover all losses using SAFU and its own funds, and after completing checks, will publish a technical report and updated Proof of Reserves.

Market

Sentiment has deteriorated to the "fear" level, last seen in August. BTC dropped by 7% to $76.5k before attempting a rebound. Analyst Benson Sun believes the stolen BTC will not be sold immediately and acts as "locked supply," so pressure on Bitcoin may be limited, but ETH could face additional pressure.