Choose a section or paragraph
Binance has begun restoring cryptocurrency withdrawals after replacing approximately $6 billion in assets stolen during a historic cyberattack. But while the exchange is moving to protect customer balances, billions in stolen cryptocurrency remain at the center of an international investigation.
Binance is attempting to restore confidence following one of the most damaging security breaches in cryptocurrency history, with roughly $6.3 billion in digital assets stolen from exchange-controlled wallets on October 29.
By Sunday, November 1, the exchange said it had replaced about 95% of the affected tokens using company resources. Withdrawals for major cryptocurrencies, including Bitcoin and Ether, began resuming, while services involving other assets were being restored in phases.
The development offers some reassurance to customers who faced uncertainty when withdrawals were suspended. It does not, however, mean that the stolen funds have been recovered.
Blockchain investigators are continuing to trace assets across multiple networks, while stablecoin issuers and law enforcement agencies work to prevent the attackers from moving or converting cryptocurrency.
The distinction between reimbursing users and recovering stolen assets has become one of the most important questions surrounding the incident.
How Binance Lost $6.3 Billion in Approximately 20 Minutes
The attack began on October 29, when unauthorized transactions started moving cryptocurrency out of Binance-controlled wallets.
According to blockchain intelligence company TRM Labs, approximately $6.36 billion was transferred across ten blockchain networks, with most of the theft taking place in roughly 20 minutes.
Ethereum accounted for the largest portion of the losses, followed by Bitcoin and Tron. Other affected networks included the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
This was not a typical exploit involving a single smart contract. Investigators found evidence suggesting that the attackers gained access to transaction-signing capabilities used by Binance’s operational wallets.
That would help explain how withdrawals could be authorized across blockchains that use different security systems.
Binance initially investigated a compromised employee laptop. Subsequent reporting indicated that the intrusion was more complicated, involving malicious software and additional potential points of compromise.
A definitive technical explanation has not yet been publicly established.
Which Cryptocurrencies Were Stolen?
TRM Labs’ initial investigation estimated the value of assets removed from Binance wallets across the affected networks.
| Blockchain network | Estimated stolen value |
|---|---|
| Ethereum | $3.79 billion |
| Bitcoin | $1.47 billion |
| Tron | $628 million |
| XRP Ledger | $296 million |
| Solana | $96 million |
| Arbitrum, Optimism and Base | $39 million combined |
| Avalanche | $28 million |
| Polygon | $10 million |
Figures are approximate, based on TRM Labs’ valuation of the assets when they were transferred. Rounding and subsequent price movements may produce differences between reported totals.
On Ethereum, the stolen assets included ETH and several major stablecoins, among them USDT and USDC.
Bitcoin losses amounted to approximately 18,270 BTC, while the XRP Ledger saw transfers totaling roughly 233 million XRP.
The diverse range of assets complicated the response.
Centralized stablecoin issuers can restrict certain tokens held in attacker-controlled addresses. Native Bitcoin and Ether, by contrast, cannot generally be frozen using the same issuer-controlled mechanism.
That difference would become particularly important in the hours following the theft.
Binance Has Replaced Most Customer Assets, Not Recovered the Stolen Funds
On November 1, Binance said it had used company money to replace approximately $6 billion in stolen tokens, representing about 95% of the affected assets.
The remaining portion involved less liquid cryptocurrencies that could take longer to obtain in the quantities required.
The exchange’s response has involved its Secure Asset Fund for Users, commonly known as SAFU, alongside other company financial resources.
Binance has also committed to rebuilding its SAFU reserve to approximately $1 billion.
These measures are intended to protect customer balances and reduce the financial damage experienced by users.
But there is an important distinction.
When Binance purchases replacement cryptocurrency using its own money, customer assets can be restored even if the original stolen tokens remain under the attacker’s control.
The exchange may therefore be absorbing substantial losses while investigators continue trying to recover the stolen funds.
For customers, the immediate concern is whether their balances are accessible and properly backed. For the broader cryptocurrency industry, the question is how much of the stolen money can eventually be retrieved.
What Happened to the Billions in Frozen Cryptocurrency?
One of the most significant developments after the attack was the rapid intervention of stablecoin issuers and blockchain security organizations.
TRM Labs reported that Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council had collectively frozen approximately $2.7 billion worth of affected assets during the early response.
These restrictions made it harder for the attackers to move certain tokens or convert them through ordinary channels.
Binance subsequently reported that approximately $3 billion in affected assets had been located with the assistance of industry partners.
However, these numbers should not be treated as separate recoveries or added together.
They refer to different reporting stages and categories of assets, which may overlap.
More importantly, a frozen token is not necessarily a recovered token.
An issuer may be able to prevent an address from transferring particular stablecoins, but returning those assets to their rightful owner can involve further technical, legal and investigative steps.
That process could continue long after customer withdrawals have resumed.
The Attackers Still Have Access to Difficult-to-Freeze Assets
Despite the extensive freezing operation, blockchain investigators identified substantial cryptocurrency holdings outside the direct control of stablecoin issuers.
In its initial assessment, TRM Labs estimated that the attackers retained more than 420,000 ETH and approximately 18,270 BTC, with a combined value of around $2.4 billion at the time.
Those figures represented an early investigative snapshot, not a verified current balance as of November 1.
Unlike centrally issued stablecoins, Bitcoin and native Ether do not have an issuer that can simply blacklist an address.
The funds can still be monitored through public blockchain records, but stopping or recovering them usually requires intervention at exchanges, custodians or other identifiable points where the assets are moved.
Investigators also observed attempts to convert some stablecoins into Ether using trading and decentralized lending infrastructure.
Such activity can make the recovery process more complicated, particularly when stolen assets move through numerous addresses and financial protocols.
How the Hackers Exploited Ethereum Wallet Authorization
The technical findings surrounding Ethereum are especially revealing.
TRM Labs reported that the attackers abused a legitimate Ethereum feature known as EIP-7702, which allows certain wallet accounts to delegate execution to smart-contract code.
Investigators identified a series of pre-signed authorizations used to establish attacker-controlled execution behavior on a Binance hot wallet.
Once the malicious authorization took effect, the attacker could instruct the affected wallet to transfer assets out.
Further transfers occurred as new funds entered the compromised wallet.
The findings suggest that the attackers had access to more than a simple withdrawal interface.
They appear to have obtained authorization capabilities powerful enough to manipulate how an operational wallet executed transactions.
However, this mechanism explains only part of the incident.
Because other affected blockchains do not use Ethereum’s EIP-7702 system, investigators believe a broader compromise of the exchange’s signing infrastructure is a more likely explanation for the multi-chain theft.
The final root cause will require additional evidence from Binance’s internal investigation and technical post-mortem.
FBI Links the Binance Hack to North Korea’s TraderTraitor Group
The investigation has also taken on an international security dimension.
On October 31, the FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group previously linked to major cryptocurrency thefts.
Reuters reported that US investigators observed members of the group converting stolen digital assets into Ether and warned that additional laundering activity could follow.
Blockchain intelligence company TRM Labs also attributed the attack to TraderTraitor with high confidence, citing patterns in the preparation, execution and movement of stolen cryptocurrency.
Those assessments strengthen the case for North Korean involvement, although they do not reveal every individual participant or establish the final beneficiaries of the stolen assets.
The North Korean government has previously denied allegations involving state-backed cryptocurrency theft.
The public evidence reviewed does not establish that Binance executives intentionally enabled the attack or knowingly facilitated the transfer of funds to North Korea.
The investigation should remain focused on documented wallet activity, technical evidence and verified law-enforcement findings rather than unsupported accusations.
What Happened to BNB During the Security Breach?
BNB remains an important part of the broader investigation, particularly because Binance identified the cryptocurrency among the assets involved in its restoration and reserve disclosures.
However, the public information reviewed does not establish a complete BNB-specific transaction trail.
TRM Labs’ initial network breakdown did not separately list BNB Chain among the ten affected networks.
That absence does not establish that no BNB was stolen. BNB can also exist in tokenized forms on other networks, and different reporting categories may account for some discrepancies.
Equally, the inclusion of BNB in an exchange disclosure does not prove that the BNB Chain protocol itself was compromised.
A theft from an exchange-controlled wallet and an exploit of a blockchain’s underlying protocol are different security events.
Cryptopian News previously examined this distinction in its investigation into the BNB transaction trail.
The remaining questions concern the precise amount of BNB affected, the networks involved, and whether transaction-level evidence can establish the movement of those assets.
Until that information is available, a definitive conclusion would be premature.
Why the Binance Hack Matters Beyond Customer Reimbursement
Binance’s decision to absorb the immediate financial damage demonstrates the importance of financial reserves in centralized cryptocurrency exchanges.
It also exposes a wider issue.
Customers of custodial platforms depend on more than blockchain security. They depend on employee access controls, internal signing systems, withdrawal authorization procedures and the exchange’s ability to detect suspicious activity.
A secure blockchain cannot independently prevent an exchange’s own authorized infrastructure from issuing a malicious transaction if that infrastructure has been compromised.
The incident also highlights the limitations of traditional proof-of-reserves disclosures.
Showing that customer assets are backed is valuable, but it does not by itself demonstrate that internal authorization systems cannot be abused.
Independent security assessments, stronger operational safeguards and transparent incident reporting will be critical to restoring confidence.
What Binance Still Needs to Explain
Despite the progress in restoring withdrawals, several questions remain unresolved.
First, the exchange has not yet provided a complete public technical explanation of how the attackers obtained transaction-signing capabilities across multiple networks.
Second, the relationship between located funds, frozen assets and genuinely recovered cryptocurrency needs a clearer accounting.
Third, further evidence is needed to establish the final movement of stolen Bitcoin, Ether and other affected tokens.
There is also a need for more detailed information about the security controls introduced after the attack and the independent verification of restored customer balances.
Finally, a complete technical account would help clarify the precise extent of BNB exposure without confusing exchange wallet losses with a protocol-level failure.
These are not minor details. They will determine how the incident is understood by customers, security researchers and regulators.
Cryptopian News Analysis: Financial Recovery Is Only Part of the Story
Binance has made meaningful progress in addressing the immediate financial consequences of the theft. Restoring customer balances and resuming withdrawals are significant steps after an incident of this scale.
But the broader investigation is far from complete.
The exchange’s replacement of approximately $6 billion in affected assets should not be mistaken for the recovery of the original stolen cryptocurrency. Large amounts have been frozen, while other assets remain difficult to recover and require continued monitoring.
The technical findings also raise important questions about how centralized exchanges manage powerful transaction-signing systems across different blockchains.
For Binance, the immediate priority is restoring normal operations and demonstrating that customer assets remain protected.
For the cryptocurrency industry, the larger challenge is ensuring that an attack of this magnitude cannot be repeated through weaknesses in operational infrastructure.
Ultimately, the success of Binance’s response will be judged not only by the money it replaces, but by the clarity of its investigation, the security improvements it implements and the evidence it provides to rebuild public trust.
Verified references for the article
These sources support the major financial, technical and attribution claims:
- Reuters — Binance replaces stolen assets and resumes withdrawals, November 1
- Reuters — How the record Binance hack unfolded
- TRM Labs — Blockchain forensic findings and attacker attribution
- Cryptopian News — Earlier BNB transaction investigation
Editorial note: This article is based on publicly available reporting, Binance disclosures and blockchain intelligence published through November 1, 2026. Cryptopian News has not independently verified every wallet transfer or conducted a separate forensic audit. Financial figures may change as investigations and recovery efforts continue.
- Binance Replaces $6B After Hack: What Remains Missing - November 1, 2026
- South Korea’s Hanwha Partners With Chainlink to Bring Real-World Assets Across Blockchains - October 30, 2026
- QuFi Post-Quantum Verification Platform: A New Infrastructure Layer for Digital Assets — A Post-Quantum Verification Platform for Digital Assets - September 4, 2026