Jump to content
Crypto Front Page

Crypto networks, markets and policy

Binance schedules phased withdrawals after $6.3bn breach

Binance began restoring withdrawals in phases after a breach with an estimated $6.3 billion impact, while the exchange says it will cover losses.

The Crypto Front Page Desk3 min read

Binance schedules phased withdrawals after $6.3bn breach

Binance said it would begin restoring withdrawals in phases on Nov. 1, after a security breach with an estimated $6.3 billion impact disrupted access to customer funds at the world’s largest cryptocurrency exchange. Its withdrawal recovery update sets out a gradual reopening after security checks; Binance said it would absorb the losses. The company announced a withdrawal suspension, not a halt to trading.

The incident is also being described as a likely record-setting crypto theft. The Associated Press reported that blockchain firms linked it to a North Korean hacking unit, while Binance said its investigation was ongoing.

How did the attacker move funds?

Binance’s initial investigation suggested that an attacker used access gained through a compromised DevOps engineer’s laptop to reach a service container and submit unauthorized withdrawal transactions. The company said it had found no evidence that wallet private keys were leaked. In the incident announcement, Binance put the estimated impact at about $6.3 billion and said roughly $3 billion had been frozen on-chain with partners.

That sequence matters: the reported route was through access to a service and its withdrawal process, rather than a confirmed theft of wallet keys. Binance said it revoked the affected address authorisation and was working with law enforcement and blockchain intelligence partners to trace and recover funds. The full attack path has not yet been verified; the exchange said it would publish a technical post-mortem once its investigation is complete.

What does a phased withdrawal restart mean?

Binance’s plan reopens withdrawal access network by network, after checking that the affected services are ready. Think of it as reopening separate exit gates one at a time: the exchange can check each route before letting funds move through it again.

The first phase was scheduled for Nov. 1 between 06:00 and 09:00 UTC. It covered assets across networks including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana and XRP. Binance said it would prioritize assets using user demand from the previous week, then add other networks and assets after their checks were complete. Deposits remained open, according to the exchange.

Who bears the loss, and what comes next?

Binance said it would cover losses through its Secure Asset Fund for Users and company funds, rather than pass them to customers. The AP reported that the exchange had reserved more than $6.34 billion in company funds to cover the stolen assets. That is Binance’s commitment; the investigation and recovery effort are still underway.

The change is a move from a broad withdrawal suspension to a staged reopening, with availability varying by asset and network. The next markers are which additional withdrawal routes Binance restores, how much of the stolen crypto can be frozen or recovered, and the technical post-mortem explaining how the attacker gained access.

References