Binance expands withdrawals after $6.3bn hot-wallet breach

Binance began reopening withdrawals for more assets on Nov. 3, days after a hot-wallet breach that the exchange says caused about $6.3 billion in losses. The move extends a staged recovery: Binance says deposits remained open, and the breach did not halt trading. In its latest recovery update, the exchange said the new phase would start at 04:00 UTC, with each asset and network returning only after readiness checks.

The scale makes the incident stand out against recent exchange thefts. The Associated Press reported that the previous record was Bybit’s $1.5 billion hack in February 2025; Binance’s reported loss is more than four times that amount by dollar value. Binance said it would absorb the financial impact, and an earlier update said it had set aside $6.34 billion, including $5 billion in the affected tokens, and that about $3 billion had been frozen on-chain.

What is reopening, and what remains restricted?

The Nov. 3 phase covers selected assets across BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron and Base. Binance says the rollout will be progressive: the list does not mean every listed asset was available at once, and further assets would return as they passed checks. Users were directed to check availability for the specific asset and network. The exchange also warned that higher traffic could cause delays.

That is a narrower change than a full return to normal service. Binance’s Oct. 30 incident update said withdrawals had been temporarily suspended while it reviewed security and validated affected systems, while deposits and other unaffected platform services remained operational. Trading access and the ability to move funds off-platform are different functions: in this case, the confirmed disruption was to withdrawals, not a general trading halt.

How did the breach compare with earlier exchange hacks?

Binance said the incident began around 20:05 UTC on Oct. 29, when its hot wallets were compromised. The company said its initial investigation pointed to a possible compromised laptop, but later uncovered additional points of breach; it reported no evidence at that stage that wallet private keys had leaked. The full attack sequence remained under investigation.

Attribution also remained provisional. AP reported that blockchain firms TRM Labs and Chainalysis linked the attack to TraderTraitor, a North Korean hacking unit, while Binance said it was working with law enforcement to confirm who was responsible. AP noted that the dollar value exceeded Bybit’s earlier loss, while Binance founder Changpeng Zhao said the comparison could differ when measured in bitcoin rather than dollars. The record claim is therefore about reported dollar value, not a settled measure across all possible comparisons.

What will show whether the recovery is holding?

The next signals are the pace at which Binance restores withdrawals across the remaining networks, whether its security investigation explains how attackers accessed the hot wallets, and how much of the stolen assets can ultimately be recovered. Binance has said it will bear the losses, but users and markets still have to assess how reliably they can withdraw and what the eventual technical findings show. The exchange’s phased approach gives security checks priority over speed; its cost is that access to some assets may remain uneven during the recovery.

Sources and documents

• latest recovery update — binance.com