11-03-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Binance resumed withdrawals on November 1 after a record $6.3 billion hack on October 29. The exchange says it has replenished 95% of affected funds, but it hasn’t explained the “additional points of breach.” The FBI blames North Korea’s TraderTraitor group, and laundering continues through cross-chain services like THORChain. Meanwhile, fresh breaches at Mercado Bitcoin, BTCPay, Chainalysis, and others show exploits are growing more frequent and more intense.
Key Takeaways:
- Binance resumes withdrawals on November 1 after recovering from the largest crypto hack in history, during which customers withdrew $4.65 billion in under 10 hours.
- Binance says it replenished 95% of the impacted funds using its SAFU fund, corporate treasury, and futures insurance fund.
- Binance has not specified the “additional points of breach” beyond an initially compromised DevOps engineer’s laptop, though it reports no evidence that wallet private keys leaked.
- Laundering of the stolen funds is ongoing, using thousands of scripted transactions and cross-chain services such as THORChain and Relay.
- The FBI attributes the hack to North Korea’s TraderTraitor group, while President Trump questioned the attribution and North Korea denies involvement.
- Exploits are becoming more frequent and more intense, with Bitget ($388M), Mercado Bitcoin (~$49M), CoinDCX ($16M), BTCPay wallet sweeps and a Chainalysis breach all reported within weeks.
Binance has resumed withdrawals after the world’s largest digital asset exchange suffered the largest crypto hack in history, but with attacks on the rise, exchange platforms’ ability to bounce back from future hacks is anything but assured.
On November 1, Binance tentatively began allowing customers to withdraw funds/tokens from their accounts after temporarily disabling this activity following the record $6.3 billion hack on October 29. Binance said the process would unfold in ‘phases’ (certain tokens on certain networks) based on “past week data of user demand.”
In less than 10 hours, Binance customers withdrew $4.65 billion in assets, while just over $1 billion flowed into the exchange via new deposits. Net outflows over the first 24 hours peaked at $7 billion before settling back down to about half that figure.
Binance claimed the net outflow of $3.6 billion amounted to 2.1% of its total assets under management, adding that the pace of withdrawals was slowing after an initial surge. Binance also released a new ‘proof of reserves’ snapshot of 10 prominent tokens to further alleviate customer concerns. Another snapshot has been promised for Wednesday, November 4.
On November 2, Binance said additional token and network withdrawal options would be made available Tuesday. The 5% of tokens not yet available for withdrawal consists of assets that are “less liquid, and take longer to source at the required scale.”
Binance co-CEO Richard Teng issued a warning Monday urging users to be cautious when receiving communications purporting to be from the exchange offering speedier processing of withdrawals or ‘compensation claims.’
Binance said it had ‘replenished’ 95% of the impacted funds using its Secure Asset Fund for Users (SAFU), its corporate treasury and its futures insurance fund. The company thanked customers for their patience and understanding, and thanked partners for taking whatever actions they could to freeze assets and/or trace stolen funds.
Binance founder Changpeng ‘CZ’ Zhao joined in the gratitude message, thanking U.S. federal law enforcement agencies for providing “vital help in this incident, including tracking, freezing, etc.” CZ said actions by the Federal Bureau of Investigation (FBI), U.S. Secret Service, Internal Revenue Service (IRS) and others were due “a lot” of the credit for why the fiat price of major tokens like BTC didn’t fall even further in the immediate aftermath of the hack.
The FBI issued a statement on October 31 that included a list of blockchain addresses linked to efforts to launder the hack’s proceeds. The FBI urged entities including “THORNode operators, RPC node operators, instant exchanges, DeFi [decentralized finance] services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from” these addresses.
The FBI also confirmed that North Korea’s TraderTraitor group of cyber bad actors was “responsible for the theft.”
The FBI’s assertion was questioned by U.S. President Donald Trump, who was asked about the attribution during a Halloween party at the FBI’s Mar-a-Lago resort in Florida. Trump said, “We don’t know if it’s North Korea. But if it is, we’ll talk to North Korea about it.” Trump has previously questioned the findings of America’s intelligence agencies when it involves authoritarian regimes like North Korea or Russia, whose leaders Trump claims to be on good terms with.
Meanwhile, Kim Yo-jong, sister of North Korean leader Kim Jong-un, issued a statement Monday disavowing any involvement by the regime in the hack. The statement also accused the U.S. of ‘misleading’ the world’s public opinion “as if all the cyber crimes in different parts of the world are our deeds.”
What happened
While Binance initially claimed the hack was the result of a DevOps engineer’s laptop being compromised, the company later acknowledged “additional points of breach,” the substance of which it has yet to clarify. Binance did claim to have found “no evidence that wallet private keys were leaked.”
However, blockchain analytics firms Chainalysis and TRM Labs confirmed that a Binance ‘hot’ wallet was compromised to run attacker-deployed code. This code allowed the wallet to execute a smart contract that ‘swept’ assets from other Binance wallets, sending the lot to wallets under the attacker’s control.
The attackers reportedly conducted dry runs of this attack vector beginning 36 hours before the actual attack. Once the funds had been swept and transferred, Chainalysis said the funds underwent “laundering patterns we have not seen before,” involving “thousands of transactions in a short period.”
These patterns saw tokens “repeatedly circulate among addresses, often sending funds back to addresses involved earlier in the sequence.” Chainalysis believes this represents “a programmatic process for moving and redistributing the stolen funds,” although, at present, this automation appears to involve scripts rather than artificial intelligence.
Laundry day
While centralized issuers Tether (USDT), Circle (NASDAQ: CRCL) (USDC), Ripple Labs (RLUSD) and World Liberty Financial (USD1) were able to freeze roughly $2.7 billion worth of the stolen stablecoins ($1.5 billion in USDT, $823 million in USDC, ~$200 million in RLUSD and $27 million in USD1), other stablecoins had already been converted to other tokens not subject to centralized control.
Some online observers flagged millions of dollars’ worth of tokens flowing through the Relay cross-chain payment protocol, despite its claims to screen addresses against certain blacklists, including those for hacks and sanctions evasion.
Others noted the predictable involvement of cross-chain bridging platform THORChain, which was recently raked over the coals due to its refusal to intervene to stop North Korean hackers from laundering many of the $388 million in tokens stolen from the Bitget exchange in September.
This time, the FBI was among those urging THORChain to act, although it appeared to make little impression on the protocol’s principals. Co-founder Chad Barraford tweeted, “I hope law enforcement catches whomever is responsible for the Binance hack,” but added that “THORNode operators have zero information that isn’t already public and readily available in real time. No subpoenas required, a best case scenario for investigations.”
Barraford went on to say that hackers look to “exit crypto though centralized parties into US dollars because that the most effective means to launder money. These CEXes have identifying info and communication with these bad actors and should work with law enforcement.”
Ironically, THORChain did temporarily stop the hackers from laundering additional funds, but not out of any sense of duty. Instead, an October 31 block reorganization on the Ethereum network caused THORChain “to pay out 10 ETH that a vault never received … Node operators then halted all chains as a precaution so core developers could investigate. The 10 ETH has been returned by the user to make the vault solvent again.”
You’re not worried enough
While Binance has been trumpeting its ability to absorb these staggering losses so customers don’t suffer, some observers are wondering whether the exchange will be able to do so when this happens again. Or if some other major exchange with shallower pockets could absorb a blow this size, or possibly larger. Because another attack is very much a case of when, not if.
There’s been a flurry of hacks/compromises of crypto platforms that seems to have no end, with September’s Bitget hack followed by last month’s $16 million stolen from India’s CoinDCX exchange.
A couple of days prior to the Binance hack, Indonesia’s largest exchange Indodax temporarily suspended deposits and withdrawals after detecting “an increase in cyber attack attempts.” Indodax resumed normal operations a few days later, assuring customers that “there were no unauthorized transfers or data breaches” and that there was no impact on customers.
On Sunday, the company behind the BTCPay service for merchants told operators to switch off their servers after “receiving reports of hot wallets on BTCPay servers being swept by unauthorized attackers.” The company later issued a report stating that the incident targeted users running older versions of its software.
On Monday, Brazil’s Mercado Bitcoin exchange confirmed a “security incident in one of our systems.” Mercado temporarily suspended deposits and withdrawals and vowed that customers wouldn’t suffer any losses, but the losses from the exploit have been estimated at ~$49 million.
Monday also saw renowned blockchain sleuth ZachXBT issue a report on the theft of over $106 million worth of tokens from “multiple centralized exchange accounts” belonging to an unnamed European Union entity. The funds were withdrawn in USDT and USDC on Sunday, then converted into other tokens and swapped across multiple chains. ZachXBT said the attacker’s identity was not yet known, but he stated: “With a high degree of confidence it is NOT [North Korea’s] Lazarus Group based on multiple laundering indicators.”
And in a true sign that we’re trapped on the highway to the danger zone, Chainalysis itself admitted on October 30 that it was “the target of a cybersecurity incident” that resulted in the attacker gaining access to “non-sensitive customer data, such as user IDs, full names, email addresses, and organization role labels for users provisioned on our platform.”
Chainalysis stressed that there was no indication that the attackers gained access to “investigation content (such as graphs, notes, or cases), transaction or query results, passwords in clear text, [multi-factor authorization] secrets, or user session tokens.” Chainalysis said it had engaged “world-class third-party cybersecurity experts” and was using “sophisticated” AI tools to review its security protocols and “strengthen our defenses.”
Wise words. But with AI tools available to both sides of this conflict, we’re almost certainly in for additional stories of this kind. And public confidence in the ability of crypto operators to protect customer assets hangs in the balance.
FAQs:
Did Binance resume withdrawals after the hack?
Yes. Binance began phased withdrawals on November 1 after pausing them following the October 29 hack. Customers pulled $4.65 billion in under 10 hours.
How much did Binance lose in the hack?
Hackers stole about $6.3 billion from Binance on October 29, the largest crypto hack in history.
How did the Binance hack happen?
Binance first blamed a compromised DevOps engineer’s laptop, then admitted “additional points of breach” it hasn’t detailed. Chainalysis and TRM Labs say attackers compromised a hot wallet to run attacker-deployed code that swept assets from other Binance wallets.
Who was behind the Binance hack?
The FBI says North Korea’s TraderTraitor group was responsible. President Trump questioned that attribution, saying it’s unknown, while Kim Yo-jong denied North Korean involvement.
Is the stolen Binance money still being laundered?
Yes. Chainalysis reports thousands of scripted transactions moving funds in unfamiliar patterns, and observers flagged flows through THORChain and Relay. The FBI urged THORChain operators and others to block linked addresses, but the protocol appeared unmoved.
Are crypto hacks getting worse in 2026?
Recent incidents suggest yes. Beyond Binance, they include Bitget’s $388 million hack, CoinDCX’s $16 million loss, Mercado Bitcoin’s estimated $49 million exploit, a $106 million European Union entity theft, BTCPay wallet sweeps, and a Chainalysis data breach.
Watch: Can Blockchain Recover Stolen Crypto? BSV Says Yes
