Binance resumes phased withdrawals after $6.3 billion crypto hack

Binance, the world’s largest cryptocurrency exchange, has begun restoring cryptocurrency withdrawals in phases after a cyberattack that stole about $6.3 billion in digital assets. The exchange disclosed the security incident recovery update on its official X account on Sunday, November 1, 2026. The FBI attributed the incident to North Korean hackers. It is the biggest cryptocurrency heist in history, surpassing the $1.5 billion Bybit hack in February 2025.

Binance said the first phase of withdrawals would resume between 06:00 and 09:00 GMT on Sunday, November 1, after security assessments and precautionary measures. The initial rollout covers 15 blockchain network groups.

What users can withdraw

Withdrawals will become progressively available for Bitcoin, Ether, BNB, Solana, XRP and Dogecoin. The rollout also includes Tether’s USDT and Circle Internet Group’s USDC across supported networks.

Binance said the restoration would be guided by user demand and security checks rather than reopening all withdrawal services at once. The exchange said: "We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened."

Binance warned of temporary delays or longer processing times during the initial rollout because of increased traffic. It advised customers whose withdrawals fail to try again after a short while. It said it would continue monitoring network and platform performance.

How the attack happened

The attack occurred on Thursday, October 29. Hackers compromised Binance’s hot wallets and initiated unauthorised withdrawals estimated at $6.3 billion. Binance’s initial investigation suggested the breach involved a compromised DevOps engineer’s laptop. The attacker allegedly used it to access a service container and submit unauthorised withdrawal transactions.

Binance and other cryptocurrency companies worked with blockchain intelligence firms, law enforcement agencies and asset issuers to trace and freeze the stolen funds. By November 1, Binance said it had covered approximately 95% of the affected amount. The remaining 5% consisted largely of less-liquid tokens that would take longer to source.

Scale of the heist

The Binance incident is significantly larger than the February 2025 attack on Bybit, where about $1.5 billion was stolen. The FBI also attributed that incident to North Korean hackers.

According to blockchain analytics firm Chainalysis, the cryptocurrency industry recorded more than $3.4 billion in stolen digital assets between January and early December 2025. The Bybit attack accounted for approximately $1.5 billion of that total. That was an increase of approximately 54% compared with the $2.2 billion stolen from cryptocurrency platforms in 2024, according to the firm’s previous report. The Binance theft alone, at approximately $6.3 billion, is substantially higher than the combined amount recorded across the cryptocurrency ecosystem in either of those years.

Nigerian context

For Nigerian users, the incident comes against the backdrop of Binance’s regulatory challenges in the country. Users can still access Binance accounts, but the exchange discontinued its Nigerian naira services in March 2024, including naira deposits, withdrawals and trading pairs.

Nairametrics reported on April 18, 2026, that the Central Bank of Nigeria had concluded its testimony against Binance in ongoing legal proceedings. The CBN maintained that the exchange conducted what it described as "hidden operations" in Nigeria without authorisation.