Binance resumes withdrawals after recovering 95% of $6.3 billion stolen in cyberattack

What happened

Binance froze deposits and withdrawals on November 1 after hackers stole $6.3 billion worth of cryptocurrency from its wallets. The exchange attributed the breach to TraderTraitor, a North Korean hacking group identified by the FBI. The incident is being described as the largest digital heist in history.

The hackers reportedly used advanced tactics, including AI-driven automation, to prepare for and execute the attack within 36 hours. They laundered the stolen assets at unprecedented speed, converting much of it into Ethereum before wiping evidence of their operations.

Recovery and withdrawal resumption

Binance has recovered 95% of the stolen assets, with the remaining 5% consisting of less liquid tokens that may take longer to source. The exchange has allocated $6.34 billion from its own funds, including its $1 billion Secure Asset Fund for Users (SAFU), to cover the losses and compensate users.

Withdrawals resumed in phases starting November 1, with 15 cryptocurrencies—including Bitcoin, Ethereum, XRP, and Dogecoin—restored initially. However, some networks remain partially or fully suspended, and Binance has committed to restoring all services once security checks are complete.

Broader context of cyberattacks on exchanges

The Binance breach follows other high-profile cyberattacks on cryptocurrency exchanges. WazirX and Bybit recently lost $235 million and $1.5 billion, respectively, with North Korean hackers also implicated in those incidents. These attacks highlight the growing sophistication of state-linked cybercrime groups targeting digital assets.

The FBI has accused North Korea of using such cyberattacks as a revenue stream, though Pyongyang has denied these allegations.

Earlier reporting on the breach

Lazyfounder previously reported on the breach when Binance first froze withdrawals, noting the $6.3 billion theft and its potential implications for the cryptocurrency sector. The earlier story highlighted concerns about the security of digital assets and the scale of the attack, which dwarfed other recent breaches in the industry.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

For cryptocurrency founders and operators, this incident underscores the critical importance of robust security measures and contingency planning. Binance’s decision to cover losses using its own funds—rather than passing them to users—sets a precedent for how exchanges might handle similar crises. However, the scale of the breach and the sophistication of the attackers signal that even the largest platforms remain vulnerable to state-linked cybercrime groups.

The use of AI-driven automation in this attack also raises concerns about the evolving tactics of cybercriminals. Exchanges and other crypto platforms may need to invest more heavily in AI-powered security tools to detect and mitigate such threats in real time. Additionally, the involvement of North Korean operatives highlights the geopolitical risks facing the industry, which could lead to increased regulatory scrutiny or demands for stricter compliance measures.

Related on Lazyfounder

• Binance
• FBI
• More technology news
• Binance hit by $6.3 billion crypto hack, GLP-1 drugs linked to eating disorders
• Binance investigates record $6.3 billion hack allegedly carried out by North Korean operatives