Binance is working to restore customer access after hackers stole about $6.3 billion in cryptocurrency in what has been described as the largest crypto theft on record. The exchange said it had replenished 90% of the stolen assets and remained on track to reopen withdrawals in stages on Sunday, Nov. 1, subject to final security checks.
The incident affected Binance hot wallets, which are connected to the internet so exchanges can process transactions and withdrawals. TRM Labs traced the first unauthorized transfers to about 8:05 p.m. UTC on Thursday, with assets moved across several blockchains. Industry partners have since frozen roughly $3 billion of the affected funds, while the investigation into how the breach occurred remains under way.
According to Cointelegraph’s recap of its live coverage, Binance has pledged to cover the losses from its own resources. The exchange said it had reserved more than $6.34 billion, including $5 billion already held in the affected tokens. That figure does not include the assets frozen by industry partners. Binance said it was acquiring the remaining tokens through exchanges and over-the-counter transactions.
Binance pledges to cover the losses
A Binance spokesperson said the $5 billion allocation was held in the company’s custody, but declined to identify the relevant wallet addresses, citing security concerns. CertiK, a blockchain security firm, said it needed additional information before it could independently verify those holdings.
The exchange said deposits and services not affected by the breach remained operational. It also planned to produce an initial proof-of-reserves snapshot within 12 hours of its announcement, with the results expected by Monday. A proof-of-reserves report is intended to show the assets held by an exchange and how they correspond to customer balances.
The scale of the incident has nevertheless left users waiting for withdrawals to resume. Binance said it expected to reopen them in phases on Sunday, Nov. 1, once security checks were complete. The exchange’s Saturday update said 90% of the stolen assets had been replenished and that the planned reopening remained on schedule.
Investigators examine wallet controls and EIP-7702
The attackers targeted hot wallets and used Ethereum’s EIP-7702 feature during the theft. EIP-7702 allows a wallet to authorize software to act on its behalf. The feature came under scrutiny because it was used to drain one of Binance’s wallets, although security experts said the funds could have been stolen without it.
Ido Ben-Natan, CEO of Blockaid, told Cointelegraph that compromised signing systems likely enabled the attack. He said the EIP-7702 mechanism may have helped the attackers bypass safeguards and move assets in a single operation.
Binance co-CEO Richard Teng said the attacker used an EIP-7702 delegation to obtain execution authority over a hot wallet without going through the exchange’s normal approval controls. Teng also said a “self-destruct mechanism” destroyed tools and traces that could have helped investigators reconstruct the attack.
Binance said its investigators had identified additional breaches beyond the initially suspected compromised laptop. However, the exchange reported no evidence that wallet private keys had been leaked. Teng stressed that the incident did not result from one engineer’s permissions or a single “one-click” action, and said the investigation had not assigned responsibility to any individual.
Chainalysis observed thousands of transactions in rapid succession, a pattern that could indicate automated laundering. The funds moved between different addresses and, in some cases, returned to wallets used earlier.
Attribution remains unconfirmed as markets react
TRM Labs attributed the attack to North Korea’s TraderTraitor group, which the US Federal Bureau of Investigation blamed for the $1.5 billion theft from Bybit in February 2025. Binance has not publicly confirmed who carried out the attack, so the attribution remains part of the ongoing investigation.
The breach also unsettled cryptocurrency markets and prompted a precautionary freeze on new deposits and borrowing at decentralized lender Aave. Aave reopened its markets on Friday afternoon, while Binance withdrawals remained suspended at the time of the latest updates.
Moneyiar market data, recorded on Nov. 1, 2026, at the stated times, shows BNB at $710.8219612197, up 0.87% over 24 hours but down 3.77% over seven days. Telcoin was priced at $0.0014461769, with a 0.13% 24-hour rise and a 3.08% weekly gain. Cap stood at $0.0729242628, down 7.98% in 24 hours and 24.63% over seven days, while edgeX traded at $0.3535830822, up 4.12% daily and 12.56% over the week.
The investigation, asset recovery and withdrawal timetable may still change as Binance completes its technical review and security checks.
