Binance lost about US$6.3 billion from its hot wallets (wallets kept online so withdrawals can go out fast) on 29 and 30 October 2026. On 31 October it said it had covered up to 90% of the stolen assets; on 1 November, about 95%. The money came from its SAFU reserve fund, part of its futures insurance fund and its company treasury. Co-CEO Yi He said Binance would use half of the $1 billion SAFU fund and fill it back up.
Withdrawals reopened on Sunday 1 November, bitcoin first, at about 13:00 Thai time. The first phase covers 15 coins, among them BTC, ETH, USDT, USDC and XRP. The last 5% is coins outside the top ten, which Binance says are harder to buy in size. Since the reopening, users have taken out about $3.6 billion, Siam Blockchain reported, citing Cointelegraph. Binance's 2025 annual report gives $162.8 billion in customer assets.
About $3 billion of the stolen coins stay frozen, mostly USDT and USDC; bitcoin and ether cannot be frozen this way. On 31 October the FBI named North Korea's TraderTraitor unit and said the thieves had turned the coins into ether. Co-CEO Richard Teng called it a complex attack, with hacked laptops and malware built to erase its traces.
Binance TH is a separate company, Gulf Binance, licensed by the Thai SEC. It paused crypto withdrawals on 30 October while baht kept moving. The reports read for this note, up to 2 November, cover Binance.com's reopening and give no date for Binance TH.
Speed: days
The drop came in hours and the climb back is taking days, not the years of Mt. Gox (2014, repayments from 2024) or FTX (2022, repayments from 2025). The difference is the balance sheet: those firms had no money left, and Binance's $6.3 billion hole is about 4% of the $162.8 billion it holds for customers. Outflows of $3.6 billion so far are about 2% of that. The guess: withdrawals settle within weeks unless Binance's promised proof-of-reserves report shows a gap. The way in was laptops and people, not the math under bitcoin; the keys sat on machines someone used every day.