Key Highlights
- On November 2, Binance co-CEO Yi He said that securing the exchange’s environment remains the top priority.
- She contrasted Binance’s response with fraudulent platforms and opaque banks that shut down without warning and never reopened withdrawals.
- Binance began phased withdrawal restoration on November 1 across 15 networks and major assets, processing about $4.65 billion in withdrawals against $1.01 billion in deposits within hours, a net outflow of roughly $3.64 billion or about 2.1% of reported assets under management.
Binance co-founder and co-CEO Yi He stated on November 2 that the exchange’s top priority remains securing its environment so users can withdraw funds and normal operations can fully resume.
In a post on X, she contrasted Binance’s approach with fraudulent exchanges, peer-to-peer platforms, and some commercial banks that maintained opaque ledgers, shut down without warning, and left users unable to recover funds or obtain explanations.
“Every action has a motive,” Yi He wrote. She noted that such platforms often liquidate or declare bankruptcy after disappearing, offering only arbitrary excuses, with no real operations or transparency about account balances or the destination of funds. Withdrawals in those cases never reopen. She thanked users for their support.
Binance Resumes Withdrawals in Phases
Binance began a phased restoration of withdrawals on November 1, several days after suspending them following the October 29 incident in which attackers stole approximately $6.3 billion in digital assets from the platform’s hot wallets. The first phase covered major assets including bitcoin, ether, USDT, USDC, BNB, XRP, and others across 15 networks, prioritized by user demand. Additional networks and assets followed as security and stability checks cleared.
In the hours after reopening, the exchange processed about $4.65 billion in withdrawals against $1.01 billion in deposits, resulting in a net outflow of roughly $3.64 billion, or about 2.1% of its reported assets under management. Deposits had remained open throughout. Binance said it had covered approximately 95% of the stolen assets using company funds, including portions of its Secure Asset Fund for Users, futures insurance fund, and corporate treasury, and would continue sourcing the remaining less-liquid tokens until full 1:1 backing is restored. A new Proof of Reserves snapshot was published for user verification.
Yi He had earlier indicated that withdrawals would reopen only after the environment was confirmed secure and free of contamination, a process that involved rebuilding wallet setups and conducting audits. Fiat withdrawal channels for several currencies were also expanded in subsequent updates.
U.S. Secret Service Launches Investigation into Binance Hack
U.S. authorities have attributed the attack to the North Korean state-sponsored group known as TraderTraitor, linked to the Lazarus Group, the same actors previously blamed for the $1.5 billion Bybit theft in 2025. The FBI, working with the U.S. Secret Service and IRS Criminal Investigation, confirmed the attribution and observed the actors converting stolen assets primarily into Ether ahead of further laundering through decentralized finance protocols and instant swap services.
The FBI released a list of more than 600 Ethereum addresses, 19 Bitcoin addresses, and one Solana address tied to the proceeds and urged crypto service providers, THORChain node operators, RPC providers, DeFi platforms, and analytics firms to block related transactions.
Industry partners had already frozen roughly $3 billion in stablecoins and other assets shortly after the theft. Binance continues cooperating with law enforcement while completing its internal security overhaul.
The record-scale incident, which unfolded largely within about 20 minutes across multiple blockchains, tested confidence in the largest cryptocurrency exchange by trading volume. By prioritizing verified security before full restoration of services and absorbing the financial impact itself, Binance has sought to differentiate its response from the opaque failures Yi He described. Users continue to monitor further phases of withdrawal access and ongoing recovery efforts.
