Binance Begins Phased Withdrawal Resumption After $6.3bn Cyberattack

Binance, the world’s largest cryptocurrency exchange, has started restoring cryptocurrency withdrawals in phases following a cyberattack that resulted in the theft of about $6.3 billion in digital assets.

The exchange disclosed the development in a security incident recovery update published on its official X account on Sunday, November 1, 2026.

The FBI has attributed the attack to North Korean hackers, making the incident the largest cryptocurrency heist reported so far. It dwarfs the $1.5 billion Bybit hack recorded in February 2025.

Binance said it would begin the first phase of withdrawal restoration between 06:00 and 09:00 GMT on Sunday after completing security assessments and precautionary measures.

The initial phase covers 15 blockchain network groups and includes major cryptocurrencies such as Bitcoin, Ether, BNB, Solana, XRP and Dogecoin.

It also covers Tether’s USDT and Circle’s USDC stablecoins across supported networks.

However, Binance said it would not restore all withdrawal services at once. Instead, the exchange will rely on security checks and user demand to determine the order of restoration.

“We are taking a phased approach by prioritizing tokens based on the past week data of user demand,” Binance said.

The exchange added that it would restore each network and asset pair only after completing stability and security checks.

Binance also warned users to expect temporary delays during the initial rollout because of increased traffic. It advised customers whose transactions fail to try again after a short period.

The cyberattack occurred on Thursday, October 29, when hackers compromised Binance hot wallets and initiated unauthorised withdrawals estimated at $6.3 billion.

Binance’s preliminary investigation linked the breach to a compromised laptop belonging to a DevOps engineer. The compromise allegedly gave the attacker access to a service container used to submit unauthorised withdrawal transactions.

The scale of the attack prompted a wider industry response as Binance worked with blockchain intelligence firms, law enforcement agencies and digital asset issuers to trace and freeze the stolen funds.

By November 1, the exchange said it had covered about 95 per cent of the affected amount. It said the remaining five per cent consisted mainly of less-liquid tokens that would require more time to source.

The recovery effort forms part of Binance’s broader attempt to secure its platform and restore normal services while completing additional security checks.

The incident has also raised fresh concerns over the security of cryptocurrency exchanges. At $6.3 billion, the reported loss is more than four times the amount stolen in the February 2025 Bybit attack.

The FBI also blamed North Korean hackers for the Bybit breach, which resulted in the theft of about $1.5 billion in digital assets.

Data from blockchain analytics firm Chainalysis showed that cryptocurrency platforms lost more than $3.4 billion to theft between January and early December 2025.

The Bybit attack accounted for about $1.5 billion of that figure. Chainalysis had earlier estimated that hackers stole about $2.2 billion from cryptocurrency platforms in 2024.

The Binance theft therefore exceeds the combined value of cryptocurrency stolen across the industry in either 2024 or 2025.

For Nigerian users, the development comes amid Binance’s previous regulatory difficulties in the country.

The exchange discontinued its Nigerian naira services in March 2024, ending naira deposits, withdrawals and trading pairs.

The Central Bank of Nigeria (CBN) has also concluded its testimony against Binance in ongoing legal proceedings. The apex bank maintained that the exchange conducted what it described as “hidden operations” in Nigeria without authorisation.