Binance Reopens Withdrawals After the $6.3B Hack
Matthew Leo · Published November 6, 2026 · News
Binance has begun restoring withdrawals after a theft the FBI attributes to North Korea’s TraderTraitor operation. The exchange said on November 1 that it had covered about 95% of the roughly US$6.3 billion taken, while withdrawals for some less-liquid assets were still returning in phases.
That is a meaningful operational milestone, but it is easy to describe it too generously. Replacing assets on an exchange is not the same as recovering stolen cryptocurrency from the attacker.
What Binance says it has restored
In an October 31 customer update, Binance said it had replenished 90% of affected assets using company resources, including part of its Secure Asset Fund for Users, its futures insurance fund and corporate treasury. Reuters reported on November 1 that the covered share had since reached about 95% and that Bitcoin withdrawals had resumed.
The exchange’s first incident notice said a compromised DevOps laptop was involved and that investigators had found additional points of compromise. Binance said it had no evidence that private keys were leaked, and that roughly US$3 billion of the stolen assets had been frozen. A promised postmortem has not yet filled in the remaining technical gaps.
Replacement, freezing and recovery are different
Three figures matter, and they should not be collapsed into one:
- Customer assets replaced: Binance says it has used its own resources to restore most account balances and withdrawal capacity.
- Stolen assets frozen: assets identified at cooperating services may be immobilized, but a freeze does not automatically return them to Binance.
- Assets recovered: funds actually returned to the exchange are the smallest and least clearly disclosed category so far.
The FBI attributed more than US$6 billion in theft to TraderTraitor and published addresses for virtual-asset providers to block. That attribution is stronger evidence about responsibility than Binance’s still-incomplete explanation of how the compromise unfolded.
What proof of reserves can and cannot show
Binance has pointed customers to a proof-of-reserves snapshot. Such a snapshot can help show that specified on-chain assets existed at a point in time and can allow users to check whether their balances were included. It does not, by itself, provide an audited view of all corporate liabilities, off-chain obligations or the legal availability of every reserve asset.
Customers should therefore treat the snapshot as one control, not a substitute for audited financial statements or a completed incident report.
What Canadian holders should check
Canadians who still have exposure through an eligible account, business counterparty or self-custody transfer should verify the status of the exact asset and network before moving funds. A reopened Bitcoin withdrawal does not prove that every token or chain is operating normally.
- Use Binance’s official status and support pages rather than links in messages or social posts.
- Confirm the withdrawal network, destination address and minimum amount with a small test transaction where practical.
- Review account sessions, API keys and withdrawal allowlists, especially if the account was used through trading software.
- Preserve transaction records for tax and incident documentation.
- Do not interpret a restored balance as evidence that the stolen asset itself was recovered.
What remains unanswered
The central unknown is the full intrusion path: how one compromised device and any additional access points produced a theft of this scale without private-key leakage, as Binance currently maintains. Customers also need a clearer reconciliation of corporate funds used, frozen assets and assets actually returned.
Until the postmortem arrives, the safest conclusion is narrow. Binance has made substantial progress restoring customer access with its own balance sheet. It has not yet shown that the underlying security failure is fully understood or that most stolen funds have been recovered.
Tags: cybersecurity, incident response, technology finance, cryptocurrency