Binance sets phased withdrawal restart after $6.3B hack

Binance says it will reopen cryptocurrency withdrawals in phases after a hack drained about $6.3 billion from its hot wallets, a breach the Associated Press describes as the largest crypto theft on record. The exchange says deposits remained open; its Nov. 1 update set a window to begin restoring withdrawals after security checks.

A withdrawal moves crypto from a customer’s Binance account to an external wallet over a blockchain network. Binance’s hot wallets are online and handle transfers; the company says they were compromised at about 20:05 UTC on Oct. 29. According to Binance’s security incident update, the exchange revoked affected authorizations and temporarily suspended withdrawals while it checked the affected systems. Trading was not described as halted in that update.

How will Binance restore withdrawals?

Binance plans to reopen supported asset and network combinations in stages, after checking each service. Its Nov. 1 recovery update said phase one was due to begin between 06:00 and 09:00 UTC that day. Bitcoin withdrawals were among those listed, alongside assets on Ethereum, BNB Smart Chain, Tron, Solana and other networks. The exchange said each network and asset would become available progressively, with more added after readiness checks.

The phased rollout works like reopening lanes on a bridge one at a time: Binance checks each route before allowing transfers through it. Users may face delays, the company said, and directed them to check the withdrawal page or network status page for availability. Deposits stayed open during the suspension.

How much was taken, and what can be recovered?

Binance put the loss at about $6.3 billion in token assets. The company said it had set aside more than $6.34 billion to cover the impact, using its Secure Asset Fund for Users, futures insurance funds and corporate treasury. Its Oct. 30 update said about $3 billion had been frozen on-chain with help from blockchain firms, law enforcement and industry partners.

Binance said the attack involved unauthorized withdrawals, but its investigation was still underway. An earlier statement said a compromised DevOps engineer’s laptop may have let an attacker access a service container and submit withdrawal transactions. The company later said investigators had found additional points of breach and no evidence that wallet private keys had leaked. It had not published a completed technical report.

What does the restart mean for customer balances?

Binance says it will absorb the financial impact and that user funds remain safe. In its Nov. 1 update, it said it had covered about 95% of the impacted amount, with the remaining 5% made up of less liquid tokens that could take longer to source. The exchange said its investigation and recovery work would continue after withdrawals returned.

Source material

• Binance’s security incident update — binance.com
• Nov. 1 recovery update — binance.com