Binance reactivated withdrawals across 87 blockchain networks as of Nov. 14, marking critical progress following a $6.3 billion security breach on Oct. 29, 2026.
The breach saw attackers extract approximately 167,464 ETH and $1.6 billion in tether (USDT) from Binance-controlled hot wallets spanning over a dozen blockchains. Blockchain analysts including Chainalysis, Elliptic, Bitquery and TRM Labs documented that most stolen capital exited those wallets within about 20 minutes. Third parties subsequently froze roughly $3 billion of the stolen funds.
Investigators traced the initial entry point to a compromised Devops engineer's laptop. Binance co-CEO Richard Teng later acknowledged additional complexities, with blockchain researchers documenting exploitation of Ethereum's EIP-7702 authorization mechanism. The FBI attributed the attack to North Korea's TraderTraitor group with high confidence.
Binance said all customer funds are protected and pledged to cover losses using its SAFU fund and corporate resources.
Ethereum-related protocols, Litecoin, Cardano and Avalanche are among the networks where withdrawals have resumed. Binance targets full restoration across all remaining networks and assets by the end of next week, though the company cautioned that temporary delays and extended processing times could occur as activity increases.
Cryptoquant on-chain data shows pronounced negative netflow readings for Bitcoin during early November, with users moving BTC off the platform. Despite the turbulence, Binance's Bitcoin reserves remained elevated throughout the period of high withdrawals and market uncertainty.
