Binance Restarts Bitcoin Withdrawals After $6.3 Billion Hack

For crypto investors, seeing a balance in an account is one thing; being able to withdraw it is another. Binance began reopening withdrawals on November 1 after hackers stole about $6.3 billion on October 29. Bitcoin and selected cryptocurrencies returned first across 15 networks. Customers can now withdraw some funds. But how did hackers break into Binance? And what steps will the exchange take to protect customer funds?

Binance Reopens Withdrawals as the Investigation Continues

The first phase covered Bitcoin, Ethereum, BNB, Solana, XRP, and selected stablecoins. Other assets will return after further checks. Binance said it had replaced about 95% of the affected assets with company funds and would cover the rest.

In the first nine and a half hours, customers withdrew $4.65 billion and deposited about $1.01 billion. Net outflows reached $3.64 billion, around 2.1% of Binance's reported $171 billion in assets. This shows the scale of early withdrawals, but not how many customers left or why. The attack targeted Binance hot wallets, which are online wallets used for routine transactions.

FBI Investigation and the Impact on the US Crypto Market

On October 31, the FBI attributed the theft to TraderTraitor, a North Korean state-backed hacking group. The agency said the stolen assets were being converted mainly into Ether. The FBI, US Secret Service, and IRS Criminal Investigation issued a joint warning to crypto platforms. They urged them to block suspicious transfers. They also asked these platforms to block transactions linked to the identified wallet addresses. The agencies asked them to stop transactions linked to wallet addresses listed in the FBI alert.

President Donald Trump said on October 30 that US officials were still investigating who was responsible. No new Binance-specific US sanctions had been announced by November 2. US spot Bitcoin ETFs recorded $643.3 million in net outflows on October 30. Market data also showed about $1.53 billion in leveraged positions liquidated over 24 hours, including $1.29 billion in long positions.

These figures point to investor caution but do not prove the hack caused all the selling. ETF outflows show money leaving funds. Liquidations happen when traders use borrowed money. If losses rise or they lack enough collateral, their positions can close automatically.

For US investors, the breach raises questions about exchange security and custody. Binance.com and Binance. US operate as separate platforms. This means the global exchange's withdrawal restart does not indicate that the US platform faced the same disruption.

Four Details Investors Should Watch Next

-Replacement is not recovery: Binance replaced the affected customer balances using its own funds. However, investigators have not confirmed the recovery of the stolen coins.
-Check the network before transferring: A cryptocurrency may be available for withdrawal on one blockchain. However, withdrawals on another network may still be paused.
-Stablecoins have different controls: Some issuers can freeze tokens linked to suspicious activity. Bitcoin has no central issuer with this power.
-Proof of reserves has limits: It can show whether an exchange holds assets to back customer balances. It does not prove its systems are safe from hackers.

Binance’s next step is to explain how the attack happened. The exchange has promised a report on the security breach and the changes it has made. Investors will look for clear answers and stronger security measures. The incident also highlights the risks of storing crypto on exchanges.