Binance reopens withdrawals in stages after a $6.3 billion theft
On Thursday evening, 29 October, Binance's hot wallets were drained of about $6.3 billion. According to TRM Labs, that means 18,270 BTC, 200,630 ETH, nearly $2.7 billion in USDT and USDC on Ethereum, 233 million XRP and 970,500 SOL. It is a record, far ahead of the Bybit hack in February 2025 ($1.5 billion).
On Saturday, the FBI named the North Korean group TraderTraitor, which was already behind Bybit. The funds are being converted into ether before being laundered through DeFi and instant exchange services. About $3 billion, in stablecoins, could be frozen by their issuers, something that is impossible with bitcoin or ether.
Binance suspended withdrawals and then reopened them on Sunday in phases, with BTC, ETH, USDT, USDC, BNB and XRP first, then Base, Dogecoin and Optimism. The platform says it has replaced 95% of the assets from its own funds, SAFU included, and promises a full proof of reserves. Crypto left on a platform therefore depends on that platform to get out, unlike crypto in a wallet where you hold the keys.
On Thursday evening, 29 October, hackers emptied part of the online vaults of Binance, the biggest crypto platform in the world. They got away with about $6.3 billion, mostly in bitcoin, ether and stablecoins (cryptos whose value tracks the dollar). Nobody had ever seen a theft this size in crypto. Binance first blocked all withdrawals, then reopened them in stages on Sunday, starting with bitcoin, ether and stablecoins. The platform says it is covering the losses with its own money, that it has already replaced 95% of them, and that no customer will lose their crypto.
Prices fell on Friday. If you hold crypto on a platform, it is the platform that keeps it for you, and this hack is a reminder that it can be robbed. The crypto you keep in your own wallet (an app like Trust Wallet or Rabby) is not exposed to this kind of attack. Binance, for its part, no longer accepts new customers in France.
Read the expert version
Binance robbed of $6.3 billion by North Korea's TraderTraitor group, says the FBI
The attack drained Binance's hot wallets on the evening of Thursday, 29 October. The platform speaks of $6.3 billion, and TRM Labs breaks it down as 18,270 BTC ($1.47 billion), 200,630 ETH, 1.875 billion USDT and 823 million USDC on Ethereum, 233.46 million XRP and 970,500 SOL, plus USDT on other networks. On 31 October, the FBI attributed it to TraderTraitor (Lazarus), which had left the same signature at Bybit in February 2025, with a massive conversion into ETH followed by dispersal over several months through DeFi and instant swaps.
About $3 billion is frozen, mostly stablecoins, because Tether and Circle blacklisted the addresses. The FBI has published these addresses and is asking platforms and on-chain analysts alike to block the related flows. The stolen BTC and ETH, on the other hand, can still move and go through bridges or mixers, so the selling pressure on ETH may last.
Binance suspended withdrawals, then reopened them on 1 November in phases, with a first window from 06:00 to 09:00 UTC for BTC, ETH, USDT, USDC, BNB and XRP, then Base, DOGE and OP. It says it has bought back 95% of the assets with its own funds and the SAFU, and it has announced a proof of reserves. The remaining 5% are tokens outside the top 10, which are less liquid. For your tax report, nothing changes, since your Binance positions are read as they are, and under French tax rules a possible reimbursement in kind is not a disposal.
