Binance Restores Withdrawals After $6.3bn Hot-Wallet Breach as Circle Raises USDC Freeze to $1.1bn

Binance has reopened withdrawals on 15 networks and says it has covered about 95% of the roughly $6.3bn impact. Circle told CNBC it has frozen more than $1.1bn in USDC; Tether says it froze more than $1.5bn in USDT.

Binance Restores Withdrawals After $6.3bn Hot-Wallet Breach as Circle Raises USDC Freeze to $1.1bn — editorial cover artwork
Binance Restores Withdrawals After $6.3bn Hot-Wallet Breach as Circle Raises USDC Freeze to $1.1bn — editorial cover artwork

By Elena Marsh, Journalist, Stablecoins

Updated 3 November 2026: this article was first published on 31 October, when withdrawals were suspended. It has been rewritten to reflect Binance's phased restart of withdrawals, its completed proof of reserves for 31 October, Circle's larger freeze figure, Tether's 2 November statement and the FBI's attribution as reported by CNBC.

Binance, the world's largest cryptocurrency exchange by Reuters' description, began restoring withdrawals on 1 November, three days after attackers compromised its hot wallets at around 20:05 UTC on 29 October 2026. Binance estimates the impact at about $6.3bn of token assets and says it has now covered about 95% of that amount with its own funds.

Stablecoin issuers have raised their freeze figures. Circle "coordinated with law enforcement to freeze more than $1.1 billion in USDC associated with the incident", a spokesperson told CNBC, up from the more than $800m its CEO cited on 29 October. Tether said on 2 November that it froze more than $1.5bn in USDT within 30 minutes of the attack.

What Binance has said so far

All figures below are Binance's own unless stated otherwise. None has been independently audited.

Item — Binance's position (as of Recovery Update #5, 2 Nov)

Time of compromise — Around 20:05 UTC, 29 October

Estimated impact — About $6.3bn of token assets

Covered with company funds — About 95%, up from about 80% (30 Oct) and 90% (31 Oct)

Remaining 5% — Less liquid tokens outside the ten fully backed assets, still being bought

Fully backed assets — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC, at 100%

Withdrawals — Phase one reopened 1 November on 15 networks; next phase planned for 3 November

Deposits — Open throughout and unaffected

Proof of reserves — Zero-knowledge proof for the 31 October snapshot completed 2 November; next snapshot, with more tokens, planned for 4 November

Technical findings — Post-incident report to follow once the investigation is complete

Withdrawals return in phases

Binance's Recovery Update #4, published on 1 November, said phase one would reopen between 06:00 and 09:00 UTC that day on 15 networks: BTC, ETH, BSC, TRX, SOL, XRP, ZEC, DOGE, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui, each for listed assets only. CNBC reported that Binance said all 15 were running by 12:36 UTC and that testing continued for the remaining networks.

Binance said in a post on X that it processed $4.65bn in withdrawals and $1.01bn in deposits between 06:00 and 15:30 UTC on 1 November, leaving $3.64bn in net outflows, according to CNBC. Binance has said the next phase, for additional networks and assets, is planned for 3 November and will be rolled out progressively. It has not published that list. Customers should check the withdrawal page for their specific asset and network.

Proof of reserves

In Recovery Update #5 on 2 November, Binance said the full zero-knowledge proof for its 31 October, 00:00 UTC snapshot was complete, so holders of the ten listed tokens can check that their balances are backed at least 1:1 using its verifier. Binance plans another snapshot covering more tokens on 4 November and estimates the proof will take about 40 to 50 hours to generate. The Block reported the completion the same day.

This is a self-published, cryptographic check of a dated snapshot for ten assets. It is not a financial-statement audit, and it does not cover the less liquid tokens Binance is still buying.

Stablecoin issuers as the first line of recovery

The freezes show the one point in the system where stolen funds can be stopped quickly. Bitcoin and ether have no issuer that can block an address; dollar stablecoins do. Decrypt reported on 29 October that Tether froze 975.1m USDT and Circle froze 823m USDC in the main receiving wallet; both companies' totals have risen since.

Circle said its investigation is ongoing, CNBC reported. Tether said on 2 November that its freeze was made within 30 minutes of the attack. Tether did not say whether, or when, the frozen USDT would be returned to Binance.

A freeze is not a recovery. Frozen tokens cannot move, but they have not been returned to Binance, which is covering the loss from its own funds.

Investigations and attribution

The FBI attributed the attack to North Korean hackers, identifying the operation as TraderTraitor, CNBC reported. Blockchain analytics firms TRM Labs and Chainalysis had earlier said the attack resembled previous thefts blamed on North Korea, according to Reuters. North Korea has denied involvement in such thefts. Binance has not published its technical findings, and NextCurrency is not drawing conclusions about how the breach happened beyond what Binance and named sources have said.

What happens next

Three things matter now for Binance customers and counterparties: the next withdrawal phase planned for 3 November, the 4 November proof-of-reserves snapshot covering more tokens, and Binance's post-incident report. Each is a Binance plan, not a completed event.

Sources

Explore NextCurrency