Bitcoin and Ethereum coins on a dark surface in a Binance hack update

Binance Hack Update: Withdrawals, the FBI Probe, and the North Korea Trail

by

Update — Sunday, November 1, 2026: Binance has begun reopening withdrawals. Phase one went live this morning (06:00–09:00 UTC) covering 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, and Polygon, and the exchange says it has now covered about 95% of the stolen assets — roughly $6 billion — with the 10 largest affected tokens fully backed. This is a phased restart, not a full reopening: other networks follow only after further security checks, and Binance warns of delays during the rollout. In the other major development, Reuters reported that the FBI has now officially attributed the attack to North Korea’s TraderTraitor unit — the first US government attribution, which had not yet been made when the report below was published on October 31. A comprehensive proof-of-reserves update from Binance is scheduled for Monday, November 2. The original report follows, as published on October 31.

Two days after the largest crypto theft on record, the Binance hack update is a story of deadlines. Withdrawals are still paused, with a phased restart targeted for Sunday, November 1. The FBI and the US Secret Service have publicly joined the response. About $3 billion of the stolen assets are frozen, and Binance has put dates on the two things customers are waiting for: withdrawals first, then a proof-of-reserves report on Monday. This binance hack update covers only what has changed since our original report on the Binance hack — what is confirmed, what is still alleged, and what happens next.

Binance hack update: what changed in 48 hours

  • Withdrawals: still suspended as of Saturday, October 31. Binance targets a phased restart on Sunday, November 1, subject to security checks. Deposits, paused in the first hours, are operating again.
  • The money: roughly $3 billion frozen on-chain, up from $2.54 billion early Friday. Binance has reserved more than $6.34 billion to cover losses — about 80% already held in the same tokens that were stolen, the rest being bought.
  • The investigation: the FBI says it is aware of the incident and is engaged; Secret Service investigators are working with industry partners to freeze and recover funds. Neither agency has attributed the attack to anyone.
  • The suspects: TRM Labs, Chainalysis, and Elliptic all attribute the theft with high confidence to North Korea’s TraderTraitor unit. Binance has named no one.
  • The proof: a proof-of-reserves snapshot was taken Saturday; results are due Monday, November 2. The report is not out yet.
  • The market: bitcoin is holding just above its post-hack low, trading around $77,600 on Saturday.

Binance hack update: withdrawals still paused — Sunday is the target

The single most important fact in this binance hack update has not changed since Thursday night: you still cannot withdraw from Binance.com. In its second security incident update, published Friday evening (19:33 UTC) and signed by co-CEOs Yi He and Richard Teng, Binance said its technical team is targeting the start of a phased withdrawal restoration within approximately 34 hours — which lands on Sunday, November 1 — provided security checks are complete. Teng separately told reporters the exchange remains on track to resume withdrawals by Sunday.

“Phased” is the word to watch. Binance has not promised that every asset, network, and account returns at once, and a phased restart usually means queues and staggered availability. Deposits are a different story: Binance halted both deposits and withdrawals in the first hours of the incident, then restored deposits; its October 30 update says deposits and other unaffected services operate normally. Lending protocol Aave, which briefly froze new deposits and borrowing as a precaution, reopened its markets on Friday — a small sign that the wider market contagion stayed contained.

Update: Binance withdrawals resume in phase one on Sunday, November 1 – see the phase-one report for which networks are live and what is still not back.

Update: Binance phase two is live – see the phase-two proof-of-reserves report.

The money: $3 billion frozen, $6.34 billion set aside to cover losses

The frozen total has climbed. Binance put the frozen figure at about $2.54 billion early on Friday; by its Friday update, roughly $3 billion of the stolen assets were frozen on-chain with partners’ help. The biggest blocks came from the stablecoin issuers. Reuters reported that Tether froze nearly $1.57 billion in USDT and Circle more than $800 million in USDC; Circle CEO Jeremy Allaire confirmed his company had frozen more than $800 million and would keep supporting the investigation. TRM Labs’ own early-Friday tally, about $2.7 billion, counted roughly $1.77 billion of USDT — a different figure from Reuters’ $1.57 billion, and a reminder that freeze totals are still moving and measured differently by each firm. Elliptic says it has verified $2.84 billion frozen, and estimates about $3.23 billion remains in wallets the attackers control, in assets no issuer can freeze.

Frozen is not the same as returned, and Binance’s cover pledge is separate from the freeze. The exchange says it has reserved more than $6.34 billion — slightly more than the roughly $6.3 billion it estimates was taken — through its Secure Asset Fund for Users (SAFU) and corporate funds. About $5 billion of that, roughly 80%, is already held in the exact tokens that were drained; Binance is buying the remaining fifth or so through exchanges and over-the-counter desks, and has cautioned that thin liquidity could slow that process. The promise, in co-CEO Richard Teng’s words, is that customer money is safe and Binance is covering every loss.

The FBI probe is real — but there is no official attribution

On Friday, US law enforcement stepped out of the background. The FBI said in a statement, reported by Reuters and Bloomberg, that it is “aware of the incident and is engaged with relevant public and private partners to understand the scope of the activity, evaluate potential impacts, and coordinate appropriate investigative steps.” A Secret Service spokesperson said its investigators are “working around the clock” with private-sector partners, including Circle, to identify, freeze, trace, and recover the stolen funds, coordinating with the US Attorney’s Office for the District of Columbia. Binance confirmed on Friday that it is working with law enforcement and has begun recovering affected assets, without naming agencies itself.

Be precise about what this means. Federal engagement is confirmed; federal attribution is not. No US agency has said who carried out the attack. In the 2025 Bybit case, the FBI’s public attribution to North Korea came five days after the theft — so an official word, if it comes, may still be days away. Anything you read claiming the US government has “confirmed” North Korea did this is ahead of the facts.

The Binance North Korea hack trail hardens — including the AI question

Programmer at a laptop in a dark room as investigators trace the Binance hack update

The private-sector case, meanwhile, got stronger. TRM Labs and Chainalysis were joined by a third analytics firm, Elliptic, in attributing the theft with high confidence to TraderTraitor, the North Korean state unit linked to the Lazarus Group. Chainalysis strengthened its call with a concrete link: stolen Binance assets were observed mixing with proceeds from September’s Bitget theft, which investigators had already attributed to North Korean actors. The BBC’s follow-up analysis, published Saturday, walks through the unit’s long history — from the Sony Pictures hack onward — and the sanctions-evasion motive that North Korea has always denied.

The BBC also reported expert views that the attackers may have used AI tools to automate parts of the intrusion and the laundering that followed. Treat that as an expert claim, not an established fact — but the on-chain evidence for automation is real: Chainalysis described “never-seen-before laundering patterns,” with thousands of transactions in a short window suggesting a programmatic process, including one wallet that swapped $325 million of stablecoins into about $285 million of ether in roughly 20 minutes. Experts quoted in coverage differ on how much AI changed the picture: Cornell economist Eswar Prasad said AI is “turbocharging” hackers’ ability to find and exploit flaws, while other security specialists note this unit was already capable of an operation like this before AI tools matured. Binance, for its part, still has not named a culprit, and says investigators found additional breach points beyond the first compromised laptop — including abuse of Ethereum’s EIP-7702 delegation feature to seize control of a hot wallet, and a self-destruct mechanism that erased the attackers’ tools.

One caution for readers: social media is filling with “inside job” theories ahead of Monday’s reserves report. As of Saturday, no evidence supports them, and the on-chain tracing firms investigating the theft point outward, to an external state-backed attacker. File the theories under speculation until someone produces proof.

The 48-hour timeline

  • Thu Oct 29, ~20:05 UTC — Unauthorized transfers begin draining Binance hot wallets across ten blockchains; most funds gone in about 20 minutes.
  • Thu Oct 29, evening — Binance confirms it is investigating, suspends deposits and withdrawals, and says user funds are safe. Binance.US states it is not affected.
  • Fri Oct 30 — FBI and Secret Service statements confirm federal involvement. Binance’s Update #2 (19:33 UTC) sets aside $6.34 billion, targets a Sunday phased withdrawal restart, and promises proof-of-reserves results by Monday.
  • Sat Oct 31 — Proof-of-reserves snapshot taken. BBC publishes its North Korea analysis. Withdrawals still paused; bitcoin holds near $77,600.
  • Sun Nov 1 (target) — Phased withdrawal restart, if security checks pass.
  • Mon Nov 2 (due) — Proof-of-reserves results published; further technical findings expected within about 48 hours of Friday’s update, with a full post-mortem to follow.

The market: bitcoin is bruised, not broken

Bitcoin has steadied — barely — above its post-hack low of about $76,368. Market data on Saturday, October 31 put bitcoin at roughly $77,600 (Finnhub), with CoinGecko recording about $77,177 early Saturday and a 24-hour low near $76,338, so the price is still hugging the bottom of its post-hack range rather than rebounding. October as a whole was rough for crypto, and the hack landed a day after the Fed’s decision this week to hold interest rates steady, with risk appetite already thin. The honest read: the market absorbed the largest theft in crypto history without a cascade, but it has not yet decided the episode is over. Sunday’s withdrawal restart and Monday’s reserves report are the next two tests.

What Binance users should do now

Crypto coins on a keyboard as users follow the Binance hack update

The question readers keep asking — is Binance safe right now? — has a practical answer: Binance has pledged to honor every balance and has reserved the money to do it, but until withdrawals actually reopen, your funds are locked on the platform and the pledge is untested. These steps protect you either way:

  1. Do not panic-move money on Sunday. When withdrawals reopen in phases, expect queues and possible per-asset delays. A slow withdrawal during a phased restart is normal operations, not a new red flag.
  2. Verify your balance records today, while you wait. Export or screenshot your Binance balances, deposits, and trade history now. If anything is disputed later, your own timestamped records are your strongest evidence.
  3. Ignore every “support” message you receive. Binance’s own explainer warned about follow-on scams impersonating the platform. No legitimate recovery process will ask for your password, seed phrase, or a “verification” transfer. Type the exchange’s address yourself; never follow a link from email, Telegram, or X.
  4. Check Monday’s proof of reserves yourself. Binance’s reports let individual users verify their balance was included. Take the two minutes to check — and understand the limit: a reserves snapshot proves assets at one moment, after the buyback, not the size of the hole on Thursday night. Critics have made exactly that point about the timing, and it is fair.
  5. Re-decide where your business float lives. Whatever happens Monday, this week made the standing advice concrete: keep only near-term working funds on any single exchange, hold reserves in self-custody, and prefer venues with published reserves and US licensing for operating money — our comparison of the best crypto exchange for small business lays out the options.
  6. Binance.US users: no action needed. Binance.US, the separate American company, said it was not affected, and nothing in the last 48 hours has changed that. Its funds and services were reported secure and operating normally.

Conclusion

Forty-eight hours in, this binance hack update is a story of a promise being tested in public. The freeze is real and growing, the federal investigation is real and on the record, and the North Korea attribution is as strong as private analysis gets without being official. What is not yet real is the finish line: withdrawals flowing again and a reserves report that customers can check. Both are due within about 48 hours. Judge Binance — and, honestly, every exchange your business uses — by whether those two deadlines are met.

What is the latest Binance hack update?

As of Saturday, October 31, 2026: withdrawals from Binance.com remain paused, with a phased restart targeted for Sunday, November 1. About $3 billion of the stolen assets are frozen, and Binance has reserved more than $6.34 billion to cover all losses — roughly 80% of it already held in the same tokens that were taken. The FBI and the US Secret Service have publicly confirmed they are engaged, though neither has attributed the attack; TRM Labs, Chainalysis, and Elliptic attribute it with high confidence to North Korea’s TraderTraitor unit. Proof-of-reserves results are due Monday, November 2.

When will Binance withdrawals resume?

Binance is targeting a phased restart on Sunday, November 1, 2026 — roughly 34 hours after its Friday-evening update — subject to security checks. As of Saturday, October 31, withdrawals remain suspended. “Phased” means services may return asset by asset or network by network, with queues, not everything at once. Deposits are operating normally.

Has Binance published its proof of reserves yet?

No. Binance took an initial proof-of-reserves snapshot on Saturday, October 31, and says results will be published by Monday, November 2. Until the report is actually out, treat any claim about what it shows as speculation. Note also that the snapshot follows Binance’s buyback of stolen assets, so it shows backing now — not the position on the night of the theft.

Are Binance user funds safe after the hack?

Binance says yes: balances will be honored, and the exchange has set aside more than $6.34 billion from its SAFU fund and company funds to cover every loss, so the cost falls on Binance, not customers. Two honest caveats: until withdrawals reopen, funds cannot be moved off the platform, so the pledge is not yet tested in practice; and frozen assets (about $3 billion) are frozen, not yet recovered. Binance.US, the separate American company, was not affected at all.

Sources

Reporting note: this is a developing story. Figures were checked on October 31, 2026; freeze totals differ slightly by source and are attributed in the text. Binance’s investigation is ongoing, and the withdrawal and proof-of-reserves timelines are company targets, not guarantees. This article is news reporting, not financial advice — see our Disclaimer page.

Was this article helpful?

Leave a Comment