Binance Withdrawals Return While Hackers Keep Billions

• Binance withdrawals are back on dozens of additional blockchain networks this week.
• The exchange used its own reserves to cover what customers lost in the hack.
• Most of the stolen crypto has not been frozen or recovered.
• Several smaller exchanges and wallet providers have suffered breaches since the Binance attack.

Binance reopened cryptocurrency withdrawals on 87 blockchain networks this week and plans to restore the rest by the end of next week, around November 22, the exchange said in an announcement on November 14. The coins customers are now withdrawing come from Binance’s own balance sheet. The exchange used its reserves and corporate cash to cover the full $6.34 billion lost in the October 29 attack on its wallet infrastructure, while only about $2.85 billion of the stolen crypto had been frozen or intercepted by early November.

This week, we reopened withdrawals for 87 networks. We will aim to reopen withdrawals for all remaining networks and assets by the end of next week. Thank you for your patience and understanding. Find out more: https://t.co/KzvX9pJcX5 pic.twitter.com/9TUEK1qBg4

— Binance (@binance) November 14, 2026

Why a Token Can Still Be Stuck on Binance

The reopened list includes established blockchains such as Cardano, Avalanche, Aptos, NEAR, Litecoin and Cosmos. It also covers layer-2 networks, which are separate chains that process Ethereum transactions at lower cost, such as zkSync Era, Linea, Scroll and Starknet, plus newer ecosystems like Hyperliquid, Berachain and Celestia.

The figure counts network routes, so the number of distinct coins is lower. A token like USDT can move over several chains, and Binance reopens each route on its own schedule, so a withdrawal on one network may work while another route for the same asset stays closed. The exchange asked customers to check availability coin by coin and warned that heavy traffic could delay some transfers. It has not named the networks that remain restricted, and it gave no guarantee that it will meet the November 22 target.

SAFU Covered Only a Slice of the $6.34B Bill

On November 13, Binance said it had covered 100% of the affected assets. The money came from its Secure Asset Fund for Users (SAFU), an emergency reserve built to compensate customers after incidents, together with surplus capital from its futures insurance fund and the corporate treasury. SAFU held about $1 billion, so even used in full it could pay for less than a sixth of the loss, which left the insurance surplus and the treasury to cover the rest. Binance then bought replacement coins on the open market and through over-the-counter deals, which are large private trades arranged directly between two parties.

Covering balances is a separate matter from getting the stolen funds back. Binance replaced customer losses with its own capital, while the attackers still control the bulk of what they took. The $2.85 billion frozen as of November 3 may also change after reconciliation and price swings, according to the exchange. SAFU now has to be rebuilt, and Binance has set a target of roughly $1 billion.

Binance took a fresh Proof of Reserves snapshot on November 12, covering 198 tokens. The zero-knowledge proof that comes with it lets each customer confirm their balance is included in the reserves without exposing anyone else’s data. On Binance’s reserve page, Bitcoin is backed at just 100.05%, a surplus of about 372 BTC, which is a thin margin for an asset the attackers took 18,270 BTC of.

How a Fake Recruiter Reached the Wallets

Binance’s preliminary investigation traces the breach back to June. An engineer installed a tampered version of Homebrew, a widely used software installer for Mac, while setting up an AI coding tool. Binance caught the problem, but the attackers had already learned who worked on its wallet systems. In September they approached a second engineer through a legitimate recruitment platform and, during a fraudulent interview, persuaded that person to download a malicious coding assignment. By October 20 they had abused an internal AI tool to obtain wallet credentials, and on October 29 they reached the signing systems that authorize transactions.

The stolen assets included about 233.46 million XRP, 970,500 SOL, 44.2 million OP and 18,270 BTC. The attackers also exploited EIP-7702, an Ethereum feature that lets ordinary wallets temporarily behave like smart contracts. This kept some transfers running outside Binance’s normal withdrawal systems and made the breach harder to contain. The FBI attributed the attack to North Korea, and blockchain investigators linked it to the TraderTraitor group. Pyongyang denies involvement.

Smaller Platforms Lost $53M in Two Weeks

Source: DefiLlama. Estimates vary between investigators.

On November 2, Brazilian exchange Mercado Bitcoin lost between $40 million and $48.6 million from wallets on Bitcoin, Ethereum, Solana, Tron and Avalanche. Tether froze more than $4.5 million in USDT tied to the theft, and the exchange said customers would not bear any losses. Some of the funds taken from BitMart the same day passed through addresses linked to the Mercado Bitcoin incident, although investigators have not confirmed that the same attacker was behind both. At Keplr, a flaw in Web3Auth’s login service exposed private keys for wallets created with Google or Apple accounts, and users lost about $1.82 million before the two teams moved roughly $5.6 million to safety. Across Protocol lost control of its website after attackers tricked staff at its domain registrar, Namecheap, and sent visitors to a fake interface that asked them to approve fraudulent transactions.

Security newsletter BlockThreat counted about $53.2 million stolen in 13 incidents during its early November reporting period, not counting Binance. Roughly 97% of that came from compromised infrastructure, exchange breaches, operational security failures and phishing. Smart contract bugs accounted for only a small share. DefiLlama data puts total 2026 hack losses at about $8.78 billion across 344 incidents as of November 14, and Binance alone accounts for around 72% of that figure.

Two Gaps Binance Must Close by Nov. 22

The first gap is the networks that are still closed. Customers holding tokens on those chains cannot move them off the platform until the routes reopen, and Binance has not said what happens if some of them miss the target. The second is SAFU itself, because until the fund is back near $1 billion the exchange has a thinner emergency cushion than it had before the attack.

Binance says it has rebuilt or replaced the compromised internal systems, tightened device and wallet controls and expanded monitoring for unusual behavior. It still owes users a final incident report and an independent security review. The exchange has also changed its finance chief. Kaiser Ng left to pursue another venture and was replaced by Justin Yek, a former vice-president of finance at Airwallex, and nothing links the departure to the breach.

The recruitment trick at the center of the Binance case has been used by TraderTraitor before. In December 2024, the FBI attributed the $308 million theft from Japanese exchange DMM Bitcoin to the same group. That attack began when a fake recruiter sent a malicious coding test to an employee at Ginco, a Japanese wallet software company, which suggests exchanges will need to screen how their engineers handle job offers as closely as they screen their wallet systems.