Binance is open for business again. Just three days after attackers drained roughly $6.3 billion in digital assets from the world’s largest crypto exchange, customers can once more move their funds, and the company has already replaced the vast majority of what was taken.
The theft on October 29 reportedly unfolded in about 20 minutes, making it the biggest crypto heist on record. Binance responded by pausing withdrawals across several networks, a precaution that bought time to assess the damage and line up replacement assets before reopening.
That replacement effort is the real story. Binance says it has restored around 95% of the stolen crypto by drawing on its Secure Asset Fund for Users, its Futures Insurance Fund and its own corporate treasury. The remaining 5% is made up of tokens that are harder to buy in bulk, and the exchange has committed to covering the full loss itself rather than passing any of it on to customers. Very few companies in any financial sector could absorb a multi-billion-dollar hit and keep operating within days.
SAFU was created in 2018 for exactly this kind of scenario, and it has now been tested at a scale few would have imagined. Binance used the same fund to make users whole after a much smaller 2019 breach, and this episode shows how significantly its reserves have grown since.
The reopening is being handled carefully. Fifteen cryptocurrencies are available first, including Bitcoin, Ether, Dogecoin and selected USDC and USDT stablecoins, chosen according to customer demand over the past week. Less liquid tokens will follow in later phases.
As expected after an incident of this size, many users moved quickly to withdraw. Analytics platform DefiLlama recorded more than $3.5 billion in net outflows on Sunday. Binance says that initial wave is already settling, that withdrawals represent a small portion of the assets it manages and that customer deposits remain substantial. The fact that the exchange handled billions in outgoing transfers in a single day without fresh disruption is itself a meaningful sign of stability.
On the investigation side, the FBI has attributed the attack to TraderTraitor, a North Korean state-backed group that blockchain analysts had also identified. The same group was blamed for the roughly $1.5 billion Bybit hack in 2025. President Donald Trump said on Saturday that North Korea’s role wasn’t certain.
The coming weeks will show how quickly confidence returns, but Binance’s rapid recovery may end up setting a new benchmark for how exchanges protect users when the worst happens.
