Key Highlights:
- Binance began reopening withdrawals for another batch of crypto assets at 04:00 UTC on November 6, covering BSC, Ethereum, Optimism, Base, Arbitrum and other networks.
- The exchange attributed the October 29 attack to a multi-stage operation involving fake recruitment interviews, compromised employee devices, malicious software and access to an internal AI tool.
- Binance said it had reserved more than enough funds to cover the losses, while blockchain analytics firms continued tracking the stolen assets through complex laundering routes.
Binance is gradually restoring withdrawal services following the October 29 security breach that resulted in approximately $6.3 billion in unauthorized transfers from its hot wallets. The latest recovery phase began at 04:00 UTC on November 6, allowing withdrawals for additional assets across several blockchain networks after security checks. The reopening marks another step in the exchange’s efforts to restore normal operations, although withdrawals are returning gradually rather than becoming available for every asset at once.
The incident has also raised broader concerns about cybersecurity practices at crypto exchanges, particularly the risks posed by social engineering and compromised development systems.
How is Binance Restoring Withdrawals After the Security Breach?
Binance announced in its November 6 recovery update that withdrawals would resume progressively for selected assets on BNB Smart Chain ( BSC), Ethereum, Optimism, Base, Polygon, Arbitrum, Avalanche C-Chain, Tron and Sui, The exchange said it was prioritizing tokens based on user demand over the preceding week and would make each network-and-asset combination available only after completing security and readiness checks.
The latest list includes tokens such as USDE, PENDLE, ZRO, JASMY and SAND on BSC; U, XRP, CAKE and W on Optimism. Binance advised that not all assets would become available simultaneously and that users could experience temporary delays or longer processing times as services returned. Deposits remained open during the launch. This is part of a phased recovery that began earlier in November. Binance initially resumed selected withdrawals on November 1, prioritizing major assets and networks before gradually adding more tokens.
Subsequent updates expanded availability across additional networks, including BSC, Ethereum, Solana, XRP, Sui, Arbitrum, Optimism, Tron and Base. The exchange has also reported progress in replenishing the assets affected by the breach. In an update published on November 3, Binance said it had reserved more than 100% of the funds required to cover the loss and had replenished 98% of the affected token assets.
It estimated that approximately $2.85 billion in assets had been frozen or intercepted, although the figure remained subject to reconciliation and market-price movements. Binance said it would absorb the financial impact through its Secure Asset Fund for Users (SAFU) and corporate treasury rather than passing the losses on to customers.
What Happened in the October 29 Binance Hack?
Binance’s preliminary investigation describes the incident as a multi-stage attack rather than a straightforward phishing operation. According to the exchange, attackers used fake recruitment interviews to compromise an employee’s work computer. During a later interview conducted through a messaging platform, the employee was instructed to download a malicious code repository disguised as a work assignment. The malware reportedly replaced a legitimate development-tool component and established communication with an external server controlled by the attackers.
The attackers subsequently used the compromised device and an internal AI tool to gain access to other engineers’ systems. Binance said the attackers discovered a container deployment permission token on an employee’s computer and later used stolen credentials to deploy a container and execute a malicious script. This gave them access to an internal wallet-signing service, allowing unauthorized transactions to be initiated outside the exchange’s normal withdrawal process.
The breach affected hot wallets across multiple blockchains, with Binance estimating that approximately $6.34 billion in digital assets were impacted. The exchange said the attackers exploited Ethereum’s EIP-7702 authorization mechanism to grant a smart contract under their control partial execution rights over a hot wallet. Binance also reported that it found no evidence that wallet private keys had been leaked.
The incident has prompted wider discussion about the security of crypto infrastructure and the growing role of AI in cyberattacks. Binance co-founder Changpeng Zhao warned that attackers could increasingly use AI to identify vulnerabilities and urged firms to strengthen their own AI-based defenses. He also called for greater cooperation across the crypto industry, including shared security practices, cross-audits and faster coordination to freeze stolen funds.
The latest recovery update indicates that Binance is continuing to restore services while the investigation and asset-tracing efforts remain underway. The exchange has also said it is rebuilding affected systems, replacing compromised devices, strengthening wallet risk controls and expanding AI-based behavioral monitoring.
