Binance hack: more asset withdrawals reopen Nov. 3 as company says it has covered 95% of losses
Binance reopened withdrawals for more assets and networks Tuesday (3), five days after the estimated US$ 6.3 billion hack. USDT on TRON was already in the first phase, on Nov. 1. The FBI blames North Korea, which denies responsibility.
In this article
Key points
- Starting Nov. 3 at 4 a.m. UTC (1 a.m. in Brasília), Binance began reopening withdrawals for dozens of tokens on nine networks. Access is being restored gradually, by asset and network.
- USDT on TRON (TRC-20) is not part of the Nov. 3 phase because it was already in the first phase, on Nov. 1. Availability should be checked on the withdrawal page.
- Binance says it has replenished about 95% of the affected funds. On Nov. 2, it completed a proof of reserves for ten assets, based on an Oct. 31 snapshot. This is not an audit.
- The FBI attributed the hack to North Korean group TraderTraitor on Oct. 31, and Pyongyang denied it. Scammers are offering fake US$ 150 compensation.
São Paulo, November 3, 2026 — Binance began another phase of reopening withdrawals on Tuesday (3), starting at 4 a.m. UTC (1 a.m. in Brasília). The list includes dozens of tokens on BNB Chain, Ethereum and Solana, plus some assets on XRP Ledger, Sui, Arbitrum, Optimism, TRON and Base. Access is being restored gradually. According to the exchange’s update No. 6, each asset and network combination will return only after security checks. This is another step in the recovery from the October 29 hack, which drained about US$ 6.3 billion from the company’s operational wallets, according to Binance itself.
For anyone paying a supplier in USDT, the most relevant information is in the previous phase. USDT on the TRON network (the TRC-20 standard) does not appear on Tuesday’s list because it was already included in the first reopening phase, on Sunday (1). For TRON, today’s announcement lists only TUSD, another stablecoin (a cryptocurrency pegged to the dollar). Binance itself warns of delays and staggered availability. Before scheduling a payment, check the withdrawal page to see whether the network is available.
- amount affected in the October 29 hack, according to Binance
- US$ 6.3 billion
- share of the affected funds Binance says it had replenished by November 1
- 95%
- net outflow in the first 9.5 hours after withdrawals reopened, according to Binance
- US$ 3.64 billion
- addresses linked to the theft listed by the FBI, according to Help Net Security
- 628
What changes with the November 3 phase
Binance says it selected the tokens for this phase based on user demand over the past week. The company warns that not all listed assets will become available at the same time. It asks customers to check the withdrawal or network status page and, if a withdrawal fails, to try again shortly afterward. According to the announcement, deposits remain open and were not affected.
Among stablecoins, the new list includes USD1, FDUSD, RLUSD and USDe on Ethereum, USDC on Sui, RLUSD on XRP Ledger and TUSD on TRON. It also includes bitcoin and ether on BNB Chain and all bSTOCKS on that network. The announcement gives no date for completing the reopening. It says other assets will be added when ready and updates will be posted on the company’s official X account.
A reopening announcement does not guarantee that every asset and network pair is working. Before withdrawing, check on the platform itself that the network required by the recipient is listed as active.
USDT on TRON and fiat currency withdrawals
The November 1 announcement in Portuguese scheduled the first phase for between 6 a.m. and 9 a.m. UTC. The list included USDT on TRON, Ethereum, BNB Chain, Solana, TON, Polygon, Avalanche C-Chain, Arbitrum and Optimism, as well as BTC, ETH, BNB, TRX and SOL on their native networks. According to Decrypt, the entire first phase was available by Sunday morning.
On Monday (2), withdrawals resumed in US dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah. Help Net Security reported, citing a Binance post on X, that this brought the number of currencies available for withdrawal to 28, including the Brazilian real. The report does not explain how Pix withdrawals are working.
In Brazil, BBrasil SPSAV, the Binance company serving Brazilian customers, said on October 30 that customer funds remained safe and that it follows the Central Bank’s asset segregation rules, according to Metrópoles. The suspension mentioned in the statement concerned virtual asset withdrawals. The text did not address withdrawals in reais through Pix.
Reserves: what Binance says it has replenished
On November 1, Binance said it had replenished about 95% of the affected funds through purchases on the market and at over-the-counter (OTC) desks, up from 90% in the previous update. The remaining 5% consists of less liquid tokens outside the top ten. These figures come from the company and have not been independently verified. Replenishing balances with its own money is also different from recovering what was stolen. In its October 31 update, the exchange said it had set aside more than US$ 6.34 billion of its own funds to cover the losses. It also said the replenishment draws on corporate cash, part of the futures insurance fund and SAFU, its emergency fund. The company did not specify how much of that amount it had already spent.
Binance will absorb the financial impact of the stolen funds, not our users.
Binance, Portuguese-language statement dated November 1, 2026
On November 2, update No. 5 announced the completion of a zero-knowledge proof of reserves, a technique that allows data to be verified without revealing the underlying information. The proof refers to a snapshot taken at midnight UTC on October 31 and covers ten assets: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. According to Binance, an open-source tool allows customers to check whether their own balance is included in the snapshot and whether, in that data, reserves for the ten assets cover user balances at least 1 to 1. A new snapshot, including more tokens, is scheduled for November 4. The company estimates that the proof will take 40 to 50 hours to complete.
This type of verification has limits. It shows a single point in time and does not cover tokens outside the list. The PCAOB, the US audit oversight body, warned in 2023 that proofs of reserves are not audits and do not show whether assets remained available after the snapshot, according to Cointelegraph.
After withdrawals reopened, Binance reported that US$ 4.649 billion flowed out and US$ 1.01 billion flowed in between 6 a.m. and 3:30 p.m. UTC on November 1. The net outflow was about US$ 3.64 billion. According to the company, that equals 2.1% of the US$ 171 billion in assets in its October 28 proof of reserves. Binance also said, according to Decrypt, that withdrawal volume had fallen after the initial peak and was stabilizing, as expected.
FBI points to North Korea; Pyongyang denies it
On Saturday (October 31), the FBI, together with the Secret Service and the US Internal Revenue Service’s Criminal Investigation division (IRS-CI), attributed the theft to TraderTraitor, according to Help Net Security and Decrypt. The group is linked to the North Korean state and was also named by the FBI in the Bybit hack of February 2025. According to Help Net Security, the alert lists 628 addresses: 608 on Ethereum, 19 on Bitcoin and 1 on Solana. The FBI asked node operators, instant swap services, DeFi platforms and blockchain analytics firms to block transactions tied to those addresses. Analytics firms TRM Labs and Chainalysis had already linked the hack to the group on October 30.
In a statement carried by North Korean state media and reported Tuesday by ABC News, Kim Yo Jong, the sister of leader Kim Jong Un, described the US accusation as absurd rhetoric that offered nothing new. She also called it a serious political provocation.
The origin of the hack remains under investigation. In its October 30 update, Binance said initial findings suggested the incident could involve a compromised laptop. It later reported finding other points of entry and said it had found no evidence of leaked wallet private keys. The company has promised a detailed technical report on the incident.
The money trail ran through TRON
The TRON network played a central role in the laundering. According to Elliptic, on October 29 the attacker swapped 234 million USDT for TRX on SunSwap before Tether froze the remainder. Starting October 30, a distribution wallet spread 684.6 million TRX across about 7,700 new addresses. In findings released November 1 and cited by Decrypt, Chainalysis said the criminals had moved more than US$ 500 million on TRON through more than a thousand addresses. According to Decrypt, most of those wallets have already been emptied, with funds moved through blockchain bridges to Ethereum, Bitcoin and other networks.
In Elliptic’s update at 8:40 a.m. UTC on Tuesday, US$ 2.85 billion had been frozen or seized. That equals about 44% of the US$ 6.43 billion the firm estimates was stolen, a figure higher than Binance’s. About US$ 3.18 billion more remained in addresses linked to the theft. Elliptic offers any company a free list of those addresses for blocking. In another case this year, the T3 Financial Crime Unit had already shown how USDT freezes on TRON affect recipients.
The fake US$ 150 compensation scam
Scammers spread fake posts and screenshots promising US$ 150 in compensation, redeemable through the app, to anyone affected by the withdrawal pause. According to Help Net Security, a member of Binance’s global affiliate team warned on X that the images were fake and directed users to official channels. Changpeng Zhao, the exchange’s founder, shared the warning and urged caution. The approach resembles fake support and crypto recovery scams.
Do not click links offering supposed refunds or provide your password, verification code or private key. Check for updates only in Binance’s own announcement center.
What to do before paying a supplier
- Confirm the receiving network with your supplier. TRON (TRC-20), Ethereum (ERC-20) and BNB Smart Chain (BEP-20) are different networks, and sending funds over the wrong network can result in a loss.
- On the withdrawal page, check whether your chosen USDT and network pair is active. Allow for possible delays and do not promise the supplier a deadline.
- Verify the address through a second channel and, for a large amount, make a test transfer, as explained in the guide to validating a TRC-20 wallet.
- After sending, save the transaction hash and check its status on Tronscan.
- Remember that a confirmed transfer is irreversible and virtual assets have no FGC coverage.
- Oct. 29Binance’s operational wallets are hacked, with the company estimating losses at US$ 6.3 billion. Virtual asset withdrawals are suspended.
- Oct. 31Reserves snapshot at midnight UTC. Binance says it has set aside more than US$ 6.34 billion. The FBI attributes the theft to TraderTraitor.
- Nov. 1First withdrawal phase, including USDT on TRON. Binance says it has replenished about 95% of the affected funds.
- Nov. 2Withdrawals resume in US dollars and other fiat currencies. Proof of reserves for ten assets is released.
- Nov. 3A new phase reopens withdrawals for more assets. North Korea denies carrying out the hack.
- Nov. 4New reserves snapshot scheduled, including more tokens.
Frequently asked questions
Can I withdraw USDT from Binance on the TRON network yet?
USDT on TRON was included in the first reopening phase on November 1, 2026, and Decrypt reported that the entire phase was available that morning. Binance warns that access is being restored gradually and delays are possible. Before withdrawing, check the pair’s status on the withdrawal page.
Did Binance customers lose money in the hack?
Binance says it will absorb the losses using its own funds and will not pass them on to users. On November 1, the company said it had replenished about 95% of the affected funds. These figures are statements from the exchange and have not been independently verified.
Who is behind the Binance hack?
On October 31, 2026, the FBI attributed the theft to TraderTraitor, a group linked to North Korea, according to Help Net Security and Decrypt. TRM Labs and Chainalysis had already made the same connection on October 30. North Korea denied responsibility in a statement by Kim Yo Jong reported on November 3.
Does Binance’s proof of reserves guarantee the money is there?
According to Binance, the November 2 proof allows customers to check whether their balance is included in the October 31 snapshot and whether reserves for ten assets covered balances at least 1 to 1 at that moment. It does not cover other tokens or show what happened after the snapshot. Proof of reserves is not an audit.
Is Binance paying users US$ 150 in compensation?
No. The screenshots circulating on social media are fake, according to a member of Binance’s team. Changpeng Zhao shared the warning. Do not click such links or provide passwords, codes or private keys.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Security Incident | Recovery Update #6: Withdrawals Reopen for More Assets (2026-11-03) · Binance, Nov 3, 2026
- Security Incident | Recovery Update #5: October 31st PoR Snapshot Now Fully Verifiable by Users as ZK Proof Generated (2026-11-02) · Binance, Nov 2, 2026
- Atualização Institucional: Incidente de Segurança #4: Saques reiniciados em fases · Binance, Nov 1, 2026
- Security Incident | Recovery Update #3: 90% of Stolen Assets Replenished; Proof of Reserves Snapshot Provided (2026-10-31) · Binance, Oct 31, 2026
- Security Incident Update #2 (2026-10-30) · Binance, Oct 30, 2026
- FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals · Decrypt, Nov 2, 2026
- FBI pins $6.3 billion Binance crypto heist on North Korea while scammers circle anxious users · Help Net Security, Nov 2, 2026
- How North Korea is laundering the $6.4 billion stolen from Binance · Elliptic, Nov 3, 2026
- North Korea denies role in Binance heist as customers withdraw billions · ABC News (Australia), Nov 3, 2026
- US accounting watchdog warns investors about proof-of-reserve reports · Cointelegraph, Mar 9, 2023
- Binance emite comunicado para investidores brasileiros após ataque hacker · Metrópoles, Oct 30, 2026
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
