What happened
On 29 October 2026, Binance said an attacker compromised its hot wallets and withdrawal system, taking about $6.3 billion in assets. A hot wallet is an internet-connected custody system used to process transfers. Binance paused withdrawals while it investigated and moved unaffected funds.
The company first linked the incident to a compromised employee laptop. Its second update said investigators had found additional breach points, without publishing a final technical cause. Binance said it found no evidence that wallet private keys leaked. That distinction matters, but it does not mean the signing system was safe: an attacker who reaches the approval layer can sometimes make valid transfers without extracting a key.
Blockchain investigator TRM Labs traced about $6.36 billion across ten networks. Its estimate includes 18,270 BTC, worth about $1.47 billion at the time, sent from a Binance hot wallet. TRM assessed that the speed and coordination pointed to compromised signing infrastructure, but Binance has not confirmed that mechanism.
On 31 October, the FBI attributed the theft to North Korea's TraderTraitor activity and said it had observed laundering. Attribution identifies the suspected operator. It does not establish exactly how Binance's controls failed.
What it changes
Binance's latest recovery update scheduled the first withdrawal phase, including Bitcoin, for 1 November between 06:00 and 09:00 UTC. The company said it had covered 95 percent of the impacted amount and fully backed the ten largest affected balances. It described the remaining 5 percent as illiquid.
Those are company statements, not an independent audit of all liabilities. A phased reopening also means availability can differ by network and account. Users should check the withdrawal status in their own account rather than infer that every route is restored.
The practical lesson is about the boundary between custody and ownership. A bitcoin balance at an exchange is a claim on the exchange until a withdrawal confirms to an address the user controls. Binance says it is replacing the lost assets with company funds, but customers still depended on Binance to pause, finance and restart access.
Moving bitcoin to self-custody removes that withdrawal gate. It also transfers key protection, backups and transaction review to the owner. The safer choice depends on whether a person can manage those responsibilities, not on a slogan. Our wallet guide explains the trade-offs before moving funds.
What it does not change
There is no evidence that the Bitcoin protocol, Bitcoin signatures or a user's self-custody wallet were broken. The reported bitcoin left Binance-controlled infrastructure through valid-looking transfers. The event is a failure of a custodian's operational security, not a change to Bitcoin's consensus rules.
Frozen assets are not the same as recovered assets. Binance said roughly $3 billion had been frozen onchain by 30 October. A freeze can stop movement on networks whose issuers or validators can intervene, but returning those assets may require separate legal and technical steps.
The 95 percent coverage figure is also not a completed postmortem. Binance has promised a detailed report but has not yet published one. It has not disclosed the full authorization path, the number of compromised people or systems, or whether every affected control has been replaced. Users should treat the staged restart as service recovery, not proof that the root cause is closed.
The FBI's attribution is stronger evidence about who likely conducted the operation. It does not resolve Binance's changing explanation, and it does not show that customers face no residual risk.
Context
Three independent newsrooms reached the same core facts while adding different checks. CoinDesk reported Binance's $6.34 billion funding plan and the gap between frozen and recovered assets. The Block compared the transfers with outside security researchers and examined the signing-infrastructure theory. Cointelegraph obtained comment from Binance and CertiK about replacement assets and custody controls.
The reports agree on the scale, the 29 October event, the withdrawal pause and Binance's commitment to cover losses. They do not establish a final root cause. That remains the key unanswered question when judging whether the exchange has fixed the system that authorized the transfers.