Binance Hack Followed by Outflows as FBI Opens Probe

The Binance hack was followed by billions of dollars in customer withdrawals, heavy exchange-traded fund outflows and investigations by the FBI and U.S. Secret Service. The FBI attributed the October 29 theft to North Korea’s TraderTraitor. Binance says affected assets are fully backed and withdrawals have resumed.

What we know about the Binance hack

The FBI said attackers stole more than $6 billion in virtual assets from Binance on October 29, 2026, and attributed the theft to TraderTraitor, a North Korean group. Decrypt’s November 2 report estimated the haul at roughly $6.4 billion across about 10 blockchains, with most funds taken in around 20 minutes.

Decrypt reported that Binance first cited a possible compromise of a DevOps engineer’s laptop, then identified “additional points of breach.” On Ethereum, the attacker allegedly used 50 pre-signed authorizations to turn a Binance hot wallet into a contract that emptied itself. Decrypt described this as a failure of Binance’s signing approvals, not a flaw in Ethereum.

The FBI said the stolen assets were being converted primarily into ether. The bureau, U.S. Secret Service and IRS Criminal Investigation urged crypto businesses to block transactions linked to the theft addresses. The FBI’s public alert attributes the incident to TraderTraitor and urges firms to block related transactions.

Binance restarted withdrawals in phases on November 1, calling the pause a precaution while it assessed the incident and completed security checks. In its November 2 recovery update, the exchange said affected BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances were backed at 100%. It also said it would cover the full amount stolen.

Binance hack withdrawals and recovery claims

Withdrawal totals vary by reporting period. The Block reported $4.649 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours after reopening, or net outflows of about $3.64 billion. Reuters, in a November 2 report carried by Kitco, put net withdrawals since reopening at $4.72 billion. Binance characterized that as about 2.8% of platform assets and said withdrawals were stabilizing.

The figures cover different periods. They show substantial customer withdrawals, but do not establish that Binance could not meet requests. The exchange’s recovery update describes its backing claim. That statement is distinct from independent findings about the breach.

What is still unclear

Decrypt reported that the incident may have involved a compromised DevOps engineer’s laptop and described how pre-signed authorizations were used on Ethereum. The available reports do not establish how initial access was obtained or detail the “additional points of breach” Binance identified. The FBI said it is working with public and private partners to assess the scope and coordinate investigative steps. The evidence available here does not establish whether anyone inside or outside the company was directly responsible.

It is also unclear from the supplied evidence how much stolen value can be traced, frozen or recovered. Reuters reported that Circle froze more than $1.1 billion in USDC linked to the incident. The FBI said funds were being converted primarily into ether. The reported freeze is not evidence that the full loss has been recovered. Reuters’ report carried by Kitco includes the reported Circle freeze and withdrawal figures.

How markets and analysts reacted

The breach coincided with heavy fund outflows. Decrypt reported that spot Bitcoin ETFs lost $643.3 million on Friday, October 30, their largest daily outflow of the month. That session turned October’s reported $127 million net inflow into a $515.9 million net outflow. Ether ETFs lost $1.61 billion over October, their worst month since launch, according to Decrypt. Reuters, as carried by Kitco, also reported that more than $1.3 billion in leveraged crypto positions were liquidated on Friday.

The outflows followed a period of relative calm in Bitcoin funds, but they do not prove the hack alone drove every investor decision. Decrypt reported that CFTC Chairman Michael Selig said the incident “proves our exact point” about safeguards at offshore exchanges. The outlet said he was pitching a federal option that would let offshore venues register with the CFTC and meet U.S. cybersecurity standards.

At 17:13 UTC on November 2, CoinGecko market data showed major tokens lower over 24 hours:

The Crypto Fear & Greed Index was 37, classified as Fear, on November 2. The index reports broad sentiment and does not isolate the hack’s effect. Decrypt said Binance may need to acquire roughly $1.3 billion in BTC, ETH and BNB to replenish its reimbursement pool, potentially creating buying demand if it does so. The timing and execution remain uncertain. Decrypt also covered the Bitcoin ETF outflows.

What the Binance hack means for investors

Binance hack risks to keep in view

The incident involved a reported breach of exchange systems and a pause in withdrawals while Binance assessed the situation and completed security checks. It illustrates the importance of operational controls and the possibility that a security incident can interrupt withdrawals. Binance’s statement that affected balances are fully backed is its own recovery claim, not an independent finding about the breach.

The investigation is ongoing, and the supplied evidence does not establish the amount of stolen value recovered. The withdrawal figures, Binance’s backing statement and market moves each describe different aspects of the aftermath. For policy context, Decrypt reported CFTC Chairman Michael Selig’s comments on safeguards and a proposed registration option for offshore exchanges.

Bottom line

The FBI linked the October 29 theft of more than $6 billion from Binance to North Korea’s TraderTraitor, while the exchange says affected balances are fully backed. Further agency findings, evidence of fund recovery, withdrawal trends and crypto ETF flows will show how the situation develops.

Sources

• North Korea Responsible for $6 Billion+ Binance Attack (www.fbi.gov)
• Security Incident | Recovery Update #5: October 31st PoR Snapshot Now Fully Verifiable by Users as ZK Proof Generated (2026-11-02) (www.binance.com)
• Morning Minute: Binance Hack Leads to Mass Outflows While FBI Opens Probe (Decrypt)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.