AnswersPublished28 sources
Binance’s Hack Recovery on November 6: Withdrawals, Replenishment and Stolen Funds
On November 6, Binance began reopening 58 network–asset pairs across nine networks in stages from 04:00 UTC.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- On November 6, Binance began reopening 58 network–asset pairs across nine networks in stages from 04:00 UTC.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What was the status of Binance’s recovery from the October 29 hack as of November 6, including its ninth withdrawal-reopening update’s 04:00. Article summary: As of November 6, 2026, Binance was still restoring withdrawals in stages rather than operating normally across every asset, while reporting that 98% of affected assets had been replenished. Separately, Elliptic estimate. Topic tags: general, government, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, ch
Binance’s November 6 recovery update expanded withdrawals after the October 29 security incident, but services were still returning in stages. Binance reported that 98% of affected assets had been replenished; separately, Elliptic estimated that $3.11 billion of the $6.43 billion theft remained in addresses linked to the attackers. Replenishment, reopening withdrawals and recovering stolen funds are different measures. 34
45
What Binance reopened on November 6
Recovery Update #9 began at 04:00 UTC and covered 58 network–asset pairs across BNB Smart Chain, Ethereum, Base, Optimism, Polygon, Arbitrum, Avalanche C-Chain, Tron and Sui. The pairs were to become available progressively, rather than all at once, as security and readiness checks were completed. Deposits remained open. 4
9
30
The update included assets such as USDe, XRP, CAKE and FDUSD. Reporting also said Binance was prioritizing pairs based on recent user demand. 4
27
The update was part of a phased restoration, not a declaration that every withdrawal was back to normal. A November 6 report said Binance aimed to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week, and to restore remaining tokens on networks that were already back online. 4
HYPE was not included in the reported Update #9 list. One report said withdrawals for the token had been unavailable for eight days; the later reported target placed HYPE among the assets Binance aimed to restore by the end of the following week. 28
4
Replenished assets are not recovered funds
Binance reported that it had replenished 98% of affected assets, with the remaining portion involving illiquid tokens still being acquired. Reporting described the replenishment as customer-loss coverage from Binance’s own funds. 34
22
That figure does not mean Binance or investigators had recovered 98% of the stolen cryptocurrency. Elliptic’s November 6 estimate put the theft at $6.43 billion: $3.11 billion remained in theft-linked addresses, while $2.85 billion, or about 44%, had been frozen or seized. These are separate accounting measures from Binance’s reported customer-asset replenishment. 45
5
Attribution and coordinated freezes
The FBI attributed the October 29 theft to North Korea and referred to the activity as TraderTraitor. 1 Blockchain firms and other reporting also identified TraderTraitor in connection with the incident.
11
12
Freezes by issuers and other network participants helped contain some assets, but the amounts varied by source and update. CNBC reported that Circle had frozen more than $1.1 billion in USDC in coordination with law enforcement. Binance-related reporting also cited 40.5 million RLUSD frozen by Ripple; TRM Labs described freezes involving Ripple and World Liberty Financial as part of a broader response. 36
51
11
DeFi effects were smaller than after the Kelp DAO exploit
Sentora’s figures, as reported by crypto.news, showed $1.59 billion leaving lending markets after the Binance breach, with 60% returning within three days. The same report put withdrawals after April’s $292 million Kelp DAO exploit at $10.9 billion over five days. 41
Sentora said the Binance incident’s effects on its own vaults were indirect: redemptions rose, but were met in full, and the report recorded no bad debt or depositor losses at those vaults. Sentora also described coordinated intervention as helping contain assets. Those findings offer context for the more limited fallout, but do not by themselves establish a single cause for the difference between the two events. 48
47
What investigators reported about laundering
Elliptic said attackers had converted about $124 million in stolen altcoins into Bitcoin by November 6. Separate reporting on the XRP trail said roughly 42 million XRP, worth about $50 million, had been converted, mostly through THORChain, while about 192 million XRP, worth about $226 million, remained in linked addresses. 5
22
Blockchain analysis reported that 18,270 BTC stolen in the incident had remained unmoved through November 5. Elliptic described the broader laundering activity as highly complex and automated. That evidence supports describing the process as automated; it does not establish that AI was making the attackers’ decisions. 42
45
The status on November 6 was therefore mixed: Binance was adding withdrawal access and said most affected assets had been replenished, while substantial funds remained in theft-linked addresses and some asset withdrawals were still pending. 4
34
45
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Binance’s Hack Recovery on November 6: Withdrawals, Replenishment and Stolen Funds"?
On November 6, Binance began reopening 58 network–asset pairs across nine networks in stages from 04:00 UTC.