Binance Security Breach & Recovery

Timeline

High importance

Withdrawals resumed across 87 networks

14 Nov, 10:03 UTC

Binance reported that withdrawals resumed across 87 networks over the past week and plans to restore all remaining networks by the end of next week.

High importance

US Justice Department wins approval to seize $1.2B

12 Nov, 00:00 UTC

The US Justice Department announced on November 12 that it received court approval to seize or restrain more than $1.2 billion from the Binance hack.

High importance

Binance Says All Lost Tokens Replaced

12 Nov, 00:00 UTC

Binance announced it has replaced all tokens lost in the $6.3 billion hack, though zero-knowledge proof verification is still pending.

Binance completes initial security remediation

3 Nov, 09:53 UTC

Binance rebuilt the affected wallet system and internal AI tool, replaced devices, decommissioned related credentials and tokens, scanned all employee devices, and expanded AI-based behavioural anomaly detection.

Binance Refills 98% of Affected Assets

2 Nov, 00:00 UTC

By November 2, Binance reported that it had refilled approximately 98% of the affected assets.

Stolen Assets Converted to Ether

1 Nov, 06:25 UTC

US investigators observed TraderTraitor hackers converting stolen Binance assets primarily into ether (ETH).

High importance

Withdrawals reopened in phases

1 Nov, 00:00 UTC

Binance reopened withdrawals in phases on November 1, with roughly $2 billion in assets moving within hours.

High importance

95% of Stolen Assets Replenished

1 Nov, 00:00 UTC

By November 1, Binance had replenished about 95% of the affected assets by purchasing replacement tokens, with the remaining 5% in less liquid cryptocurrencies.

High importance

Binance replenishes 90% of stolen crypto

31 Oct, 15:24 UTC

Binance replaced 90% of the stolen cryptocurrency using corporate funds, futures reserves, and SAFU, and planned to reopen withdrawals on Nov. 1.

Proof of Reserves Snapshot Taken

31 Oct, 00:00 UTC

Binance took a fresh Proof of Reserves snapshot at 00:00 UTC on October 31 to allow users to verify customer balance coverage.

High importance

FBI Identifies TraderTraitor as Perpetrator

31 Oct, 00:00 UTC

On October 31, the FBI identified North Korea's hacking group TraderTraitor as responsible for the $6.3 billion Binance theft.

High importance

Binance targets withdrawal resumption within 40 hours

30 Oct, 14:34 UTC

Co-CEO Richard Teng said Binance aims to resume withdrawals within 40 hours and publish a full proof-of-reserves report by Monday.

Aave lifts precautionary freeze

30 Oct, 13:57 UTC

New deposits and borrowing resumed across all Aave V3 and V4 markets after a precautionary freeze.

Multiple Breach Points Identified

30 Oct, 13:46 UTC

Binance initially reported a compromised engineer's laptop but later confirmed the breach involved additional points of entry.

High importance

Rapid Multi-Chain Theft

30 Oct, 13:46 UTC

Hackers drained cryptocurrency from Binance wallets across 10 blockchains in approximately 20 minutes.

High importance

Binance working with FBI on asset recovery

30 Oct, 13:11 UTC

Binance is cooperating with the FBI to help recover funds stolen in the $6.3 billion exploit.

High importance

Analysts suspect North Korean group TraderTraitor

30 Oct, 05:01 UTC

Chainalysis and TRM Labs attributed the Binance hack to North Korean hacking group TraderTraitor.

High importance

Final unauthorized transfer and delegation cleared

30 Oct, 00:10 UTC

The final unauthorized transfer of 2,961.9 ETH finalized at 23:56 UTC on Oct. 29, and Binance cleared the EIP-7702 delegation code from its Binance14 hot wallet at 00:10 UTC on Oct. 30.

High importance

Binance pledges to cover all losses

30 Oct, 00:00 UTC

Binance stated that user funds are safe and that it will cover all losses using its SAFU fund and company funds.

High importance

Compromised DevOps laptop enabled unauthorized withdrawals

30 Oct, 00:00 UTC

Initial investigation suggests a compromised DevOps engineer's laptop allowed an attacker to access a service container and submit unauthorized withdrawal transactions, though no evidence of leaked wallet private keys was found.

High importance

Unauthorized hot wallet transfers

29 Oct, 20:05 UTC

Between 20:05 and 20:09 UTC on Oct. 29, five hot wallets sent 233.46 million XRP, about 970,500 SOL, 44.2 million OP, and 18,270 BTC to attacker-controlled addresses.

High importance

Binance $6.3B Security Breach

29 Oct, 00:00 UTC

Hackers used a fake job interview and malicious software to compromise engineers' computers and steal $6.3 billion in cryptocurrency on October 29.

High importance

Cryptocurrency stolen across 10 blockchains

29 Oct, 00:00 UTC

Hackers drained $6.3 billion in cryptocurrency from Binance wallets across 10 blockchains in approximately 20 minutes on October 29.

Industry Partners Freeze Connected Assets

Time unknown

Ripple, World Liberty Financial, and the Arbitrum Security Council froze cryptocurrency connected to the attack.

FBI Seizes Attack Infrastructure

Time unknown

The FBI seized cloud infrastructure used in the cyberattack campaign along with more than 900 webcam videos of victims.

Details

Binance withdrawals remain degraded following a $6.3 billion hack, with service operational across 87 networks and reports varying on whether 95% or 100% of stolen funds have been replaced.

cyberattackNewest source …Latest figure …Checked …Checked every 2 minutes

Degraded / Planned1
Operational1

Service & Withdrawal Status

2 down, 1 degraded, 2 operational

Deposits & Withdrawals
Down
Temporarily suspended while Binance conducts security checks.
as of …Stale
Deposits and Withdrawals
Down
Temporarily halted while investigating a possible security breach
as of …Stale
Binance Withdrawals
Degraded
Resumed across 87 networks; remaining networks planned for restoration by end of next week
as of …
Deposits
Operational
Operating normally
as of …Stale
Withdrawals
Operational
Reopened in phases on November 1
as of …Stale

Binance Security Breach & Recovery

Withdrawals & Network Status by status

Breach & Recovery Figures

Service & Withdrawal Status

Deposits & Withdrawals

Deposits and Withdrawals

Binance Withdrawals

Deposits

Withdrawals