Skip to content
Crypto Merchant
Get started

News

Binance hack halted withdrawals; they are reopening in phases

By the Crypto Merchant teamLast checked 6 November 2026 (the latest source is dated 3 November)

Binance, the world's largest crypto exchange, lost about $6.3 billion from its hot wallets on 29 October 2026 and halted withdrawals across multiple networks. Withdrawals started to come back on 1 November, beginning with bitcoin and other major networks, and Binance is reopening the rest in phases: 51 more tokens on Ethereum and Solana came back on 3 November. Tether and Circle froze more than $2.4 billion of USDT and USDC linked to the attacker.

What happened

On Thursday 29 October, Binance halted withdrawals across multiple networks after a theft from its hot wallets. It later put the total at about $6.3 billion, the largest crypto theft on record. Blockchain analytics firm TRM Labs, cited by CoinDesk, lists bitcoin, ether, USDT and USDC on Ethereum, XRP and SOL among what was taken. Binance first blamed a compromised laptop belonging to a DevOps engineer. On 3 November co-CEO Richard Teng told CNBC that the attackers spent months getting in: a fake version of a developer tool installed by one engineer in June, fake job interviews with another engineer in September with malware hidden in a coding exercise, and then Binance's internal AI tools, which led to the system that authorises wallet transactions. The FBI said on 31 October that it had determined North Korea was responsible.

Tether froze more than $1.56 billion in USDT and Circle about $823 million in USDC in the first days; Circle's figure later reached more than $1.1 billion. Circle said it acted in coordination with law enforcement; Tether's statement didn't say whether it had law-enforcement instructions. Ripple and others also froze funds, and Binance puts the frozen total at roughly $3 billion. Bitcoin can't be frozen at network level.

Binance said it would cover the shortfall from its SAFU fund, part of its futures insurance fund and its corporate treasury, so that users don't bear the loss. It reported 90% of the stolen assets replaced on 31 October and about 95% in a later update, and 98% of the $6.34 billion on 3 November; the rest is less-liquid tokens. Replacing the backing is not the same as recovering the money from the attacker, as CNBC points out.

How withdrawals are reopening

The first withdrawal window opened at 06:00 UTC on Sunday 1 November and included BTC, ETH, USDT, USDC, BNB and XRP. CoinDesk counts bitcoin and 15 other blockchains in that phase; The Block counts 15 networks and assets. In about the first nine and a half hours, Binance processed $4.65 billion in withdrawals against $1.01 billion in deposits. At 11:22 ET that day, its status page still showed withdrawals suspended for 531 of 552 coins.

On 2 November Binance completed a proof-of-reserves check covering ten assets. On 3 November it restored 51 more tokens, 31 on Ethereum and 20 on Solana, and said each further asset and network will follow once it passes security checks, with no fixed end date. Reports differ on the order for other networks: Odaily reported USDT on Arbitrum and Tron back on 1 November, while Reuters said some assets on Arbitrum, Optimism, Tron and Base would resume on 3 November. Neither means every asset on a network is open, and we found no report confirming the full list on Base.

As of 6 November, CNBC cites a Binance security report published on 3 November, which we haven't read ourselves, and Teng said an independent expert will review what Binance has done. We found no published result of that review.

What this means for merchants

Many customers pay from an exchange balance rather than their own wallet. From 29 October until withdrawals reopened, a customer paying from Binance could not send at all, and for many smaller tokens they may still not be able to. If you saw invoices created but not paid in those days, this is one possible reason, and not necessarily a problem with your checkout.

Invoices with short expiry windows are the most exposed. A customer who opened an invoice, tried to withdraw from Binance and failed may come back after it expired, when the amount for a coin whose price moves would be different.

The freezes are also a reminder that USDT and USDC are issuer-controlled tokens: the issuer can freeze them at an address. In this case the freezes targeted funds linked to the attacker, and none of the reports we read describes ordinary merchant wallets being frozen.

Finally, the outflows show how quickly people move funds off an exchange after an incident. If your payouts land on an exchange deposit address, you carry that exchange's operational risk from the moment the transfer confirms.

What should a merchant do?

  1. 1Review invoices from 29 October to 1 November that expired unpaid. Where a customer confirms they tried to pay, send a fresh payment link rather than asking them to reuse the old one.
  2. 2If a customer says their coin is still locked on Binance, offer another coin or network they can send now, and ask them to check it on Binance first: a coin may be open on one network and still closed on another. Coins and networks lists what Crypto Merchant accepts.
  3. 3Check network status before assuming a late payment is a chain problem. In a case like this the bottleneck is the exchange, not the blockchain.
  4. 4Send payouts to a wallet you control, and forward to an exchange only when you intend to trade. Crypto Merchant is custodial, so it holds the keys for incoming payments until you pay out; moving coins carries a gas fee, from the gas balance or the coins being moved.
  5. 5If a customer overpays while retrying, the extra is held for that customer, who withdraws it from the invoice page. Point them there rather than sending coins by hand. The invoice's overpaid_amount shows how much.

Sources

Start accepting crypto today

Free setup, no documents to sign up, 1% per paid invoice, and payouts whenever you want.

Create your accountAll news