Binance started letting customers withdraw again this morning, three days after attackers emptied its hot wallets. Bitcoin came back first, at 09:20 on Sunday, Kenyan time. At 10:49 Binance added ETH, USDT and USDC on the Ethereum network, and USDT, USDC and BNB on BNB Smart Chain, its own blockchain. Everything else comes back “in phases” once security checks are done, and Binance hasn’t said when.

Hours earlier, at 01:36, the FBI said North Korea was responsible “for the theft of more than $6 billion USD in virtual assets” from Binance, the work of a state hacking group it calls TraderTraitor. That’s the biggest crypto theft on record, about four times the USD 1.5 billion (about KES 195 billion) the same group took from Bybit in February 2025.

When we first reported the withdrawal pause early on Friday, Binance hadn’t called it a hack or given a figure. Both came within a day. In Recovery Update #2, posted at 22:58 on Friday, co-chief executives Yi He and Richard Teng wrote that “our hot wallets were compromised, resulting in a loss of approximately $6.3B USD worth of token assets”, about KES 818 billion. TRM Labs, Chainalysis and Elliptic, three firms that trace crypto for exchanges and governments, put it a little higher, at between USD 6.36 billion and USD 6.43 billion taken across ten or eleven blockchains.

So if you keep crypto on Binance, you want to know two things: whether you can move it, and whether it’s all there. For the coins above, you can, though Binance warns of delays and says to try again if a withdrawal doesn’t go through. For everything else, you wait. The answer to the second question is Tuesday, and until then it’s Binance’s word.

Binance says about USD 3 billion (about KES 390 billion) of the stolen coins is frozen. Most of that is stablecoins, tokens like USDT and USDC that are pegged to the US dollar and whose issuers can block an address. ETH and Bitcoin can’t be frozen that way.

On Friday Binance said it had set aside more than USD 6.34 billion of company money to cover the loss, USD 5 billion of it already held in the same tokens that were stolen. That’s where its first figure, 80% covered, came from. By Saturday it was 90%, and on Sunday morning 95%. Binance says ten tokens are fully backed: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The missing 5% is smaller tokens that it’s still buying on the market and through OTC deals, private trades between big buyers and sellers that keep a large order from moving the price. Binance hasn’t said which tokens or how much of each.

The money came from three places. One is Binance’s own treasury. Another is SAFU, the Secure Asset Fund for Users, an emergency fund Binance started in 2018 from a cut of trading fees. On Friday SAFU held 15,000 Bitcoin. On Saturday evening 7,499 of them left it, about USD 584 million (about KES 75.8 billion), and the fund’s public address now shows 7,500. Binance says it’ll refill SAFU to about USD 1 billion. It has used the fund before: in May 2019 hackers took 7,000 Bitcoin from Binance, and SAFU covered the loss in full.

The third source wasn’t in Friday’s update. On Saturday Binance added part of its Futures insurance fund, the money that pays out when a trader using borrowed money loses more than they put in. When that fund runs short, Binance closes part of winning traders’ positions to cover the hole, which it calls auto-deleveraging. Binance says it only took the part above the level its rules require, and also that “no exchange can completely avoid auto-deleveraging.”

Binance has said user funds are safe since Thursday night, and said it again on Sunday. It called them “completely safe” at 00:29 on Friday, about an hour and a half after the first coins left and almost a day before it gave any figure for the loss.

Teng’s version is that customers lost nothing because the hot wallet held Binance’s money. “We NEVER use any customer funds,” he said in a video on Friday. “What was affected in this incident was Binance’s own hot wallet.” He said the vast majority of customer coins sit in cold wallets, which are kept offline.

Binance’s own records complicate that. Binance 14, the main Ethereum hot wallet the attacker took over, is on the list of wallets in Binance’s Proof of Reserves, which Binance describes as “assets that we hold in custody for users”. Saturday’s snapshot, taken after the top-up, shows 3,654,922 ETH in those wallets against 3,654,919 ETH owed to customers, a margin of less than three coins. The attacker took about 200,000 ETH. So the stolen ETH sat in wallets Binance counts as backing what it owes you. If the snapshot holds, your balance is covered because Binance put its own coins back in. On Sunday morning Binance added new wallets to that list and said all withdrawals will now go out from them.

Proof of Reserves is how you check. Binance publishes what its wallets hold, plus a zero-knowledge proof, a piece of maths that lets each user confirm their own balance is counted in the total without seeing anyone else’s. Binance took a new snapshot at 03:00 on Saturday, Kenyan time. It says the full proof takes 40 to 50 hours of computing, and estimates it’ll be ready by Tuesday 3rd November (UTC). On Friday Teng had promised “a full Proof Of Reserves report by Monday”.

The proof will cover only the ten tokens Binance says are fully backed. It compares Binance’s holdings with customer balances at one moment, and it isn’t an audit of the company’s finances.

Binance’s explanation changed over Friday. At 05:25, Binance said the attack “may involve a compromised DevOps engineer’s laptop”, which gave the attacker access to a “service container”, one of the boxed-off programs that run Binance’s systems, where they submitted withdrawals. It said there was no evidence a private key had leaked, and Teng repeated all of it at 10:37. An hour later Binance said it had found “additional points of breach”.

By Friday evening Teng had more. The attacker used “a self-destruct mechanism that destroyed tooling and traces as they went”, and took control of the hot wallet through EIP-7702, the Ethereum feature we explained on Friday. “That delegation did not pass through our normal approval controls,” he said. Our reading is that Binance’s own systems signed something they shouldn’t have, but Binance hasn’t said how. Teng also called EIP-7702 “a known multi-signature protocol”. It isn’t. It lets an ordinary wallet run a contract’s code, and it has nothing to do with needing several signatures.

In public, Binance’s partners moved first that night. Tether blacklisted the attacker’s main address at 00:01 on Friday, an hour and a half before Binance’s first post saying withdrawals were paused. On Friday night Binance promised more technical findings within about 48 hours, which puts them late on Sunday. Sunday morning’s update mentions only a post-incident report “once the investigation is complete”, with no date. It also says deposits “are not affected by the incident”, although at 03:13 on Friday Binance said all deposits and withdrawals were suspended.

The part nobody could freeze is still with the attacker. On Saturday morning Elliptic put it at about USD 3.21 billion that no issuer can block. By Saturday evening Bitquery, another tracing firm, counted about USD 3.1 billion, including 18,270 Bitcoin that hasn’t moved since 23:48 on Thursday. Elliptic counts between USD 38 million and USD 67 million, in the Tron network’s TRX token, that has left the wallets it’s tracing so far. Bitquery found none of it sent to an exchange or a mixer, though some reached a cash desk, a service that pays out USDT for other coins.

Coins that sit still are easy to watch, and exchanges can refuse them when they move. Binance hasn’t said how much it expects to get back.

Until Saturday night only private firms had named anyone. Jonathan Levin, chief executive of Chainalysis, said on Friday it was “likely done by DPRK group TraderTraitor”, and TRM Labs said the same “with high confidence”. Binance itself said its investigation “has not attributed responsibility to any individual.”

The FBI’s statement settles it as far as the US government is concerned. It says TraderTraitor is converting the stolen coins “primarily into Ethereum (ETH)” and expects them to be laundered through DeFi and instant swap services, apps that trade one coin for another without an account. The FBI, the US Secret Service and the IRS’s criminal investigators are asking those services, and exchanges, to block transactions linked to the attacker’s addresses, which the FBI has published. Binance thanked the FBI at 08:05. The FSRA, the Abu Dhabi regulator that licensed Binance as an exchange last December, says it is “engaging closely with Binance and monitoring the incident”.

Binance’s person-to-person market, where Kenyans swap USDT for M-Pesa with each other, kept running through the pause. At 11:15 on Sunday, 58 ads were selling USDT for M-Pesa at about KES 130 per USDT. Binance hasn’t said anything about P2P since Thursday.

Kenya’s licensing deadline also lands this week. Existing crypto operators have until Wednesday 4th November to comply with the law we covered last October, which makes licensed platforms keep customer assets apart from their own and hold enough of each coin to pay everyone back. That’s the same thing Binance is promising to prove on Tuesday.

While the rest of the coins are still locked, ignore anyone on WhatsApp or Telegram offering to speed up or “unlock” a Binance withdrawal.

Binance found USD 6 billion of its own in three days, and that’s why its users will most likely be able to withdraw their full balances, and some already can. But it called user funds “completely safe” almost a day before it said what it had lost, it says the stolen wallet held its own money while its reserve list counts that wallet as backing customers, and its proof date has already moved by a day. Sunday’s withdrawals were the first check you could run yourself. Tuesday’s proof is the second.

Figures as of 11:15 on Sunday 1st November 2026, Kenyan time, at USD 1 = KES 129.90 and USD 77,865 per Bitcoin. We’ll update this story as more networks reopen and when the proof is out.