Changpeng Zhao’s Binance restores 95% of $6.3 billion hack

Chinese-Canadian billionaire Changpeng Zhao’s Binance began restoring customer withdrawals on Sunday after replacing about 95% of the $6.3 billion in digital assets stolen in what is likely the largest cryptocurrency heist on record.

The world’s largest crypto exchange opened its first withdrawal window from 06:00 to 09:00 GMT on Nov. 1, starting with Bitcoin, Ether, BNB, XRP, Tether’s USDT and Circle’s USDC, along with withdrawals on 15 blockchain network groups. Binance said assets are being reopened in order of user demand over the past week, with each one passing security checks first.

“We are taking a phased approach by prioritizing tokens based on the past week data of user demand,” Binance said in a statement on X.

The exchange said it has replaced about 95% of the affected assets using company funds, including its Secure Asset Fund for Users, an emergency reserve. That was up from about 90% a day earlier, according to CoinDesk. The remaining 5% consists mostly of smaller, less liquid tokens outside the top 10, which Binance said it is still buying through market and over-the-counter channels.

Chief Executive Richard Teng said on X that the exchange had “replenished approximately 95% of the impacted assets” and that Binance will absorb the financial impact of the theft, meaning customers will not bear the losses.

The theft itself unfolded quickly. Hackers drained Binance’s hot wallets, the online wallets used for routine payouts, late on Thursday, Oct. 29. Binance’s initial investigation suggests the breach began with the compromised laptop of a DevOps engineer, which gave the attacker access to a service container used to submit unauthorized withdrawals, according to Nairametrics.

The FBI attributed the attack to North Korean hackers. Blockchain analytics firm TRM Labs linked it to TraderTraitor, the group also blamed for the roughly $1.5 billion theft from Bybit in February 2025.

TRM Labs said the haul included 18,270 Bitcoin worth about $1.47 billion, 200,630 Ether, 1.875 billion USDT and 823 million USDC on Ethereum, 233.46 million XRP and 970,500 Solana.

Binance said about $3 billion is frozen, mostly stablecoins that issuers such as Tether and Circle can block. Bitcoin and Ether cannot be frozen the same way, which leaves a large part of the stolen funds beyond reach.

Behind the exchange sits one of the world’s richest crypto investors. Zhao, who founded Binance in 2017 and stepped down as chief executive in 2023 under a plea agreement with US authorities, remains its largest shareholder. Forbes estimates he owns about 90% of the exchange, which accounts for most of his fortune.

His wealth is disputed. Forbes has valued him at more than $100 billion, though Zhao said in October that he is worth $10 billion to $30 billion.

A day after the hack, Zhao told Elon Musk to stop mocking the theft after the SpaceX founder responded with laughing emojis. Zhao had earlier pointed to Binance’s SpaceX holding, worth more than $1 billion, as one of the resources the exchange could draw on. He estimated the remaining gap at about $2 billion at the time, while noting that the figures were not final.

Binance has promised a full proof-of-reserves report and said all major balances listed on its platform are fully backed. The exchange warned users that withdrawals may be delayed by heavy traffic and advised those whose transactions fail to retry after a short wait.