Binance, the world's largest cryptocurrency exchange, restored withdrawals in phases after a reported $6.3 billion (£4.7 billion) theft. Net outflows reached $4.72 billion (£3.51 billion) after the suspension was lifted, Reuters reported.
Why Binance's 1 November 2026 Restart Made Access the Immediate Test
For customers, the immediate consequence was a period when deposits remained open but withdrawals did not. Binance said it would restore withdrawals asset by asset after security checks, and its co-chief executive said security had to come before normal operations. Access is the test.
The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored cyber unit. It said the attackers were converting stolen assets primarily into ether and urged virtual-asset services to block transactions linked to addresses it identified. The FBI's attribution does not establish how the attackers gained access.
Reuters Reports $4.72B in Net Outflows Since the Restart
Binance began restoring withdrawals on 1 November 2026, first reopening selected assets and networks, then adding others as checks were completed. The exchange warned that traffic could delay processing during the rollout. It also restored US-dollar cash withdrawals on 2 November 2026.
Reuters first reported net outflows of $3.64billion (£2.71 billion) during the first 9½ hours after withdrawals partly resumed. In a later update, it reported cumulative net outflows of $4.72 billion (£3.51 billion) since the suspension was lifted.
Binance said withdrawal volumes had declined and were stabilising; the figures are global and do not show how UK customers were affected.
The outflows have not established whether customer confidence in Binance will recover. Reuters reported that analysts expected security concerns to influence how much institutional investors and market makers allocate to crypto. Bitcoin, which had fallen to a six-week low, was trading around $78,000 (£58,100) on Monday.
Binance Says It Replaced About 95% of the Affected Assets
Binance said on 1 November 2026 that it had replenished about 95% of the affected amount using company resources, including its treasury, insurance funds and security reserve. It said the remaining tokens were less liquid and would take longer to source.
This describes Binance's stated efforts to replace the assets, not the proportion recovered from the attackers.
The breach's technical details remain under investigation. Reuters reported that Binance co-chief executive Richard Teng had described a compromised laptop and malware designed to delete evidence.
Binance's 30 October 2026 update said its initial investigation suggested a laptop might have been involved, but subsequent work had uncovered additional points of breach.
Security journalist Zack Whittaker argued on Bluesky that if an employee's laptop could reach systems controlling billions in crypto, responsibility would also lie with the company's security design. This is Whittaker's assessment, not an investigator's finding. TechTimes' earlier report on Binance's breach covered the initial estimates and technical accounts.
Binance said that its $6.3 billion crypto breach "may involve a compromised DevOps engineer’s laptop." If a single employee's laptop was able to access Binance's systems capable of controlling billions of dollars of crypto, that's the *company's* fault for having a bad security setup.
— Zack Whittaker (@zackwhittaker.com) 2026-10-30T14:39:25.271Z
FCA Guidance Sets the UK Consumer Context
The available reporting does not establish that UK customers lost funds or faced a different withdrawal timetable. For a UK user, the practical question is whether they can move their crypto if a service is interrupted, and what routes for complaint or compensation may apply.
Access is the test: a displayed balance may not be usable while withdrawals are unavailable.
The Financial Conduct Authority's guidance, updated in January 2026, says crypto investors are unlikely to have access to the Financial Ombudsman Service or the Financial Services Compensation Scheme if something goes wrong. Potential protection depends on the firm and whether its service involves a regulated activity.
The FCA's separate Binance warning page, last updated in June 2023, said at that time that no Binance Group entity held UK authorisation or registration to conduct regulated business; it is not a response to this breach or confirmation of the group's present status.
The Guardian reported that fake compensation offers were circulating after the breach and that Binance founder Changpeng Zhao warned users on X about scammers. The report does not establish that UK customers were targeted. Separately, TechTimes has reported UK police warnings about fake-officer calls used to probe people about crypto holdings; those warnings concern a different fraud risk.
For incident updates, Binance has told users to rely on its official channels. That is especially relevant when messages promise compensation or ask customers to connect a wallet or transfer assets to recover them.
