Binance has re-enabled cryptocurrency withdrawals across 15 blockchain networks after a security incident that saw more than $6 billion in digital assets stolen. Changpeng Zhao, the exchange's founder and former CEO, publicly thanked the U.S. Secret Service and partner federal agencies, saying their rapid response helped trace and freeze a significant share of the stolen funds.

The investigation spans several U.S. authorities, including the Federal Bureau of Investigation (FBI), the Internal Revenue Service Criminal Investigation division (IRS-CI), and the Department of Justice (DOJ). North Korea has been attributed as the perpetrator, although the inquiry remains ongoing.

Zhao highlighted that investigators identified and froze a considerable amount of the stolen cryptocurrency within minutes of Thursday's incident. That timing carries weight in blockchain thefts, where the longer stolen assets sit undisturbed, the more opportunities attackers have to shuttle them through additional wallets and services before controls can catch up — a difficulty the ongoing tracing effort continues to confront. The FBI has additionally published a list of cryptocurrency addresses tied to the case to help track the movement of the affected assets. Publicly listing such addresses allows exchanges, analytics firms, and other platforms to flag incoming deposits connected to the theft, a standard practice in blockchain investigations that extends monitoring well beyond the agencies directly involved. The swift intervention marks a notable step toward recovering the funds, with authorities still working to trace the remainder and identify those responsible.

In a post on X, Zhao expressed his gratitude to the agencies involved:

Thank you, @SecretService, and all the agencies and industry partners involved. You acted within minutes to help track and freeze stolen funds, and the work continues. Your speed, expertise, and dedication helped contain the damage and reduce the risk of potential ripple effects across crypto and, may I say, even the broader financial markets. Deeply grateful.

— CZ BNB (@cz_binance), November 1, 2026

Withdrawals Resume Across 15 Networks

Binance halted withdrawals temporarily as it worked to contain the situation and put the necessary operational safeguards in place. Restoration began in phases at 06:00 UTC on November 1, 2026, and by 12:36 UTC the exchange had reopened withdrawals across all 15 blockchain networks and the assets covered in the first restoration phase.

The pause triggered heavy outflow activity as users moved funds off the platform. Over the reported window, withdrawals totaled roughly $4.649 billion against about $1.01 billion in deposits, a net outflow of approximately $3.64 billion.

That net outflow equated to roughly 2.1% of the $171 billion in assets under management reported in Binance's October 28 Proof of Reserves snapshot — the customer assets the exchange holds — indicating that the exchange continued processing large volumes of customer transactions while progressively restoring withdrawal access across its supported networks.

Binance confirmed the restoration timeline and the associated flows in a statement on X, adding that its teams were rigorously testing the remaining networks and assets ahead of the next phase:

Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026. By 12:36 UTC, withdrawals had resumed for all 15 networks and assets in the initial phase. After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial. Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion. This represents 2.1% of our $171 billion in total assets under management (AUM), based on the latest available Proof of Reserves (PoR) data as of October 28, 2026. A new PoR snapshot was taken at 00:00 UTC on October 31, and zero-knowledge proof (ZKP) computation began. The updated report is expected to be available on our PoR website tomorrow. Our team continues testing rigorously the remaining networks and assets. We know how important safe and reliable access to your funds is and will share details of the next phase as soon as we can. Rest assured that market conditions are stable. Thank you for your patience and continued support.

— Binance (@binance), November 1, 2026

Proof of Reserves Update in Progress

In parallel with restoring withdrawals, Binance is preparing an updated Proof of Reserves (PoR) report offering additional detail on the assets it holds for customers. A fresh reserves snapshot was reportedly taken at 00:00 UTC on October 31, and the corresponding zero-knowledge proof computation was still underway, with the updated report slated for release on November 2.

PoR systems are intended to give users evidence that an exchange holds enough assets to cover customer balances. They typically employ cryptographic verification to show that reported holdings match customer liabilities without publicly exposing individual account details. Zero-knowledge proof technology reinforces this process by allowing an exchange to validate specific financial information without disclosing the underlying private data.

The forthcoming report is expected to give users a refreshed view of Binance's financial position after the heavy withdrawal activity surrounding the security incident.

North Korea Attribution Keeps Crypto Security in Focus

The reported North Korean connection adds a further dimension to the case, amid sustained international scrutiny of cryptocurrency thefts tied to state-associated cyber operations. Tracing stolen digital assets across multiple blockchain networks is inherently difficult, as attackers often shuttle funds through different wallets, exchanges, and transaction routes to obscure their trail.

The combined involvement of the FBI, IRS-CI, DOJ, and the Secret Service underscores the value of cooperation between law enforcement agencies and cryptocurrency platforms when investigating large-scale digital asset thefts.

With withdrawals back online across all 15 initially affected networks and recovery efforts ongoing, attention now turns to the remaining networks and assets Binance is still testing, the updated Proof of Reserves report expected on November 2, and the findings that emerge from the multi-agency investigation. For the exchange, the immediate priorities remain preserving operational stability, supporting customers, and cooperating with authorities as the inquiry moves forward.

Source: CoinTrust