The short version
- Binance withdrawals should be back within 48 hours, co-CEO Yi He said at 04:17 UTC on Friday, while deposits already work as normal.
- TRM Labs blames North Korea’s TraderTraitor unit for the $6.36 billion theft, and ZachXBT says stolen coins were mixed with funds from the $388 million Bitget exploit.
- The crew is watching whether withdrawals restart on time, and urges users to ignore “support” DMs and turn on 2FA, an anti-phishing code and the withdrawal whitelist.
Binance withdrawals should be back within two days, co-CEO Yi He said in a service update early on Friday. Deposits already work as normal. With Binance withdrawals suspended since Thursday night, the biggest risk to Binance users isn’t the hack itself, it’s the scammers who follow every hack like this one.
Here is what we know about the restart, who is behind the $6.3 billion theft, and five things to check in your account today.
Yi He’s update, posted at 04:17 UTC:
**Service Update**
Deposits remain unaffected and continue to operate as normal.
Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours.
We will continue to share
When Will Binance Withdrawals Resume?
Binance withdrawals should restart within 48 hours of that update, so by early Sunday UTC at the latest if the plan holds. Yi He said the team is “working on enhancements to the withdrawal service and related address controls” and will share progress “through official Binance channels.”
That wording matters. The attacker got in through a compromised DevOps engineer’s laptop and pushed unauthorized withdrawals out of Binance’s own hot wallets, Binance said. The fix is in the system that sends withdrawals, so the restart may come in stages, coin by coin or network by network, with longer queues than usual.
Binance says user funds are safe and that it will cover all losses from its SAFU fund and its own money. Nothing in its updates asks users to do anything to get that cover. We covered the hack itself, the freezes and the numbers in our Binance hack report.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
Who Is Behind the Binance Hack?
North Korea, according to the trackers, although Binance hasn’t named anyone yet. Blockchain analytics firm TRM Labs attributes the theft to TraderTraitor, North Korea’s elite hacking unit, with high confidence, and counts about $6.36 billion taken across ten blockchains.
Onchain investigator ZachXBT replied on X that it was “likely Lazarus Group (DPRK),” the wider North Korean group TraderTraitor belongs to. At 04:51 UTC he added a new clue: stolen funds from Binance and from the $388 million Bitget exploit were mixed at the same address after arriving through THORChain.
@SpecterAnalyst Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain.
This indicates the same actor is likely behind both incidents.
The Bitget exploit was attributed to DPRK-linked
SIDE TRAIL: How to Protect Your Crypto Accounts
What Should Binance Users Do Now?
Nothing drastic. Is Binance safe to leave money on for now? The exchange has promised to cover every loss, so the work is on your side of the login. Five checks:
- Ignore every “Binance support” DM. Treat any unsolicited message on Telegram, WhatsApp or X that offers an early withdrawal, a refund or a “wallet check” as fake. Anyone asking for your password, 2FA code or seed phrase is a scammer. Check any contact on Binance Verify before you reply.
- Use only official channels. Type binance.com yourself or use the app. Lookalike sites and fake “withdrawal request” emails always spike after a hack.
- Set an anti-phishing code. Binance then prints your own word in every real email it sends, so a fake one stands out at a glance.
- Check your 2FA, devices and API keys. Use an authenticator app or passkey rather than SMS, log out devices you don’t recognise and delete API keys you no longer use.
- Turn on the Binance withdrawal whitelist. With it on, coins can only go to addresses you saved in advance, so a stolen login alone can’t send them anywhere new.
When withdrawals reopen, don’t race the queue. Send a small test first and double-check the network before moving a large amount. A wrong-network transfer is a bigger risk than a few more hours on the exchange.
TRAIL MAP: The 10 Most Common Crypto Scams and How to Spot Them
BNB Price After the Binance Hack
BNB trades at $717 at the time of writing, down 5% in 24 hours after a dip to $682. It sits under its 50-day moving average at $750, with $706 as the first support. Bitcoin is down 2% at $78,470.
The crew is watching two things: whether withdrawals restart inside the 48 hours, and what Binance’s post-mortem says about how one laptop opened the door to its withdrawal system.
In crypto since 2016. Covers altcoins and the daily market. When not trading, out climbing and traveling.
More from Teddy →
