Level 1 — Absolute Beginner

Binance is a very big company. People buy and sell digital money there. Digital money is also called crypto.

On Thursday, thieves took a lot of money from Binance. They took about 6.3 billion dollars. It happened very fast. Most of it took only about twenty minutes.

Binance stopped all withdrawals. This means customers could not take their money out. People were worried.

On Sunday, Binance opened withdrawals again. The company says it has already replaced 95 percent of the missing money. It used its own money to do this. The FBI says hackers from North Korea took the money.

company

An organisation that sells goods or services to make money.

digital money

Money that exists only on computers and not as coins or paper.

thief

A person who takes something that is not theirs.

billion

One thousand million.

withdrawal

Taking money out of an account.

customer

A person who buys something or uses a service.

replace

To put something new in the place of something that is lost.

hacker

A person who breaks into computers without permission.

Level 2 — Elementary

Binance is the world's largest crypto exchange, a place where people trade digital currencies such as bitcoin. On Thursday 29 October, attackers drained about 6.3 billion dollars from its wallets. Most of the money left in roughly twenty minutes, across several different blockchains.

It is the biggest crypto theft ever recorded. The previous record was the Bybit attack of 2025, which cost about 1.5 billion dollars. After the breach, Binance suspended deposits and withdrawals, so customers could not move their money at all.

Withdrawals restarted on Sunday 1 November, in stages rather than all at once. Bitcoin withdrawals came back shortly after 06:00 GMT, and the first phase covered 15 assets including bitcoin, ether, XRP and dogecoin. Other assets will follow when each network passes a safety check.

Binance says it has now covered 95 percent of the stolen assets, up from 80 percent and then 90 percent earlier in the week. It used its one billion dollar Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. In an update on X the company wrote, "These losses will not be passed on to users." On Saturday the FBI blamed a North Korean state-sponsored unit called TraderTraitor.

exchange

A business where people buy and sell currencies, shares or crypto.

drain

To remove all of something, especially money, from a place.

blockchain

The shared digital record that tracks who owns a crypto coin.

breach

A break in a system's security.

suspend

To stop something for a period of time.

phase

One stage in a process that has several stages.

treasury

The money a company keeps in reserve.

state-sponsored

Paid for or directed by a government.

Level 3 — Intermediate

Binance let its customers start moving money off the platform again on Sunday 1 November, three days after an attacker emptied roughly 6.3 billion dollars from the exchange's hot wallets. The bulk of the theft took about twenty minutes late on Thursday 29 October and reached across a long list of blockchains. By any measure it is the largest crypto theft on record, dwarfing the 1.5 billion dollar Bybit attack of 2025 that previously held that unwelcome title.

The reopening was staged rather than wholesale. Bitcoin withdrawals resumed shortly after 06:00 GMT and the first phase covered 15 assets, bitcoin, ether, XRP and dogecoin among them, with each asset and network pair requiring its own security and stability check before the tap is turned. Binance's own network status page still listed some bitcoin and ethereum activity as partially suspended hours later, a reminder that a phased restart and a finished restart are different things.

The money question is where the story gets interesting. Binance says it has covered 95 percent of the stolen assets, a figure that climbed from 80 percent to 90 percent over the weekend, by buying replacement tokens with company money. The sources were its one billion dollar Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury, and co-chief executive Yi He said on Saturday that half the SAFU reserve would be used and later topped back up. Industry partners had located about three billion dollars of the stolen funds as of Friday. The remaining five percent, the company says, consists of less liquid tokens that take longer to source at scale.

Attribution arrived on Saturday, when the FBI named TraderTraitor, a North Korean state-sponsored unit, and said investigators had watched the stolen assets being converted mainly into ether with further laundering expected. The blockchain analytics firms TRM Labs and Chainalysis had reached similar conclusions. Richard Teng, Binance's chief executive, described a complex attack that began with a compromised laptop and included malware designed to erase evidence. In its public update the exchange wrote, "Binance will bear the financial impact of the stolen funds," adding that "these losses will not be passed on to users." A fresh proof of reserves snapshot was taken on 31 October, with the full cryptographic proof promised by 3 November.

hot wallet

A crypto wallet kept connected to the internet so funds can move quickly.

dwarf

To be so much larger than something else that it looks small.

staged

Done in separate steps rather than all at once.

liquid

Easy to buy or sell quickly without moving the price.

attribution

Naming the person or group responsible for an act.

launder

To move stolen money through transactions to hide where it came from.

Level 4 — Advanced

An exchange that cannot process withdrawals is not really an exchange, which is why Binance spent the weekend buying back the tokens somebody else had taken. Roughly 6.3 billion dollars left its hot wallets late on Thursday 29 October, most of it inside about twenty minutes and spread across a long roster of blockchains. The sum makes it the largest crypto theft on record by a wide margin: the Bybit breach of 2025, at about 1.5 billion dollars, held the previous title and now looks modest.

The restart on Sunday 1 November was deliberately partial. Bitcoin withdrawals resumed shortly after 06:00 GMT and the opening phase covered fifteen assets, among them bitcoin, ether, XRP and dogecoin, each asset-and-network pair gated behind its own security and stability review. Hours after the window opened, the company's status page still described some bitcoin and ethereum movement as partially suspended, a discrepancy worth holding on to: in a liquidity crisis the difference between reopening and being open is measured in queues.

What Binance has done, in substance, is convert a theft of customer assets into a loss on its own balance sheet. The exchange says it has covered 95 percent of the stolen tokens, up from 80 and then 90 percent across the weekend, drawing on its one billion dollar Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury; co-chief executive Yi He indicated on Saturday that half of SAFU would be consumed and subsequently replenished toward its billion-dollar mark. Industry partners had traced about three billion dollars of the stolen funds by Friday. The residual five percent, the company concedes, sits in thinner markets where buying at the required scale would move prices against it, which is a polite way of saying the hole is easier to fill in bitcoin than in obscure tokens.

Attribution came from the FBI on Saturday, which named TraderTraitor, a North Korean state-sponsored unit, and reported that the proceeds were being converted principally into ether ahead of expected laundering; TRM Labs and Chainalysis had independently pointed the same way, while President Trump told reporters, "We don't know if it's North Korea." Chief executive Richard Teng characterised a complex intrusion that started with a compromised engineer's laptop and deployed malware intended to destroy forensic traces. The exchange's own framing was unambiguous: "Binance will bear the financial impact of the stolen funds," it wrote, and "these losses will not be passed on to users." A proof of reserves snapshot dated 31 October is to be followed by full cryptographic verification by 3 November, and that document, rather than any press statement, is what the market will actually read.

roster

A list of items or people belonging to a set.

gated

Held back behind a condition that must be satisfied first.

discrepancy

A difference between two accounts of the same thing that should match.