Is it true that users lost their money after the $6.3 billion Binance hack?

True. The money left the exchange's "hot" wallets (the ones connected to the internet for fast payouts) from the evening of October 29, UTC. Binance put the loss at about $6.3 billion, the largest crypto theft in history and 4 times the Bybit hack of 2025. About $3 billion was frozen with the help of partners. The preliminary cause is a hacked laptop belonging to one of the engineers.^[4][2][1]

The FBI says so. On October 31 it named the North Korean group TraderTraitor (part of the well-known Lazarus group) and said the stolen funds were being converted into ether (the Ethereum cryptocurrency) to cover the tracks. Earlier, crypto-tracing firms TRM Labs and Chainalysis reached the same conclusion.^[3][1][9]

Not confirmed. Binance said: "These losses will not be passed on to users." The gap is being filled from the exchange's customer insurance fund (SAFU), part of its futures insurance fund and the company's own money. By October 31, 90% of the stolen funds were covered, and by November 1–2 about 95%; the rest is rare coins that are harder to buy. Withdrawals have worked again since November 1: in the first hours customers withdrew about $4.6 billion.^[1][2][3][6]

Partly. After the hack the exchange halted withdrawals, and on November 1 it began reopening them step by step, by network and coin. Bitcoin, ether, the main "stablecoins" (coins pegged to the dollar) and many others can already be withdrawn; HYPE and APT reopened on November 8. As of November 8, INJ, PLASMA, NEAR and LTC were still waiting to reopen; the exchange has not published a full list of restrictions.^[1][7]

Not confirmed. The exchange is operating and paying out withdrawals. On November 2 it published a proof of reserves, a mathematical check that customer balances in the top 10 coins are backed 1:1. Caveat: it is a snapshot of a single moment and covers only 10 coins; such a check does not guarantee future stability.^[6][5][8]

This is a scam. Binance warned that it does not contact customers about money, does not sell places in the withdrawal queue and does not charge to reopen a coin. Scammers write via direct messages, email and chats, send tiny transfers with a message attached, lead people to fake websites and ask for passwords, SMS codes or a wallet's recovery phrase.^[5]

There is no public evidence. The FBI and independent crypto-tracing firms link the theft to North Korean hackers; about $3 billion was frozen by third-party companies within hours. The investigation is not over, and Binance has promised a full report later.^[9][3][4]

False attribution. Only one part is real: the engineer's laptop was indeed hacked. The "romance with a spy" story has not been confirmed in any way, ZachXBT did not publish it (a user-added note on X points this out), and Binance co-founder Yi He called it untrue.^[9]

False. On November 7 a post spread online claiming Musk was attacking Binance for holding 80% of the market and urging people to withdraw. Musk replied: "I never wrote anything like that. This is made up."^[10]

Around 20:24 UTC, money starts leaving Binance's "hot" wallets. According to the FBI, the theft took place "on or about October 29".^[2][3]

Binance reports a $6.3 billion hack, halts withdrawals and promises to cover all losses. About $3 billion is frozen. Bitcoin and ether fall by more than 3%.^[4]

Binance says it has covered 90% of the stolen funds. The FBI names North Korea's TraderTraitor group as the culprit. "Inside job" and "staged hack" theories appear; a CryptoTicker check finds no evidence for them.^[2][3][9]

Withdrawals reopen step by step; about $4.6 billion is withdrawn between 6:00 and 15:30 UTC. The same day, the "engineer and the spy" story citing ZachXBT is posted on X; by November 3 the post has over 800,000 views.^[1][9]

The exchange publishes a proof of reserves for 10 coins and says about 95% is covered. It warns about fake "compensation" and paid "fast-track withdrawals".^[6][5]

24/7 Wall St., citing Binance, reports that 98% of the stolen funds have been replaced; this has not been independently verified.^[8]

A fake Musk "quote" urging people to withdraw money from Binance spreads. Musk calls it made up.^[10]

HYPE and APT withdrawals reopen. The exchange still says about 95% is covered; some coins are still waiting to reopen.^[7]

Withdrawals resumed on November 1; Binance promises users will not bear the losses; $4.6 billion was withdrawn in the first hours.^[1]

The FBI blamed North Korea's TraderTraitor group; Binance covered 90% from its SAFU fund, an insurance fund and its own money.^[3]

A record loss of about $6.3 billion; Binance has covered 90%, the rest is rare coins.^[2]

First report of the hack: $6.3 billion, about $3 billion frozen, possibly caused by an engineer's hacked laptop.^[4]

A check of the "inside job", "staged hack" and "spy" theories: no public evidence.^[9]

Binance warns about fake "compensation" and paid withdrawal "speed-ups".^[5]

Binance published a proof of reserves for 10 coins; about 95% of the stolen funds are covered.^[6]

A story about a Binance engineer and a North Korean spy, falsely attributed to ZachXBT; a user-added note appeared under the post.^[9]

2026-11-01 · over 800,000 views as of 2026-11-03 (according to CryptoTicker)

A fake Elon Musk "quote" urging people to withdraw money from Binance; Musk and former Binance CEO Changpeng Zhao called it false.^[10]

2026-11-07

Scam offers of "compensation", "priority processing" and moving money to a "Binance vault".^[5]

2026-11-02

結果： Bybit did not halt withdrawals, closed the gap within 72 hours with loans and large deposits from partners, and a reserves check showed backing above 100%.^[11]

結果： The losses were covered from the SAFU fund, and withdrawals returned after a security review.^[12]

結果： Here the fears came true: it was not a hack but a shortfall of money at the exchange itself. On November 11, 2022, FTX filed for bankruptcy, customers lost access to their money for a long time, and could only get it back through the bankruptcy process.^[13]