Search interest in "Binance" sat near 25 on the weekly Google Search index through most of October, then jumped to 70 in the week ending October 31: a 180% rise and the highest weekly reading in the 14 weeks on record. The trigger is the largest crypto heist on record, roughly $6.3 billion drained from the exchange's hot wallets on October 29. By November 1, Binance had restarted customer withdrawals in phases after saying it replaced 95% of the stolen assets, and the FBI attributed the attack to North Korea's TraderTraitor group. That combination, a record theft plus a record-fast recovery, is why the story is moving.
Where the attention moved
The spike stands out because the baseline was so quiet. Weekly search interest for "Binance" drifted between 27 and 55 from August through mid-October, sliding to 25 in the week of October 24. The heist week took it straight to 70, roughly double the 13-week average of 34.7. Over three months, search interest is up 141%.
The story also ranked 15th on the Google News top-stories board on November 1. People searching were not just reading: they were looking for an exchange that had frozen their money for three days.
What Binance says it did
Binance's updates, issued through its official recovery thread, put the breach at approximately $6.3 billion taken from hot wallets on October 29. Reuters reporting cited by outlets on November 1 calls it the biggest cyber theft ever recorded, passing the $1.5 billion hack of exchange Bybit in 2025.
The exchange paused withdrawals after the breach, then reopened them in stages on Sunday, November 1. Phase one ran between 06:00 and 09:00 UTC and covered 15 networks; Bitcoin went first, followed by Ether, BNB, Solana, XRP, Dogecoin and several stablecoins. Binance said it picked the order from user-demand data and warned of congestion and delays while the backlog clears.
On recovery, the numbers moved fast. The exchange said it had replenished 90% of the stolen assets by Saturday, then 95% by Sunday, about $6 billion, using its corporate treasury, the Secure Asset Fund for Users, and its futures insurance fund. Co-CEO Richard Teng said users would not bear the financial impact. The remaining 5% is mostly less liquid tokens the exchange is still buying on open markets. One honest caveat: every recovery figure so far comes from Binance itself. The exchange published a proof-of-reserves snapshot on October 31, with a more detailed cryptographic proof scheduled for early next week (its own post said Monday, November 2; one outlet reported November 3). Independent confirmation waits on that, and on the full technical post-mortem Binance promised once the investigation allows.
The attribution, and the $3 billion that did not get away
On October 31, the FBI said the attack was the work of TraderTraitor, a North Korean state-sponsored unit, linked by blockchain analysts including TRM Labs. It is the same group behind the 2025 Bybit hack, which turns this into a pattern rather than a one-off: state-level attackers going after exchanges with nine-figure-plus hauls.
Binance and its partners say roughly $3 billion of the stolen funds were frozen on-chain within days, with industry partners and law enforcement tracing the flows. The market barely flinched. By November 1, Bitcoin was trading near $77,700 and Ether near $2,260, both slightly up on the day, per the exchange's update. That is the other half of the attention story: a record heist paired with a record-fast clawback, and prices held.
What is still unresolved
Two things hang over the recovery. First, the last 5% of replacement tokens: less liquid assets take longer to source, so some networks stay closed until the exchange buys them back. Second, the withdrawal backlog: with three days of pent-up outflows hitting restored networks, Binance is metering the restart to watch for follow-on attacks.
The Android SMS of Death exploit made a similar week for the Hyperaware team: a flat line, a public disclosure, then the spike. The Binance version just happens to be measured in billions.
