Binance Reopens Withdrawals After $6.3 Billion Hack, Says 95% of Stolen Assets Replaced

Since hackers drained about $6.3 billion from Binance on Oct. 29, the exchange has moved from a full freeze to a phased reopening. Binance began restoring customer withdrawals Sunday, Nov. 1, after suspending them following the theft.

Withdrawals return in stages

Binance said the first phase would start after 2 p.m. Singapore time, with withdrawals scheduled between 0600 and 0900 GMT, covering 15 crypto assets, including bitcoin, ether, XRP and dogecoin. Some stablecoin services are also back, among them USDT and USDC on the Ethereum network, plus certain tokens on the BNB Smart Chain.

The exchange warned that heavy demand could cause delays. Customers whose transactions fail were told to wait briefly and try again. More services will reopen as security checks finish, Binance said.

Deposits had already resumed normal operation before the withdrawal restart.

Replacement figure rises to 95%

On Saturday, Binance said it had covered about 90% of the stolen assets. On Sunday it said the figure was approximately 95%. The remainder consists of less-liquid tokens that the company says may take longer to source in the needed amounts.

"Binance will absorb the financial impact of the stolen funds, not our users," the company said in a statement on X.

Binance has set aside about $6.34 billion of company funds to cover the losses. The replacement tokens were bought with money from its Secure Asset Fund for Users, a roughly $1 billion bitcoin reserve, along with part of its Futures Insurance Fund and its corporate treasury. Co-CEO Yi He said Saturday that 50% of the SAFU fund would be used. The company has pledged to replenish it to about $1 billion.

Binance said about $3 billion of the stolen assets had been frozen on-chain as of Friday. It is working with law enforcement and industry partners to trace and recover the rest.

FBI names North Korea; Trump hedges

The FBI said Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets, and tied the operation to a cyber unit it tracks as TraderTraitor. The same actors were blamed for the roughly $1.5 billion Bybit theft in February 2025. The bureau said it had watched the group convert stolen assets mainly into ether, and that it expects more laundering through decentralized finance platforms and instant swap services.

The FBI urged private-sector firms to block transactions linked to addresses TraderTraitor is using, and published a list of them.

TRM Labs, Elliptic and Chainalysis had earlier attributed the attack to TraderTraitor with "high confidence." TRM Labs and Chainalysis said the bulk of the theft unfolded in about 20 minutes beginning late Thursday and resembled earlier attacks blamed on Pyongyang.

The White House line is less settled. "We don't know if it's North Korea but if it is, we'll talk to North Korea about it," Trump told reporters Saturday, in comments posted by a White House account on X. That sits awkwardly beside the FBI's flat attribution the same day.

Pyongyang has long denied using state-linked cyber units for theft. Its Geneva mission and its embassy in China did not respond to requests for comment.

How the breach happened is still shifting

Binance first said a compromised DevOps engineer's laptop may have given the attacker access to a service container, which was then used to submit unauthorized withdrawals. Co-CEO Richard Teng described a "complex attack" involving that laptop and malware built to delete evidence of its activity.

Binance has since said its investigation found additional points of breach. It has said it found no evidence that any wallet private keys leaked. The company says unauthorized outflows stopped once withdrawals were paused, and that it revoked the affected address authorization.

Binance has not given a definitive account of the intrusion. It has promised a detailed technical post-mortem once the facts are verified, and an updated proof of reserves once remediation is done.

Scale in context

TRM Labs researchers put total crypto theft last year at $2.9 billion across nearly 150 attacks. This single $6.3 billion incident is larger than that entire total.

The open items are concrete. Binance still has to buy back the last 5% of tokens, publish its reserves proof and post-mortem, and finish reopening the remaining services. Meanwhile the FBI expects the stolen assets to keep moving through DeFi platforms and swap services, where the roughly half of the funds not yet frozen could be laundered.