Binance, the world’s largest crypto exchange, has started letting customers withdraw their money again — just days after hackers stole about $6.3 billion in the biggest crypto theft ever recorded.
Withdrawals reopened in stages on Sunday, November 1, and at the same time the FBI publicly blamed North Korea for the attack. It is a fast-moving story with two very different parts: customers getting access to their funds again, and investigators pointing the finger at a state-backed hacking group.
This is a follow-up development to the October 31 post about Bitcoin falling after the hack — new facts here are the reopening of withdrawals and the FBI attribution, not a repeat of the October 31 price story. Related reading: Bitcoin fell below $77,000
What Happened
Binance froze withdrawals after the hack on Thursday, October 29. On Sunday, it began reopening them in phases, starting with 15 cryptoassets including Bitcoin, Ethereum, XRP, Dogecoin, Tether (USDT) and USD Coin (USDC). Bitcoin withdrawals resumed first, shortly after 2 p.m. Singapore time, and other networks including Ethereum, BNB Smart Chain, XRP and Base followed later in the day.
Binance warned users to expect congestion and delays, which is normal when a lot of people try to move money at once after a freeze. It said it was prioritising tokens based on user demand over the past week.
The exchange also said it has now covered most of the loss itself. On Saturday it said about 90% of the stolen amount had been replaced, and later updates put the covered amount at about $6 billion, or roughly 95% of the $6.3 billion total. The remaining, less liquid tokens may take longer to buy back. Binance has said repeatedly that users will not bear the financial impact, and it set aside about $6.34 billion of company funds to cover the losses, using its emergency reserves, insurance funds and treasury money.
Within roughly three hours of withdrawals reopening, about $2 billion in Bitcoin, Ether and stablecoins left the exchange, according to crypto tracker Whale Alert. That does not mean more money was stolen — it mostly means customers moving their own funds out after days of being unable to touch them.
Why It Happened
The FBI said on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29. Specifically, it named a group called TraderTraitor, which it describes as a North Korean state-sponsored hacking unit and part of the wider Lazarus Group.
According to the FBI, TraderTraitor actors have been converting the stolen assets mainly into Ether, and investigators expect them to keep laundering the money through decentralised finance platforms and instant swap services. The FBI published hundreds of addresses it says held or once held the stolen funds — more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address — and asked crypto businesses, node operators and exchanges to block transactions from them.
Chainalysis, a blockchain analysis firm, warned that the attackers are likely to use tens of thousands of addresses in the coming weeks, which makes blocking them much harder in practice.
There is one wrinkle worth noting honestly. When President Donald Trump was asked about the hack on Saturday, he said the US was still learning about it and added: “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it.” So the FBI’s attribution is clear, but the political message has been more cautious.
Why It Matters
First, this is about trust. Binance is the biggest exchange in crypto, and a $6.3 billion theft shakes confidence in the whole industry — even for people who never used Binance. How fast customers get their money back, and whether Binance really covers the full loss, will shape that trust for months.
Second, the FBI naming North Korea matters for how the rest of the industry responds. When law enforcement publishes hacker addresses and asks exchanges to block them, it puts pressure on every platform to cooperate. It also shows how crypto theft has become a national security issue, not just a company problem. North Korea-linked groups were already blamed for more than $2 billion of crypto hack losses in 2025, according to industry data cited by CoinTelegraph.
Third, the scale is hard to overstate. Analysts have described this as possibly the biggest financial robbery ever, bigger than the $1.5 billion Bybit hack in February 2025. The bulk of the theft unfolded in around 20 minutes late on Thursday, according to blockchain firms TRM Labs and Chainalysis.
What Happens Next
Binance is due to publish proof of reserves on Monday, November 2. That is a public snapshot meant to show that customer funds are fully backed. After a hack this size, that report will be watched closely — and skeptics will want to see details, not just a headline.
Withdrawals will continue to reopen in phases, and more money is likely to leave the exchange in the short term as nervous customers move funds elsewhere. That is not necessarily a sign of failure. After a freeze, outflows are expected.
The longer investigation — tracking the stolen funds through swaps and decentralised platforms, and whether any of it can actually be recovered — will take weeks or months. About $3 billion in affected assets had been frozen as of Friday, but frozen funds are not the same as recovered funds.
Final Thoughts
For ordinary crypto users, the lesson from this week is blunt: even the biggest exchange can be hit, and “big” does not mean “safe.” Binance moving fast to reopen withdrawals and cover losses helps, but it does not erase the fact that $6.3 billion was taken in the first place.
The FBI attribution adds a serious geopolitical layer to what started as a company security failure. Whether it leads to real consequences for the hackers is a different question — and one that will take a lot longer to answer than a weekend of reopened withdrawals.
Key figures:
- Amount stolen: about $6.3 billion (October 29, 2026)
- Covered by Binance: about 90% on Saturday, later put at about $6 billion (roughly 95%)
- Company funds set aside: about $6.34 billion
- Withdrawals reopened: Sunday, November 1, in phases, starting with 15 cryptoassets
- Outflows in first ~3 hours: about $2 billion, per Whale Alert
Disclaimer: This article is for educational and informational purposes only and does not constitute financial advice.
Sources: Reuters report on Binance resuming withdrawals (November 1, 2026); CoinDesk report on the FBI’s North Korea attribution (October 31, 2026); Binance statements as reported by Reuters and CoinDesk.
