After one of the biggest cryptocurrency security crises ever reported, Binance is beginning to restore a service millions of customers rely on: withdrawals.
The world’s largest cryptocurrency exchange temporarily suspended withdrawals after hackers stole approximately $6.3 billion in digital assets from its platform. Now, two days after the incident, Binance says it has started reopening withdrawals in phases and has replenished approximately 95% of the affected assets.
But there is another major development: the FBI has attributed the attack to a North Korean state-sponsored hacking group known as TraderTraitor.
The incident is no longer just a story about a cryptocurrency exchange recovering from a cyberattack. It has become a major international cybersecurity investigation, with billions of dollars in stolen digital assets potentially moving through the global crypto ecosystem.
Binance Begins Restoring Withdrawals
Binance announced on November 1 that it would resume withdrawals in phases, following security reviews and efforts to restore affected services.
The first phase was scheduled to begin between 06:00 and 09:00 UTC on Sunday, November 1. Binance later confirmed that the first batch of networks had reopened, with additional assets and networks being restored progressively.
The first phase covers major cryptocurrencies and networks, including:
Bitcoin (BTC)
Ethereum (ETH)
BNB
Solana (SOL)
XRP
Dogecoin (DOGE)
USDT and USDC on supported networks
Other assets across networks such as Arbitrum, Base, Optimism and Polygon
Not every asset or network is necessarily available at the same time. Binance says users should check the withdrawal page or its network status page before attempting a transaction.
The exchange also warned that high demand during the initial reopening could cause delays or temporary withdrawal failures.
How Much of the Stolen $6.3 Billion Has Binance Recovered?
One of the biggest questions following the attack was whether Binance had enough financial resources to protect customers and replace the stolen assets.
The exchange now says it has replenished approximately 95% of the affected amount using company resources.
That is a significant increase from its earlier recovery updates:
According to Binance, the remaining 5% consists mainly of less liquid tokens outside the top ten assets. These cryptocurrencies are harder to source in the quantities required, so replenishing them may take longer.
Binance also said it had set aside more than $6.34 billion in company funds to cover the incident. It is using its Secure Asset Fund for Users (SAFU), corporate treasury and other company resources to absorb the financial impact.
The exchange insists that customers will not bear the losses.
However, it is important to distinguish between replacing affected assets and recovering the actual stolen cryptocurrency. Binance’s reported 95% replenishment means it has sourced replacement assets; it does not mean it has recovered 95% of the stolen funds from the attackers.
FBI Blames North Korean Hacking Group
The investigation has taken a major turn.
According to the FBI, the group was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29, 2026.
Investigators also observed the attackers converting stolen assets into Ethereum. The FBI warned that further laundering could involve decentralised finance platforms and instant cryptocurrency swap services.
It has urged cryptocurrency companies and other industry participants to block transactions connected to wallet addresses associated with the attackers.
This attribution is significant because North Korean-linked cyber groups have previously been accused of targeting cryptocurrency exchanges and blockchain companies to generate funds for the state.
TraderTraitor was also blamed for the approximately $1.5 billion theft from cryptocurrency exchange Bybit in February 2025.
The FBI’s latest announcement puts the Binance incident within a wider pattern of alleged state-sponsored cryptocurrency theft.
How Did Hackers Get Into Binance?
Binance’s initial investigation suggested that a compromised laptop belonging to a DevOps engineer may have provided attackers with access to internal infrastructure.
The attackers allegedly gained access to a service container and used it to submit unauthorised withdrawal transactions.
However, Binance later said its investigation uncovered additional points of breach. It has not yet published a complete technical explanation of how the attack unfolded.
The exchange also said it had found no evidence that wallet private keys were leaked.
This distinction matters.
A private key is the cryptographic credential that allows someone to control and transfer cryptocurrency from a wallet. If attackers steal private keys, they may gain direct control over the funds held in those wallets.
In this incident, Binance’s updates indicate that the attackers exploited weaknesses in its infrastructure and withdrawal authorisation processes rather than obtaining evidence-backed access to wallet private keys.
The full technical explanation is still pending. Binance says it will publish a post-incident report after the investigation is complete.
Why Did Binance Suspend Withdrawals in the First Place?
When a cryptocurrency exchange experiences a serious security breach, allowing withdrawals to continue without proper checks can create additional risks.
Binance temporarily suspended withdrawals to contain the incident, investigate the affected systems and verify that its withdrawal infrastructure was safe to operate.
During the suspension:
Security teams reviewed affected services.
The exchange revoked compromised authorisations.
Binance worked with law enforcement and blockchain intelligence companies.
Industry partners helped trace and freeze affected assets.
The company began purchasing replacement tokens to replenish affected balances.
Deposits and other unaffected services remained operational, according to Binance.
The decision was disruptive for customers, particularly those who needed to move their cryptocurrency into personal wallets or use funds elsewhere. However, the exchange said restoring access safely was more important than reopening withdrawals before completing the necessary checks.
What Does This Mean for Binance Customers?
The reopening of withdrawals is encouraging news, but customers should understand that the process is not necessarily complete for every cryptocurrency.
Binance is restoring services progressively. Availability depends on the specific asset and network.
If you use Binance, here are a few sensible steps:
1. Check whether your withdrawal network is available. Don’t assume every cryptocurrency has been restored simply because Bitcoin or Ethereum withdrawals are working.
2. Use official Binance channels. Check the exchange’s official announcements and network status page for updates.
3. Be careful with withdrawal delays. Binance has warned that high demand could temporarily slow down transactions during the reopening.
4. Watch out for recovery scams. Scammers often exploit major security incidents by pretending to be customer support representatives. Never share your password, two-factor authentication codes or wallet recovery phrase.
5. Review your account security. Use strong authentication, review active sessions and check any API permissions you no longer need.
For customers, the most important point is that Binance says it will cover the financial impact of the stolen assets rather than pass the losses on to users. That is the company’s commitment, not a substitute for independently verifying every aspect of the ongoing investigation.
Could This Become the Biggest Crypto Heist in History?
The estimated $6.3 billion impact makes the Binance incident extraordinary.
For comparison, the February 2025 Bybit hack involved approximately $1.5 billion in stolen cryptocurrency. That incident was already considered one of the largest crypto thefts ever reported.
The Binance figure is more than four times that amount.
However, comparisons require care: the Binance figure is the exchange’s estimated incident impact, while the amount ultimately recovered, frozen or permanently lost may change as investigations progress.
Even so, the scale highlights a serious challenge facing the cryptocurrency industry. As exchanges handle increasingly large amounts of digital assets, their security systems become attractive targets for highly organised criminal groups.
And unlike traditional bank transfers, cryptocurrency transactions can be difficult to reverse once they have been confirmed on a blockchain.
What Happens Next?
Binance has several important tasks ahead:
Complete the withdrawal restoration: Additional assets and networks must be reopened after security checks.
Replenish the remaining 5%: The exchange says less liquid tokens are taking longer to source.
Support the investigation: Binance will continue working with law enforcement and industry partners to trace stolen funds.
Publish a technical report: The company has promised a post-incident report explaining what happened once the investigation is complete.
Strengthen security: The exchange must demonstrate that the weaknesses exposed by the incident have been addressed.
The resumption of withdrawals is a major milestone, but it does not mean the entire incident has been resolved.
Frequently Asked Questions
1. Has Binance resumed withdrawals?
Yes. Binance began restoring withdrawals in phases on November 1, 2026. Some major cryptocurrencies and networks have reopened, while others are being restored progressively.
2. How much cryptocurrency was stolen from Binance?
Binance estimated the impact at approximately $6.3 billion in digital assets.
3. Has Binance replaced the stolen funds?
Binance said it had replenished approximately 95% of the affected amount using company resources. The remaining 5% consists of less liquid tokens that may take longer to source.
4. Who does the FBI blame for the Binance hack?
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored cyber unit.
5. Are Binance customer funds safe?
Binance says customer funds remain safe and that it will absorb the financial impact of the stolen assets. Customers should continue following official updates as the investigation progresses.
6. Is every Binance withdrawal available again?
No. Withdrawals are returning in phases. Users should check the availability of their specific cryptocurrency and network before making a transaction.
Final Thoughts: Binance Is Recovering, But the Security Questions Remain
Binance has taken an important step by restoring withdrawals after a security incident involving an estimated $6.3 billion.
Its reported 95% asset replenishment is also a significant development, especially for customers who were concerned about losing access to their funds.
But the bigger question is not simply whether Binance can replace the stolen cryptocurrency.
It is whether the exchange can demonstrate that its security infrastructure is strong enough to prevent another incident of this scale.
The FBI’s attribution to North Korea makes the story even more serious, highlighting how cryptocurrency platforms have become targets for sophisticated international cybercrime operations.
What do you think? Does Binance’s decision to cover the losses and resume withdrawals restore your confidence in the exchange, or has this incident changed how you view centralised crypto platforms?
Share your thoughts in the comments.
