Business
Binance Reopens Withdrawals After the $6.3 Billion Hack the FBI Blamed on North Korea
Customers pulled out a net $3.6 billion in the first nine and a half hours. Binance says it has replaced 95% of the stolen crypto with its own money and that users will not bear the loss.
Washington · Priya Shah, Business · Nov 2 2026
WASHINGTON - Binance customers can take their money out again, three days after the largest crypto theft on record. The exchange began restoring withdrawals in phases at 06:00 UTC on Sunday, and by 12:36 UTC it had reopened all 15 networks and assets in the first phase, including bitcoin, ether, BNB, XRP and solana, along with the stablecoins USDT and USDC.
Binance froze deposits and withdrawals after hackers stole about $6.3 billion in digital assets from its hot wallets. On Saturday, the FBI said North Korea was responsible. “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the bureau said. It attributed the attack to a group it calls TraderTraitor and said it had seen the hackers converting stolen assets into ether, which it expects to be “further laundered by converting them using DeFi and instant swap services.”
Screenshot: @binance on X
Customers did move money out, but there was no stampede. Between 06:00 and 15:30 UTC on Sunday, Binance processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion, or 2.1% of the assets it holds, TechCrunch reported, citing the exchange. Binance said withdrawal volumes fell after an initial spike. “98% choose to stay!” founder Changpeng Zhao wrote on X.
The money to cover the theft is coming from Binance itself. Co-CEO Richard Teng said on Saturday that the company had replaced 90% of the stolen assets by buying new tokens, and on Sunday Binance put the figure at 95%. The rest are tokens that are “less liquid in the market and take longer time to source at the required scale,” it said. “Binance will bear the financial impact of the stolen funds,” the exchange added. “These losses will not be passed on to users.” Reuters reported that Binance had set aside about $6.34 billion in company funds, drawing on its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund and its corporate treasury.
Screenshot: @binance on X
The reopening continued on Monday. At 08:00 UTC, Binance said fiat withdrawals were available in U.S. dollars, UAE dirhams, Vietnamese dong, Philippine pesos and Indonesian rupiah, adding to more than 20 currencies already restored, including the euro, yen and Brazilian real. Some crypto networks were still only partly open on Sunday, according to TechCrunch, and Binance has warned of delays while traffic is heavy. It now sends all withdrawals from newly generated wallet addresses, which it added to its proof-of-reserves list.
How the attackers got in is still not fully public. Teng said on Friday that it was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, Reuters reported. TraderTraitor has been tied to crypto thefts since at least 2020, according to the U.S. Cybersecurity and Infrastructure Security Agency, and is believed to be part of North Korea’s Lazarus Group. Binance has said it will publish a more detailed incident report when its investigation is complete.