Binance customers can start taking money out of the exchange again. On Sunday, November 1, Binance began a step-by-step restart of withdrawals, with Bitcoin first, three days after the record hack of Thursday, October 29. A day earlier, the FBI officially said that North Korea was behind the attack.
Key facts
- Withdrawals: The first phase started shortly after 6:00 GMT on Sunday (about 1:00 a.m. ET) and covers 15 cryptocurrencies, including Bitcoin, ether, BNB, Solana, XRP and dogecoin. Other coins will follow in later phases. Binance has not given dates for them.
- Deposits stayed open the whole time.
- Losses covered: Binance says it has replaced about 95% of the roughly $6.3 billion that was stolen, by buying the same tokens with its own money. The last 5% is made up of smaller, less-traded tokens that take longer to buy.
- Where the money came from: its SAFU emergency fund for users (about $1 billion), a Bitcoin reserve, part of its futures insurance fund and its company treasury.
The FBI names the attackers
On Saturday, October 31, the FBI said North Korea stole more than $6 billion in crypto from Binance. It blamed a North Korean state hacking unit it calls TraderTraitor, the same group it blamed for the $1.5 billion Bybit theft in February 2025. Private investigators TRM Labs and Chainalysis had already pointed to the same group.
The FBI said the hackers have mostly turned the stolen coins into ether and expects them to keep moving the money through swap services and DeFi apps to hide its trail. It published a list of wallet addresses linked to the theft (more than 600 on Ethereum, just under 20 on Bitcoin and one on Solana) and asked exchanges, DeFi services, node operators and blockchain analysis firms to block any transactions coming from them.
Why it matters
Reopening withdrawals is the moment that shows whether Binance can really cover the biggest crypto theft on record without customers losing money. A smooth restart over the next few days would ease fears that spread across the market after the hack. The FBI’s address list makes it harder for the hackers to cash out, but investigators say they have already spread the money across thousands of wallets, so much of it may never be recovered. Customers should use only Binance’s official app and website, and ignore messages offering “priority withdrawal” or “account check” links: scammers often use moments like this.
This article is for information only and is not financial advice.
