Crypto

Binance Reopens Withdrawals After Covering 95% of Record $6.3 Billion Hack the FBI Blames on North Korea

Binance began reopening withdrawals in phases on Nov. 1 after using company funds to replace 95% of the $6.3 billion stolen in a hack the FBI blames on North Korea.

Nov 01, 2026 - 02:57

0 1

Binance, the world's largest cryptocurrency exchange, began reopening withdrawals in phases early Sunday, Nov. 1, after saying it had used company money to replace about 95% of roughly $6.3 billion in digital assets stolen from its hot wallets on Oct. 29. The FBI said on Oct. 31 that North Korea carried out the theft, which blockchain analysts describe as the largest crypto heist on record.

"We've now replenished approximately 95% of the impacted assets," co-CEO Richard Teng said on X at 0511 GMT on Sunday. Shortly after 0600 GMT, Binance said on its status page that the planned withdrawals had begun, Reuters reported. Withdrawals had been halted for more than two days, according to Bloomberg.

Withdrawals return in phases

The first phase covers 15 cryptoassets, including bitcoin, ether, XRP, dogecoin and the stablecoins USDT and USDC, according to Reuters and Bloomberg. "First batch network now opened in phase one of withdrawals is $BTC bitcoin network," Binance said in a post on X, AFP reported. The exchange said it ranked tokens for reopening based on user demand over the past week.

Binance says the replacement tokens, worth about $6 billion, were bought with its own money rather than recovered from the attackers. The funds came from its $1 billion Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. Co-CEO Yi He said half of SAFU would be used and that the fund would be refilled to about $1 billion. The remaining 5% consists of less liquid tokens that may take longer to source, Binance said.

"Our users will not bear the financial impact of this incident," Teng said on X on Oct. 31, according to Reuters.

How the attack unfolded

According to blockchain records cited by Reuters, most of the theft took place in about 20 minutes, starting shortly after 2000 GMT on Oct. 29. The attackers drained hot wallets, which are internet-connected wallets Binance uses to process transactions.

Teng has described a "complex attack" that began with a compromised engineer's laptop and used malware designed to delete evidence of its activity. "That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions," he said in a statement reported by the BBC. CoinDesk reported that the attackers also used Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without Binance's normal approval steps. Blockchain analytics firm TRM Labs said the attackers compromised Binance's "signing infrastructure," the system that authorizes transactions.

Teng has said the attack targeted Binance's own hot wallet rather than customer funds. However, CoinDesk reported that the compromised wallets had previously appeared on Binance's list of assets backing customer balances.

Freezes and attribution

About $3 billion of the stolen assets had been located as of Friday, Reuters reported. About half of the stolen assets were stablecoins, which their issuers can freeze remotely. Tether said it froze nearly $1.57 billion and Circle more than $800 million; Ripple and World Liberty Financial also froze funds. TRM Labs estimated that about $2.4 billion in bitcoin and ether, which no issuer can freeze, remains out of reach.

The FBI said in a public alert that North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance "on or about October 29, 2026." It attributed the attack to activity it calls "TraderTraitor," the same group it blamed for the $1.5 billion theft from the Bybit exchange in February 2025. Cybersecurity firm Check Point says the group is also known as Lazarus Group. The FBI asked exchanges, DeFi services and node operators to block transactions linked to a list of laundering addresses it published. TRM Labs and Chainalysis had earlier tied the attack to North Korea.

North Korea has denied involvement in past hacks.

The scale of the Binance theft dwarfs earlier totals. TRM Labs counted $2.9 billion stolen across nearly 150 crypto attacks last year.

Market and regulatory reaction

Crypto prices fell after the hack but steadied. According to Reuters, bitcoin hit a six-week low of $76,368 and ether a two-month low of $2,178 last week.

Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating license, said it is "engaging closely with Binance and monitoring the incident." Asked on Oct. 30 whether North Korea was responsible, President Donald Trump said he did not know and that his administration was looking into it.

This report was first flagged by The Straits Times (@straits_times) on Instagram.