Binance reopens withdrawals as FBI blames North Korea for $6.3 billion hack

Withdrawals are flowing again, the FBI has named North Korea, and Binance says it has replaced 95% of the stolen tokens.

Binance reopened withdrawals on Sunday 1 November, three days after attackers drained about $6.3 billion from its hot wallets in the largest cryptocurrency theft on record.

The exchange said it processed $4.65 billion in withdrawals and $1.01 billion in deposits in the first nine and a half hours, a net outflow of about $3.64 billion, or 2.1% of its assets under management (Binance on X).

The same weekend, the FBI said North Korea was responsible for the theft, confirming the attribution blockchain analytics firms made within hours of the attack (CBS News).

Withdrawals reopen in phases

Binance began restoring withdrawals at 06:00 UTC on 1 November, starting with the Bitcoin network. By 12:36 UTC, all 15 networks in the first phase were live, including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, the XRP Ledger, Dogecoin, Polygon, Avalanche, Arbitrum, Base, Optimism, TON, Sui and Zcash (Cointribune).

The exchange said withdrawal volumes spiked at first and then declined, while deposits remained substantial. It put its total assets under management at $171 billion, based on proof-of-reserves data from 28 October, the day before the attack.

Binance had warned users to expect delays and longer processing times because of traffic. "Resuming withdrawals is a major milestone, but our work continues," the company said (TechCrunch).

Fiat withdrawals for several currencies reopened on Monday 2 November. A second phase began at 04:00 UTC today, Tuesday 3 November, adding more assets on networks including BNB Smart Chain, Ethereum, Solana, the XRP Ledger, Sui, Arbitrum, Optimism, Tron and Base. Binance said it would again roll out progressively as security and readiness checks are completed, with the order shaped by user demand.

The exchange also warned that scammers may target users waiting for funds. "Anyone promising to expedite it for a fee is scamming you," Binance said (Crypto Breaking).

Proof of reserves covers 10 tokens

On Monday 2 November, a day earlier than it had estimated, Binance published a zero-knowledge proof of reserves for a snapshot taken at 00:00 UTC on 31 October. It said the proof shows customer balances in ten tokens are backed at least 1:1: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC (crypto.news).

The system combines Merkle trees, which let a user confirm their balance was included in the snapshot, with zk-SNARK proofs that show reserves cover those balances without revealing individual accounts. Users can check their own balances with an open-source verification tool, which Binance said has been independently audited.

Binance said it has now replaced about 95% of the stolen assets, up from 80% on 30 October and 90% on 31 October. The remaining 5% consists of less liquid tokens outside the ten covered by the proof, which the exchange is still buying through markets, OTC deals and industry partners.

The replacement was funded from the SAFU emergency fund, part of Binance's futures insurance fund and corporate treasury. Binance said it will restore SAFU to about $1 billion.

A second snapshot covering more tokens is planned for Wednesday 4 November, with the proof expected to take 40 to 50 hours to generate. Analysts have noted that a proof of reserves is a point-in-time snapshot rather than a full audit, and cannot on its own guarantee an exchange's solvency or security (Cryptopolitan).

FBI names North Korea; Pyongyang denies it

On Saturday 31 October, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance, and identified the activity as TraderTraitor, the same designation it used for the February 2025 Bybit hack (FBI). The attribution matches the assessments TRM Labs and Chainalysis published within hours of the attack.

Working with the US Secret Service and IRS Criminal Investigation, the FBI said it had observed the attackers converting stolen assets mainly into ether, and expects further laundering through DeFi platforms and instant swap services (BleepingComputer). The bureau published a list of addresses linked to the theft and urged node operators, instant exchanges, DeFi services, analytics firms and other virtual asset providers to block transactions connected to them.

North Korea rejected the accusation. In a statement carried by state news agency KCNA, Kim Yo Jong, the sister of leader Kim Jong Un, called the US claim "absurd rhetoric and nothing new" and warned that Pyongyang had unspecified issues to reconsider over US hostility (France 24). She also suggested, without evidence, that the US itself could be behind the theft (Cointelegraph).

Binance has not yet published its technical post-mortem. Co-CEO Richard Teng has described a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity, and the exchange has said it found no evidence that wallet private keys were exposed (NBC News).

Where the stolen funds are now

Blockchain analytics firm Elliptic, which counts $6.43 billion stolen across 11 blockchains, said $2.85 billion, or 44%, has been frozen or seized, almost all of it stablecoins. That is unusually high: after the Bybit hack, around 3% was frozen (Elliptic).

About $3.24 billion remains in addresses linked to the theft, mostly ETH and BTC, and Elliptic said these funds are very likely still held by North Korea. The 18,270 stolen BTC was split into 19 addresses on the night of the attack and has not moved since. The nine largest Ethereum addresses, holding 89% of the attacker's ETH, have been dormant since 30 October.

The laundering that has taken place is heavily automated. In under four days it used about 12,000 wallets and more than 40,000 transactions. Most of it ran through Tron, where 684.6 million TRX was split across about 7,700 addresses and bridged to Ethereum. "The Binance funds are being moved by something that does not sleep," Elliptic said, contrasting it with the human working patterns seen after Bybit (Elliptic). The firm said the evidence points to conventional scripts rather than AI agents.

New routes have opened since the weekend. On 1 November, about 28 BTC ($2.2 million) went through coinjoin mixing, the first time any of the funds have been mixed. On 2 November, all 233 million stolen XRP moved to six new addresses for the first time.

On-chain analyst SomaXBT estimated that about $242 million was laundered off Tron in two days through cross-chain services including Relay, THORChain, Chainflip and Symbiosis (The Block). THORChain has not said whether its node operators will block the addresses listed by the FBI. Swaps on THORChain were separately paused after an Ethereum block reorganisation, which Chainalysis said inadvertently delayed laundering of a significant amount of the stolen funds (Gizmodo).

Elliptic said only a negligible amount appears to have been cashed out so far. Based on the Bybit case, it expects the attacker to swap ETH for bitcoin in many small transactions and cash out through over-the-counter brokers over a period of months.

Markets steady; regulators move

Markets have steadied since last week's sell-off. Bitcoin recovered above $77,000 by Monday after hitting a six-week low, and ether rebounded from a two-month low (Cryptopolitan).

In South Korea, the Financial Services Commission held an emergency meeting on Monday 2 November with financial watchdogs, the exchange alliance DAXA and major platforms including Upbit, Bithumb and Coinone. It reviewed IT access controls, withdrawal approval and signing procedures, and administrator privileges (Cointelegraph).

The regulator urged exchanges to hold more assets in offline cold wallets, above the 80% minimum already required under South Korean law, and to set aside additional reserves, monitor deposits and withdrawals continuously, add incident-response staff and share information on abnormal access attempts faster. A second meeting with government ministries and the heads of the country's five largest banks is scheduled for Thursday 5 November (Bloomingbit).

Background

On the evening of 29 October, attackers drained Binance hot wallets across multiple blockchains, moving most of the funds in about 20 minutes from 20:05 UTC. Binance puts the loss at about $6.3 billion. TRM Labs counts $6.36 billion across ten blockchains and Elliptic $6.43 billion across 11, with the differences reflecting how each firm values and counts the transfers.

Binance's preliminary findings point to a DevOps engineer's compromised laptop as the entry point. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, and TRM Labs assessed that the attacker had gained access to Binance's hot wallet signing infrastructure across chains (TRM Labs).

The theft is more than four times the previous record, the $1.5 billion stolen from Bybit in February 2025, which the FBI also attributed to TraderTraitor.

This is a developing story. Figures reflect information available as of 3 November 2026 and may change as investigations continue.