Binance reopened withdrawals after a $6.3 billion theft the FBI blames on North Korea, and customers pulled out $3.6 billion on the first day
The exchange says it has bought back 90% of the stolen tokens with its own money. The rest are harder to source, and only some coins and networks were reopened at first.
Key takeaways
- The FBI said on October 31 that North Korea was responsible for the theft on or about October 29.
- Withdrawals restarted in phases on November 1, beginning with bitcoin, ether, BNB and XRP.
- Binance said it set aside more than $6.34 billion and replaced 90% of the stolen assets.
The cryptocurrency exchange Binance began letting customers withdraw funds again on Sunday, November 1, after hackers took about $6.3 billion from it late on October 29. The blockchain analytics firm Elliptic called it "almost certainly the single largest known theft of any kind," Reuters reported in a story carried by the Honolulu Star-Advertiser.
Who does the FBI say did it?
On October 31 the FBI said North Korea was responsible and named a hacking operation it calls TraderTraitor, the same group it blamed for the $1.5 billion Bybit theft in February 2025, CBS News reported. The bureau said it had seen the stolen assets being converted into ether and expected more laundering through decentralized finance and instant-swap services. Binance co-CEO Richard Teng described a complex attack involving a compromised laptop and malware built to erase evidence, in which the attackers manipulated the system that approves transfers out of an internet-connected hot wallet.
What did customers see when withdrawals reopened?
The first phase restored withdrawals for bitcoin, ether, BNB, XRP and Dogecoin and for the Base and Optimism networks, with other assets to follow as security checks finish. Between 06:00 and 15:30 GMT on November 1, Binance processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of $3.64 billion, or about 2.1% of the assets it manages, Euronews reported. The company said it had set aside more than $6.34 billion of its own funds and had already bought tokens to replace 90% of what was stolen. It said the remaining 10% is in less liquid assets that will take longer to source.
What happens next
Stablecoin issuers froze about half of the stolen value, including nearly $1.57 billion by Tether and more than $800 million by Circle, according to Reuters. Watch for the rest of the asset restorations and for any recoveries. Our explainer on exchange hacks and crypto custody covers what holders can check.
Sources
- Honolulu Star-Advertiser (Reuters), “North Korean hackers blamed for $6.3B heist from crypto firm Binance,” October 30, 2026
- CBS News, “Binance resumes withdrawals for some major cryptocurrencies after $6 billion heist,” November 1, 2026
- Euronews, “Binance resumes withdrawals after billions stolen in hack,” November 2, 2026
Written by Action Global News from the sources above; quotations are attributed to the outlet that published them. See our editorial standards and corrections policy.
Frequently asked
Can Binance customers withdraw their crypto now?
Binance began restoring withdrawals in phases on November 1, 2026, starting with bitcoin, ether, BNB, XRP and Dogecoin; other assets follow as security checks finish.
Who hacked Binance?
The FBI said on October 31, 2026 that North Korea was responsible, naming the TraderTraitor operation.