Crypto
Binance Sets Withdrawal Restart as FBI Names North Korea
Binance planned to reopen withdrawals in phases from 06:00 GMT on Sunday after covering about 95% of its $6.3 billion hack, Reuters reported. The FBI blamed North Korea's TraderTraitor unit.
Three days after the largest crypto theft on record, Binance customers were due to get their coins back within reach. The exchange said the first phase of its withdrawal restart would run between 14:00 and 17:00 Beijing time on Sunday, November 1, or 06:00 to 09:00 GMT, and would cover bitcoin, ether, BNB, Tron, Solana, XRP, Zcash, dogecoin, Toncoin, Polygon, Avalanche and Sui, plus networks such as Arbitrum, Base and Optimism. Binance said assets and networks were ordered by recent customer demand and warned that some users might see delays or failed withdrawals in the first hours.
The order of events in the past day explains why it felt ready. On Saturday Binance said it had covered up to 90% of the roughly $6.3 billion of tokens taken from its hot wallets, and that bitcoin, ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash were "fully backed 100%", CNBC reported. By Sunday morning Reuters put the coverage at 95%; the remainder is mostly smaller, less liquid tokens that Binance said "may take longer to source in the required amounts" and that it keeps buying through the market and over-the-counter desks. The money comes from part of its SAFU emergency fund, part of its futures insurance fund and its corporate treasury. Coverage is not recovery: the stolen coins are still in the attacker's hands, apart from the roughly $3 billion frozen on chain.
Late on Saturday the FBI named the attacker. It attributed the theft to TraderTraitor, a North Korean state-sponsored hacking unit, and said its members had been converting the stolen assets into ether, with "further laundering" expected. The blockchain analytics firm TRM Labs had pointed to North Korea earlier and noted similarities with the Bybit theft of February 2025 and the KelpDAO hack of April 2026. Binance's own account has also moved on from the compromised engineer's laptop it first described: co-chief executive Richard Teng has said the attack was more complex than the misuse of one person's permissions.
The market spent the waiting period remarkably still. On Binance, bitcoin traded between $77,114.01 and $77,796.01 on Saturday, a range of less than 1%, and closed the day at $77,582.02. That close sealed October as a losing month: bitcoin fell 7.22% from $83,623.59, its first monthly decline after gains of 24.95% in August and 6.42% in September. Ether ended October at $2,255.66, down 16.02%, and BNB at $703.95, down 8.49%. In the first hour of the withdrawal window bitcoin edged up to $78,055.
The next checkpoint is Monday, November 2, when Binance has promised a new proof of reserves. That snapshot, taken after the theft and the replacement buying, will show coin by coin whether the exchange holds at least what customers are owed, which matters more than any percentage quoted while withdrawals were shut. A smooth reopening followed by a clean reserve report would close the incident for most users; a slow queue, or reserves that come in thin on the smaller tokens still being sourced, would keep it open.