Binance reopens withdrawals as the FBI blames North Korea for the $6 billion hack

The skim

• Binance began reopening withdrawals on Sunday, Nov. 1, in phases. Bitcoin went first, followed by networks including Ethereum, BNB Smart Chain, XRP and Base.
• The FBI says North Korea's TraderTraitor hackers stole more than $6 billion, and it published hundreds of wallet addresses it wants crypto businesses to block.
• Binance now says it has replaced about 95% of what was taken, up from 90% on Saturday. The stolen crypto itself is still mostly in the attackers' hands.

What happened

Three days after the largest crypto theft on record, Binance customers can start moving money out again. "First batch network now opened in phase one of withdrawals is $BTC bitcoin network," the exchange posted on X early Sunday, as quoted by AFP. It later restored withdrawals on the Ethereum network and BNB Smart Chain, CNBC reports. By 5 a.m. Eastern, Binance listed Bitcoin, Ethereum, BNB, XRP, Base, Dogecoin and Optimism as open, according to CBS News.

The restart is deliberately slow. Phase one began in a 06:00 to 09:00 UTC window, and Binance said it is "prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully." More networks open only after they pass security and stability checks. Binance also told users to expect delays and to retry after a short wait if a withdrawal fails, Al Jazeera reports.

The coverage number moved too. On Saturday Binance said it had replenished 90% of the roughly $6.3 billion stolen. On Sunday it put the figure at about 95%. "Binance will absorb the financial impact of the stolen funds, not our users," the company said.

The FBI names North Korea

Late Saturday, the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance on or about Oct. 29, activity it tracks as "TraderTraitor." Working with the Secret Service and IRS Criminal Investigation, the bureau says the hackers are converting the loot mainly into ether and expects them to keep laundering it through DeFi and instant swap services.

The alert lists more than 600 Ethereum addresses and 19 Bitcoin addresses tied to the theft, and asks THORNode operators, RPC providers, instant exchanges, DeFi services and analytics firms to block transactions involving them. The FBI has blamed the same unit for the $1.5 billion Bybit hack in 2025, which held the record until last week, The Business Times notes. Blockchain firms TRM Labs and Chainalysis had already pointed at North Korea; the FBI's statement makes it official.

Why it matters

Reopening withdrawals is the real test of Binance's promise that customers won't pay for the hack. Saying balances are fully backed is one thing; letting users pull coins out all at once is another. Crypto prices fell sharply on Friday after the hack. A smooth restart would help calm that. A messy one would revive questions about whether the backing is as solid as Binance says.

The FBI's address list matters for everyone else in crypto. Exchanges and swap services that ignore it risk handling stolen funds, and the faster those addresses are blocked, the harder it gets for North Korea to cash out. Binance said Friday that about $3 billion had already been frozen with help from partners.

What's next

Watch two things. Binance hasn't said how long the remaining phases will take, so expect network-by-network updates on its X account. And the exchange has said a full proof of reserves, letting users check their own balances, is expected around Tuesday, Nov. 3. How the attackers got in is still not public: Binance first blamed a compromised DevOps engineer's laptop, then co-CEO Richard Teng said it was a more complex attack. If you hold funds on Binance, check the withdrawal page for your exact coin and network before sending, and be patient with the queue.

Sources: FBI, CNBC, CBS News, AFP, Al Jazeera and The Business Times.