# Binance resumes withdrawals after $6.3B North Korea hack

URL: https://techaiwire.com/articles/binance-6-3-billion-hack-withdrawals-resume-fbi-north-korea/

_By Tech AI Wire Team - Nov 1, 2026_

**By the numbers:**

- $6.3B - taken from Binance hot wallets, by Binance's own estimate
- 95% - of the stolen assets Binance says it had covered by Sunday
- ~$3B - frozen, mostly USDT and USDC, per CoinDesk
- Nov 3 - target date for the full proof-of-reserves report

Binance reopened cryptocurrency withdrawals in phases on November 1, 2026, three days after about $6.3 billion was taken from its hot wallets. The FBI said late on October 31 that North Korea was responsible, [CNBC reports](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html). For anyone with funds on the exchange, the questions now are when their network reopens and how Binance is covering the gap.

## What was stolen

The theft was announced on Thursday, October 29, and hit the hot wallets Binance uses for routine payouts, according to [CoinDesk](https://www.coindesk.com/markets/2026/11/01/binance-opens-crypto-withdrawals-in-phases-starting-with-bitcoin-following-usd6-3-billion-hack). A hot wallet is one kept connected to the internet so withdrawals can be paid out quickly. Binance puts the loss at about $6.3 billion.

Blockchain analytics firm TRM Labs broke the outflow down by asset, CoinDesk reports:

| Asset | Amount taken, per TRM Labs |
| --- | --- |
| Bitcoin (BTC) | 18,270 BTC, about $1.47 billion |
| Ether (ETH) | 200,630 ETH |
| Tether (USDT) on Ethereum | 1.875 billion USDT |
| USD Coin (USDC) on Ethereum | 823 million USDC |
| XRP | 233.46 million XRP |
| Solana (SOL) | 970,500 SOL |

Binance first blamed "a compromised DevOps engineer's laptop," CNBC reports. Co-CEO Richard Teng later said the attack was more complex than the misuse of one engineer's permissions. The company has not yet explained how the attackers got from there to the wallets. TechCrunch says Binance will publish a more detailed incident report when its investigation ends.

## The FBI's attribution

The FBI said on Saturday that a North Korean group known as TraderTraitor was responsible, TechCrunch reports. The stolen assets were converted mainly into Ethereum, and the FBI expects "further laundering stages," according to CNBC. Blockchain analytics firms had already linked the attack to TraderTraitor before the FBI spoke, CoinDesk says. "Several features of this attack match earlier North Korea-linked heists," TRM Labs said.

Not all of the money is still moving. About $3 billion is frozen, mostly in USDT and USDC, CoinDesk reports. The companies that issue those stablecoins can block tokens at specific addresses. Bitcoin and Ether have no issuer and cannot be frozen the same way.

North Korea's activity against US technology companies was already in the news this fall. In October, the Justice Department [charged 14 people over North Korean remote IT workers](/articles/north-korean-it-workers-70-us-companies-laptop-farms/) hired by more than 70 US companies.

## How withdrawals are coming back

Phase one ran from 06:00 to 09:00 UTC on November 1, CoinDesk reports. Bitcoin, Ether, USDT, USDC, BNB and XRP reopened first, along with assets on 15 other blockchains. Binance prioritized the networks with the most withdrawal requests, and each chain must pass security and stability checks before it reopens.

The outlets describe the order slightly differently. CNBC says Bitcoin opened first, with Ethereum and BNB Smart Chain restored later in the day. CoinDesk lists six assets in the first window. On Sunday morning US time, TechCrunch found Bitcoin deposits and withdrawals still partly suspended. Ethereum deposits were normal, while Ethereum withdrawals were partly suspended.

Binance has not given a date for the remaining networks. "Resuming withdrawals is a major milestone, but our work continues," the company said, per TechCrunch.

## How Binance is covering the losses

Binance says it will absorb the loss itself. "Binance will absorb the financial impact of these stolen funds, not our users," the company wrote in its [third recovery update](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62) on October 31. That update put coverage at 90% of the stolen assets, up from about 80% in the update before. By Sunday the figure was about 95%, CoinDesk and TechCrunch report.

"Covered" has a precise meaning here. Binance has restored the backing for customer balances with its own money. It does not mean the stolen funds came back.

The money comes from three places, the update says. One is part of the Secure Asset Fund for Users (SAFU), Binance's emergency reserve for breaches. The others are a portion of its Futures insurance fund and corporate treasury. Binance says it will restore SAFU to about $1 billion afterwards. The previous update said the company had committed more than $6.34 billion of its own funds.

Ten major tokens are now fully backed, CNBC reports: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining share, about 5% as of Sunday, sits in tokens outside the top ten that Binance calls "less liquid." It is still buying those through market and over-the-counter channels. A proof-of-reserves snapshot taken at 00:00 UTC on October 31 is posted. The full zero-knowledge proof-of-reserves report is expected on November 3, 2026.

## What this means for developers

- **If you hold funds there, check your network before you send.** Withdrawals are opening chain by chain, and Binance has given no date for the last ones. Phase one took three hours for six assets. Expect the long tail of smaller tokens to take days.
- **One laptop was the first story.** Binance's initial explanation was a compromised DevOps engineer's machine. Teng says the full picture is more complex, but the lesson for any team running signing infrastructure holds. A developer endpoint with production access is a target, and moving money from a hot wallet should take more than one machine's credentials.
- **Stablecoins can be frozen. Coins cannot.** About $3 billion stopped moving because the USDT and USDC issuers can block addresses. Teams choosing a settlement asset should understand that property. It protects victims, and it also means a third party can freeze your funds.
- **Watch November 3.** The full proof-of-reserves report is the first thing outsiders can check for themselves. The incident report has no date. Until it ships, nobody outside Binance knows how the attackers moved from one engineer's laptop to the hot wallets.
- **Expect a long laundering trail.** The FBI expects further conversion stages, CNBC reports. The addresses involved are likely to stay on exchange and analytics watch lists for months, so any service that touches those funds should expect questions.

## Sources

- [Security Incident | Recovery Update #3: 90% of Stolen Assets Replenished; Proof of Reserves Snapshot Provided](https://www.binance.com/en/support/announcement/detail/1fdf1f61559c401da0435895ffcccb62) - Binance
- [Binance resumes withdrawals following $6.3 billion hack, says 90% of stolen user assets are covered](https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html) - CNBC
- [Binance opens crypto withdrawals in phases starting with bitcoin following $6.3 billion hack](https://www.coindesk.com/markets/2026/11/01/binance-opens-crypto-withdrawals-in-phases-starting-with-bitcoin-following-usd6-3-billion-hack) - CoinDesk
- [Binance resumes withdrawals following $6.3 billion breach](https://techcrunch.com/2026/11/01/binance-resumes-withdrawals-following-6-3-billion-breach/) - TechCrunch