Binance Resumes Withdrawals After $6.3 Billion Cryptocurrency Hack Linked to North Korea
Cryptocurrency exchange Binance has begun restoring customer withdrawals following a massive cyberattack that resulted in the theft of approximately $6.3 billion in digital assets, marking one of the most consequential security incidents in the history of the cryptocurrency industry. The company temporarily suspended deposits and withdrawals while investigating the breach, securing affected systems, and implementing measures intended to prevent further losses.
On November 1, 2026, Binance announced that withdrawals would resume gradually, with availability determined by the blockchain network and cryptocurrency involved. The exchange said it had already covered approximately 95% of the stolen assets and was continuing efforts to acquire the remaining cryptocurrencies needed to complete its recovery commitments. Binance also pledged to absorb the financial impact of the attack rather than transfer the losses to its customers.
The incident has attracted significant attention from United States law enforcement. The Federal Bureau of Investigation attributed the theft to TraderTraitor, a North Korean cybercriminal operation associated with cryptocurrency theft and sophisticated financial attacks. According to the FBI, the perpetrators were converting stolen assets primarily into Ethereum, a step that could facilitate subsequent laundering through the cryptocurrency ecosystem.
The reopening of withdrawals represents an important milestone for Binance, but it does not signal the conclusion of the investigation or recovery process. The exchange continues to face questions about the security failures that enabled the theft, the management of customer assets, and the broader implications of an attack capable of extracting billions of dollars from a major cryptocurrency platform.
Binance Restores Withdrawals Through a Phased Recovery Process
Binance initially suspended all deposits and withdrawals following the discovery of unauthorized transfers from its cryptocurrency wallets. The temporary restrictions were intended to contain the incident, assess the extent of the losses, and allow security teams to evaluate the safety of the exchange's remaining infrastructure before reopening access to customer funds.
The company acknowledged that suspending withdrawals was a significant decision because customers depend on reliable access to their assets. However, Binance maintained that the restrictions were necessary to protect the platform while investigators determined which systems and funds had been affected.
When withdrawals resumed on November 1, access was restored incrementally rather than simultaneously across all supported cryptocurrencies. The exchange explained that the availability of withdrawals depended on the specific blockchain network and asset type, reflecting the operational complexity of restoring services after a major security incident.
During the initial recovery period, some services remained restricted. Bitcoin deposits and withdrawals were listed as partially suspended, while Ethereum deposits had returned to normal even though Ethereum withdrawals were still subject to partial restrictions. This uneven restoration reflected the exchange's effort to balance customer access with the security checks required for different blockchain networks.
Binance also warned that customers could experience temporary delays or longer processing times because of increased transaction volumes. Following an extended withdrawal suspension, accumulated customer requests can create operational pressure as users attempt to transfer assets that were previously inaccessible.
The company indicated that reopening withdrawals was only one stage of its recovery strategy. Security improvements, asset replacement, forensic investigation, and additional public disclosures would continue after services became available.
$4.6 Billion Withdrawn During the Initial Reopening Period
The first hours after withdrawals resumed provided an important indication of how customers responded to the incident. Binance reported processing approximately $4.6 billion in withdrawals between 06:00 and 15:30 UTC on November 1, alongside roughly $1 billion in deposits during the same period.
<text color="secondary">Reported transaction activity during the initial reopening window</text>
Metric
Amount
Customer withdrawals
$4.6 billion
Customer deposits
$1.0 billion
Net outflow
$3.6 billion
Net outflow as share of assets under management
2.1%
The resulting net outflow of $3.6 billion represented approximately 2.1% of Binance's total assets under management, according to the company's figures. Although the volume of withdrawals was substantial, the percentage provides additional context about the scale of customer departures relative to the exchange's overall asset base.
The figures suggest that a significant number of customers sought to move funds after access was restored, while other users continued depositing assets despite the breach. These transactions do not establish the motivations of individual customers, but they illustrate the importance of withdrawal access and liquidity during a major cryptocurrency security incident.
For centralized exchanges, the ability to process customer withdrawals after a cyberattack is a critical operational test. Users generally cannot independently access assets held in custodial wallets and must rely on the platform to authorize and complete transfers. Any extended restriction can therefore raise concerns about liquidity, solvency, or the availability of customer funds, even when the company maintains that losses will be covered.
Binance's reported processing of billions of dollars in transactions during the initial reopening period demonstrated that substantial withdrawal activity had resumed. However, the company had not yet restored every asset and network to unrestricted operation, and the figures alone do not provide a complete assessment of the exchange's financial position.
Binance Says 95% of Stolen Assets Have Been Covered
One of Binance's central commitments following the attack has been to replace the stolen assets without imposing the financial losses on customers. In its November 1 update, the company stated that it had already covered approximately 95% of the affected assets and was working to obtain the remaining cryptocurrencies.
The exchange explained that the outstanding assets were less liquid, making them more difficult to acquire in the quantities required. Unlike highly traded cryptocurrencies, which can generally be purchased across numerous exchanges and trading venues, less liquid tokens may have limited market depth. Attempting to purchase large quantities over a short period can significantly affect prices or make it difficult to complete transactions efficiently.
This distinction matters because replacing stolen cryptocurrency is not necessarily equivalent to transferring a fixed amount of dollars into a reserve account. If an exchange needs to restore specific digital assets, it may have to acquire those tokens directly, potentially exposing itself to price fluctuations, liquidity constraints, and execution costs.
Binance's commitment to absorb the losses represents an important attempt to preserve customer confidence. However, the statement should be distinguished from an independently verified assessment of the exchange's reserves or the completion of all recovery activities. The company reported substantial progress but acknowledged that additional work remained.
The financial scale of the incident is extraordinary. A $6.3 billion theft would exceed the losses associated with many previously reported cryptocurrency exchange compromises, demonstrating the enormous concentration of digital assets held by major custodial platforms.
For customers, the immediate concern is whether their balances remain accessible and whether withdrawals can be completed. For regulators and the wider industry, the incident raises broader questions about custody arrangements, operational controls, security governance, and the financial resources necessary to absorb catastrophic losses.
FBI Attributes the Attack to North Korea's TraderTraitor Operation
The investigation has also brought renewed attention to North Korea's involvement in cryptocurrency theft. On October 31, the FBI publicly attributed the Binance attack to TraderTraitor, a North Korean threat group associated with operations targeting digital asset businesses and financial infrastructure.
According to the bureau, the attackers were converting stolen cryptocurrency primarily into Ethereum, with additional laundering activity considered likely. Such conversion can form part of a broader strategy to move assets across different blockchain ecosystems and make subsequent tracing or recovery more complicated.
Cryptocurrency transactions are recorded on public blockchains, but identifying the individuals or organizations controlling particular wallets can be difficult. Investigators frequently analyze transaction patterns, exchange interactions, and transfers between blockchain networks to establish how stolen funds move after an attack.
The conversion of stolen assets into Ethereum does not, by itself, make those funds untraceable. However, subsequent transfers through multiple wallets, decentralized financial services, or other intermediaries can increase the complexity of blockchain investigations.
North Korean cyber operations have repeatedly targeted cryptocurrency companies because digital assets can be transferred internationally and may offer opportunities to obtain substantial financial resources. These campaigns have included attacks against exchanges, blockchain infrastructure, cryptocurrency developers, and organizations responsible for managing large pools of digital assets.
The FBI's attribution gives the Binance incident a geopolitical dimension beyond conventional financial cybercrime. It connects the theft to a broader pattern of state-linked operations targeting digital asset infrastructure, although the specific technical method used to compromise Binance has not yet been fully described in the publicly available reporting.
How the Attackers Breached Binance Remains Unclear
Despite the scale of the theft and the attribution to TraderTraitor, important technical details remain unresolved. Binance has not yet published a comprehensive forensic account explaining precisely how the attackers gained access to the affected wallets or which security controls were bypassed.
This uncertainty is significant because cryptocurrency thefts can originate from several different types of weaknesses. Attackers may target private keys, compromise privileged accounts, exploit vulnerabilities in wallet-management software, or manipulate transaction approval processes. Each scenario presents different implications for the security of an exchange's infrastructure.
Attributing the attack to a known threat group does not establish which technique was used in this particular incident. Without additional forensic evidence, it would be premature to conclude that the attackers exploited a specific software vulnerability, compromised an employee, or obtained access through a particular wallet-management system.
The distinction also matters for evaluating Binance's remediation measures. If the attack involved stolen signing credentials, an effective response would need to address credential exposure and transaction authorization controls. If it involved a software vulnerability or an infrastructure compromise, the recovery process could require a different combination of patches, system reconstruction, and security architecture changes.
Binance has said it intends to publish a more detailed incident report after its investigation concludes. That report will be important for establishing the initial attack vector, identifying the security boundaries crossed by the attackers, and assessing whether the company has implemented safeguards appropriate to the underlying cause.
Until those details become available, the confirmed facts remain the reported theft, the suspension and phased restoration of services, the company's asset-replacement commitments, and the FBI's attribution to TraderTraitor.
The Security Risks of Centralized Cryptocurrency Custody
The Binance incident highlights the security challenges associated with centralized cryptocurrency exchanges. These platforms provide convenient trading, conversion, and custody services, but they also concentrate significant quantities of digital assets within infrastructure controlled by a single organization.
Unlike traditional bank transfers, cryptocurrency transactions may be difficult or impossible to reverse once they have been confirmed on a blockchain. If attackers gain control of the credentials or systems needed to authorize transfers, stolen assets can potentially be moved rapidly across wallets and networks before investigators can intervene.
This creates substantial pressure on exchanges to maintain robust controls around private keys, transaction signing, privileged access, and wallet operations. Security measures commonly associated with institutional cryptocurrency custody include offline key storage, distributed approval mechanisms, transaction limits, behavioral monitoring, and separation between systems used for routine operations and those controlling large reserves.
No single safeguard eliminates every risk. Offline storage can reduce exposure to internet-based attacks, but operational processes still require mechanisms for moving funds. Multi-party authorization can make unauthorized transfers more difficult, but its effectiveness depends on how credentials, devices, and approval workflows are protected.
The Binance attack also demonstrates that incident response capabilities are as important as preventive controls. Once unauthorized transfers are detected, an exchange must identify affected systems, secure remaining assets, preserve evidence, and determine whether normal operations can resume safely.
Customer communication becomes another critical part of the response. Unclear information about withdrawal restrictions, asset coverage, or restoration timelines can increase uncertainty and encourage users to make decisions based on speculation rather than verified facts.
Why Withdrawal Restrictions Can Intensify a Security Crisis
Suspending withdrawals after a major cryptocurrency theft creates an operational dilemma. Keeping transfers open while an attack remains active could expose additional funds, but freezing access prevents customers from moving assets and may undermine confidence in the platform.
Binance described its suspension as a precautionary measure intended to contain losses and complete security checks. The company emphasized that it understood the importance of reliable withdrawal access, while maintaining that temporarily restricting transactions was necessary during the initial response.
The challenge is particularly acute for exchanges because customers may interpret withdrawal restrictions as evidence of financial instability, even when the restrictions were introduced for security reasons. This makes transparent communication about the purpose and duration of a suspension essential.
Restoring withdrawals in phases can reduce operational risk by allowing teams to verify individual networks and asset types before returning them to full service. However, a gradual reopening can also create uncertainty for customers whose particular assets remain unavailable.
The substantial transaction volume reported during Binance's initial reopening demonstrates the operational pressure that can follow a major security event. Processing $4.6 billion in withdrawals over approximately nine and a half hours required the platform to accommodate significant customer activity while continuing its recovery process.
The reported $3.6 billion net outflow is therefore an important indicator of customer behavior, but it should not automatically be interpreted as evidence of insolvency or a complete loss of confidence. A comprehensive assessment would require additional information about reserves, liabilities, subsequent transaction activity, and the outcome of the recovery process.
Implications for Cryptocurrency Exchanges and Regulators
The scale of the Binance breach is likely to intensify scrutiny of cryptocurrency custody practices and the safeguards used by major trading platforms. When a single security incident involves billions of dollars, the consequences can extend beyond the directly affected company to influence perceptions of risk throughout the digital asset industry.
For exchange operators, the incident reinforces the importance of limiting the amount of cryptocurrency that can be moved through any single compromised system or authorization process. Segmentation, independent transaction approvals, and continuous monitoring can help reduce the consequences of a successful intrusion.
For regulators, the case raises questions about operational resilience, customer asset protection, incident disclosure, and the standards that should apply to organizations holding substantial quantities of digital assets. Different jurisdictions approach cryptocurrency regulation in different ways, but the fundamental challenge of protecting custodial funds is shared across markets.
The involvement of a North Korean threat group also underscores the relationship between cryptocurrency security and international financial crime. Large-scale thefts can involve cross-border transfers, blockchain tracing, coordination with exchanges, and cooperation between law enforcement agencies.
The response to such incidents increasingly requires expertise spanning cybersecurity, financial investigations, blockchain analytics, and international cooperation. Recovering stolen assets can be difficult, particularly when attackers move funds rapidly or use services that complicate attribution.
For individual cryptocurrency holders, the incident offers a reminder that platform convenience and custodial risk are closely connected. Users should evaluate an exchange's security practices, withdrawal policies, and transparency when deciding where to hold digital assets. Personal custody can reduce dependence on an exchange, but it introduces separate responsibilities involving private-key protection and recovery.
A Defining Test for Binance's Security and Customer Trust
Binance's decision to resume withdrawals on November 1 marked a significant stage in its response to the $6.3 billion theft. The exchange reported that it had covered approximately 95% of the stolen assets, processed billions of dollars in customer transactions during the initial reopening period, and committed to absorbing the losses rather than passing them on to users.
Nevertheless, several important questions remain unanswered. The company has not yet provided a complete public explanation of the technical circumstances that enabled the breach, and the restoration of all affected assets and services was still underway at the time of its announcement.
The FBI's attribution to North Korea's TraderTraitor operation places the incident within a wider pattern of sophisticated cryptocurrency attacks. It also demonstrates the continuing attractiveness of centralized digital asset platforms to financially motivated and state-linked adversaries.
The longer-term consequences will depend on Binance's ability to complete its recovery, explain the root cause of the incident, and demonstrate that its security controls have been strengthened. The publication of a detailed forensic report will be especially important for assessing whether the underlying weaknesses have been addressed.
The central lesson of the breach is that restoring withdrawals is only one part of recovering from a major cryptocurrency cyberattack. Exchanges must also establish the integrity of their systems, account for affected assets, protect customers from further losses, and provide sufficient transparency to rebuild confidence.
For the cryptocurrency industry, the incident represents another reminder that the security of digital assets ultimately depends on the systems and organizations responsible for controlling them. As the value of cryptocurrency held by major platforms continues to grow, the consequences of a single security failure can become extraordinary.