Binance Reopens Withdrawals After Covering 95% of Record $6.3 Billion Heist
Binance began reopening cryptocurrency withdrawals on Sunday, November 1, after telling customers it had covered about 95 percent of the $6.3 billion stolen in the largest digital-asset theft on record. Reuters confirmed the phased restart. It eases the immediate threat of a run on the world’s biggest crypto exchange, but it does not erase the central fact of the crisis: a single compromised machine helped expose billions of dollars held inside a supposedly borderless financial system.
The company scheduled the first wave between 06:00 and 09:00 UTC, restoring access to bitcoin, ether, BNB, Solana, XRP, dogecoin and other major assets. Binance later said the bitcoin network had reopened. Deposits remained available throughout the suspension, according to the exchange’s recovery update.
Binance framed the restart as proof that customers would not bear the cost. “User funds remain safe. Binance will absorb the financial impact of the stolen funds, not our users,” the company said.
A rescue financed from inside the exchange
That promise rests on a private bailout assembled by Binance itself. Reuters reported that the exchange used company money to buy roughly $6 billion in replacement tokens. The funds came from its Secure Asset Fund for Users, its futures insurance pool and its corporate treasury. The remaining 5 percent consists of less-liquid tokens that Binance says will take longer to source at scale.
The distinction matters. Binance has not recovered 95 percent of the stolen assets. It has replaced or covered most of the hole while investigators chase the money across blockchains. The company says partners had frozen about $3 billion on-chain by Friday, but frozen assets are not the same as funds returned to customers.
The speed of the rescue shows Binance’s financial reach. Reuters says the exchange reported 335 million registered users and $162.8 billion under custody in its 2025 annual report. The Associated Press described the scale of the breach. Those numbers also reveal the concentration of risk. Millions of people gained access to crypto through one private gatekeeper, and when that gate closed, they had to wait for the company to decide when their money could move again.
North Korea accusation raises the stakes
The FBI said Saturday that North Korea’s TraderTraitor operation carried out the theft on or about October 29. U.S. investigators said the group had begun converting stolen assets primarily into ether and expected further laundering through decentralized-finance and instant-swap services. The bureau published its attribution and address list on October 31.
The bureau published hundreds of associated addresses and urged node operators, exchanges, analytics firms and other crypto businesses to block transactions connected to them. AP independently reported the FBI’s attribution. The appeal exposes another contradiction at the center of the industry. Crypto markets sell themselves as decentralized and censorship-resistant, yet stopping a state-backed theft now depends on coordinated intervention by exchanges, infrastructure operators and law-enforcement agencies.
Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop that allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. The company said it found no evidence that private wallet keys had leaked. Its initial incident notice detailed that finding. Co-CEO Richard Teng described a complex attack designed to destroy evidence, according to Reuters.
North Korea routinely rejects accusations that it uses state-linked hacking teams for theft or revenue generation. Its representatives did not respond to Reuters requests for comment on the Binance case. Reuters reconstructed how the theft unfolded in about 20 minutes.
The reopening buys Binance time, not absolution. Customers still need a full technical account of how one endpoint became a path into critical withdrawal systems, why internal controls failed to stop the transfers, and whether executives can prove the rebuilt infrastructure is safer than the one attackers breached.
Binance says it will publish a post-incident report after the investigation. Until then, the 95 percent figure remains a measure of how much money the exchange can deploy, not how much trust it has restored. Withdrawals are moving again. The unanswered question is whether the system learned anything before the next attacker arrives. The company’s current recovery statement remains here.
Comments