Binance Resumes Withdrawals After Record $6.3 Billion Hack

Binance began restoring customer withdrawals in phases Sunday after a $6.3 billion theft, the largest on record, as the FBI attributed the breach to North Korea’s TraderTraitor group.

The Morning Brief Desk · Monday, November 2, 2026 · How the Brief is made

Sources: The Guardian World, TechCrunch, Inc.

Binance announced early Sunday that it would resume customer withdrawals in a phased process, ending a freeze imposed after hackers stole $6.3 billion in cryptocurrency from the exchange’s wallets — the largest crypto theft on record. The company said it has covered most of the stolen assets, with figures ranging from 90% in a Guardian report to 95% in Binance’s latest update cited by TechCrunch, and pledged that customers will be fully reimbursed. “These losses will not be passed on to users,” the company said.

The reopening unfolded network by network. As of Sunday morning, Binance’s status page showed a mix of normal, partially suspended and fully suspended services — Bitcoin withdrawals and deposits were partially suspended, for example, while Ethereum deposits were listed as normal. The company told users to expect delays because of traffic volume. Between 6 a.m. and 3:30 p.m. UTC, Binance processed $4.6 billion in withdrawals against $1.0 billion in deposits, a net outflow of $3.6 billion, or 2.1% of its total assets under management.

On Saturday, the FBI formally attributed the heist to TraderTraitor, a North Korean state-sponsored group. Federal investigators said the operation breached the exchange by compromising an engineer’s laptop, and that the group was converting stolen assets primarily into Ethereum, with further laundering considered likely.

The context

Binance froze all deposits and withdrawals after the breach, cutting off customer access to funds. The company said the freeze was a necessary precaution while teams worked to contain losses, assess the damage, restore services and complete security checks, acknowledging that it did not make the decision lightly given how much users depend on reliable withdrawal access.

As of last week, withdrawals remained frozen and investigators had not publicly named a culprit, though Binance had previously blamed North Korean hackers for the attack. The FBI’s statement Saturday made that attribution formal, identifying TraderTraitor as responsible. Binance says it is still working to purchase the remaining affected assets, which it described as less liquid and slower to source at the scale required to make all customers whole.

Why it matters

The breach is the largest cryptocurrency theft ever recorded, and it now carries formal U.S. government attribution to a North Korean state-sponsored group. For Binance customers, the reopening restores access to funds for the first time since the breach, backed by the company’s pledge to absorb the full financial hit. The $3.6 billion net outflow in the first hours of resumed withdrawals — about 2.1% of assets under management — offers an early measure of how much confidence customers retain in an exchange used by millions.

What’s next

Binance says it will continue restoring withdrawals in phases depending on network and asset type, strengthen its safeguards and publish a detailed incident report once its investigation is complete. The company is still sourcing the remaining stolen assets it has not yet covered. The FBI said TraderTraitor is converting the funds primarily into Ethereum, with further laundering likely, leaving open how much of the stolen crypto can be traced or recovered.

Sources

The Guardian World
Binance resumes customer withdrawals after record $6.3bn hack
The exchange says 90% of losses are covered as the FBI blames the North Korean state-sponsored group TraderTraitor for the largest crypto theft ever.
TechCrunch
Binance resumes withdrawals following $6.3 billion breach
The cryptocurrency exchange said it has now covered 95% of the stolen assets as customer withdrawals restart.
Inc.
FBI Links Record $6.3 Billion Binance Crypto Heist to North Korea
Federal investigators identified TraderTraitor as the operation that compromised an engineer’s laptop; Binance pledges full customer reimbursement.

See a mistake? Report an error · Corrections policy