Binance resumes phased withdrawals after the largest crypto hack: 95 percent of funds covered
Cryptocurrency exchange Binance announced on Sunday, November 1, the start of the first phase of restoring user withdrawals, marking the first concrete recovery step after the theft of approximately $6.3 billion recorded the previous Thursday. The attack, attributed by the FBI to the North Korean group TraderTraitor — the same faction responsible for the $1.5 billion Bybit hack in February 2025 — remains the largest theft of digital assets ever recorded in the industry's history.
What changed
Withdrawals were reopened progressively between 06:00 and 09:00 UTC, starting with Bitcoin and extending to assets on 15 other blockchains, including Ethereum, BNB Smart Chain, Tron, Solana, XRP, Zcash, Dogecoin, TON, Polygon, Avalanche, Arbitrum, Base and Optimism. Each network and individual asset underwent security and stability verification before being released, with the exchange announcing on X that priority was set based on user demand data from the previous week.
At least $4.6 billion in withdrawals were processed within the first hours of the restart, according to Binance itself, while roughly $1 billion in deposits continued operating normally throughout the entire withdrawal suspension period.
The fund coverage
A central point of the exchange's communication was the confirmation that 95 percent of the stolen assets have already been replenished with the company's own resources, an improvement from the 90 percent announced the previous day. This replenishment included a partial deployment of the SAFU (Secure Asset Fund for Users), the emergency reserve fund that Binance maintains specifically for incidents like this — a bitcoin and own-capital reserve that the platform accumulates over years for crisis situations.
The ten listed tokens (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC) are already at 100 percent coverage and can be verified on the proof-of-reserves snapshot published by the company. The remaining 5 percent corresponds to tokens outside the top ten by liquidity, whose recovery requires acquisition via market and OTC channels — a significantly more time-consuming process given the volume required.
Binance co-founder and co-CEO Richard Teng classified the attack as "complex" in a previous statement, revealing it involved a DevOps engineer's compromised laptop and malware designed to erase traces of its activity — a tactic that makes investigation significantly more difficult.
The FBI response and geopolitical ramifications
The FBI confirmed on Saturday, in an official joint statement with the USSS (Secret Service) and the IRS-CI (Internal Revenue Service - Criminal Investigation), that the TraderTraitor group — part of the well-known Lazarus Group, the same organization responsible for the 2014 Sony Pictures attack — was indeed behind the hack. The agency listed more than 60 ETH, BTC and SOL addresses associated with the attackers and asked industry companies, DeFi operators, instant exchanges and blockchain analytics firms to block transactions with those addresses.
According to the FBI, the hackers were converting the stolen assets primarily into Ethereum (ETH), with expectations that the money would be further laundered through DeFi services and instant swaps — a laundering chain that could take weeks or months to fully trace.
The context is alarming: between 2016 and early 2026, North Korea-linked actors stole approximately $6.75 billion in cryptocurrency across 263 documented incidents, according to CertiK data compiled by independent researcher Taylor Monahan. The CertiK analysis concluded that North Korea has industrialized cryptocurrency theft as a central state revenue mechanism, with diverted funds financing weapons of mass destruction and ballistic missile programs — an off-budget revenue source that supplements Russia defense exports documented by South Korean intelligence between 2022 and 2025.
Market impact and user consequences
The hack announcement caused brutal drops in major cryptocurrencies on Friday: Bitcoin plunged nearly 5 percent, Ethereum fell almost 6 percent and BNB, the native Binance token, lost about 10 percent. The reopening of withdrawals brought relative stability, but uncertainty about the pace of full recovery and the possibility of new attack vectors continue to pressure the market.
The question that remains is whether the cryptocurrency industry is prepared for a new threat standard: when a nation-state operates as an industrial-scale crypto hacking actor, with state resources, agent concealment and sophisticated DeFi money-laundering tools, the security of centralized exchanges ceases to be merely a technical problem and becomes, effectively, a matter of global geopolitical security.
Sources: CoinDesk, FBI, Cointelegraph
✓ Independent sources cross-checked and verified before publishing
