Binance restarts withdrawals as FBI blames North Korea hack

As of 7:12 a.m. ET, Monday, Nov. 2, 2026

Binance, the world's largest cryptocurrency exchange by trading volume, has begun restoring customer withdrawals in phases after a hack the FBI says North Korea carried out, and the company said a net $3.64 billion left the platform on Sunday as withdrawals reopened.

The FBI said on Saturday that North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026." The bureau said it refers to the North Korean cyber activity as "TraderTraitor."

Withdrawals reopen network by network

In a recovery update posted early Sunday, Binance said it would resume phase one of withdrawals between 06:00 and 09:00 UTC on Nov. 1 and restore them progressively as security and readiness checks were completed. Deposits were not affected, it said.

Through a series of posts on X on Sunday, Binance listed withdrawals as re-enabled on 15 networks by GROKsiNEWS.com's count: Bitcoin, Ethereum, BNB Smart Chain, XRP, Base, Dogecoin, Optimism, Arbitrum, Tron, Solana, Polygon, Avalanche C-Chain, Zcash, TON and Sui. Binance said it "will continue to restore additional assets and networks in phases as security checks are completed."

Binance's website still showed withdrawals partially suspended for most cryptocurrencies, Reuters reported on Monday.

From 0600 to 1530 GMT on Sunday, Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of $3.64 billion, or about 2.1% of the assets it manages, AFP reported. "After an initial spike, withdrawal volumes have declined and are stabilising," Binance said on X, according to Reuters.

"Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," co-CEO Yi He said in a post on X on Monday, Reuters reported.

Covering the losses

Binance has said it will absorb the losses. "Binance will absorb the financial impact of the stolen funds, not our users," the company said in its recovery update. It said it had covered approximately 95% of the impacted amount, up from 90%, and that the remaining 5% were less liquid tokens outside the top ten that take longer to source.

Reuters has described the theft as a $6.3 billion heist and reported that Binance has already raised $6 billion from its corporate treasury, an insurance fund and a fund set aside for security breaches to cover the losses.

FBI: assets converted to Ether

The FBI said it, the U.S. Secret Service and IRS Criminal Investigation have observed TraderTraitor actors converting stolen assets primarily into Ether and expect further laundering through decentralized finance and instant swap services. The agencies urged node operators, exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions tied to addresses the FBI listed.

TraderTraitor is the same group blamed for a $1.5 billion theft from the Bybit platform in February last year, AFP reported. No one has been charged.

President Donald Trump cast doubt on North Korea's involvement. "I'm not concerned. We're learning about it. We don't know if it's North Korea," Trump told reporters in Florida late Saturday, according to AFP.

About half of the stolen funds were in stablecoins that have been frozen by issuers, including Circle, which said on Monday it had frozen more than $1.1 billion in USDC, Reuters reported.