Binance Restarts Bitcoin Withdrawals After Covering 95 Percent of $6.3 Billion Stolen in North Korea-Linked Attack

Binance resumed bitcoin withdrawals on Sunday, 1 November, after covering 95 percent of the $6.3 billion in tokens stolen from the exchange on 29 October. The first phase covers 15 cryptoassets, including bitcoin, ether, XRP and dogecoin. Further assets will follow in stages. Binance said the remaining 5 percent consists of less liquid tokens that will take longer to replace.

The company set aside approximately $6.34 billion of its own funds. The money used to buy replacement tokens came from its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund, and corporate treasury. Binance has stated that it will fully cover the financial impact on users. Withdrawals had been suspended after the attack. The status page showed the planned restart beginning shortly after 0600 GMT.

The FBI stated that North Korea was responsible and identified the TraderTraitor unit, linked to the Lazarus Group. The bureau said the theft of more than $6 billion in virtual assets occurred on or about 29 October. Blockchain analytics firms Chainalysis and TRM Labs had earlier attributed the attack to the same group. The theft is the largest cryptocurrency heist on record, exceeding the $1.5 billion Bybit incident in 2025. Most of the funds left Binance hot wallets across roughly ten blockchains within about 20 minutes, beginning around 16:05 ET on Thursday.

Of the $6.3 billion, Ethereum accounted for the largest share at about $3.8 billion, followed by 18,270 bitcoin valued at roughly $1.5 billion. Approximately $2.7 billion to $3 billion in stolen stablecoins were frozen by issuers. Binance has said it is working to gain access to additional frozen funds. Roughly $2.4 billion is described as already beyond issuer reach. The exchange plans to publish proof of reserves on 2 November.

President Donald Trump has said the United States is not certain that Pyongyang directed the theft. The FBI statement attributes the attack to a North Korean entity. TraderTraitor has previously been linked to other large crypto thefts. After the Bybit incident the group converted a large portion of stolen ether into bitcoin via cross-chain routes.

Binance, the largest exchange by trading volume, halted deposits and withdrawals immediately after detecting the unusual transactions. It posted repeated assurances that user losses would be covered. The restart of withdrawals on Sunday marks the first return of normal outflow for the most liquid assets. The phased approach is intended to maintain platform stability while the remaining tokens are acquired.

The attack targeted Binance's own infrastructure rather than the underlying blockchains. Investigators continue to trace the movement of the unfrozen portion. No public figure has been given for the amount recovered through freezes or other means beyond the issuer actions already reported. Binance's coverage from its own reserves means customer balances are restored regardless of recovery progress.

The incident has prompted renewed attention to exchange hot-wallet practices and to the concentration of liquidity on a single platform. Binance's decision to restart withdrawals after replacing 95 percent of the stolen amount restores user access for the major assets while the less liquid remainder is addressed. The FBI attribution and the scale of the loss place the event among the largest state-linked cyber thefts of digital assets on record.