Binance Restarts Bitcoin Withdrawals After Covering 95 Percent of Stolen Funds

Binance resumed Bitcoin withdrawals on 1 November as the first step in a phased return of services after the theft of approximately $6.3 billion in virtual assets on 29 October. The exchange said the initial window ran from 06:00 to 09:00 UTC and covered selected assets across 15 networks, prioritised according to recent user demand.

Co-CEO Richard Teng and co-founder Yi He had indicated that withdrawals would restart within roughly 48 hours of the suspension. Deposits remained open throughout. Binance stated that it had replenished about 95 percent of the affected token amount by purchasing replacement assets with company money and that user balances would not absorb the loss. The remaining 5 percent consists of less-liquid tokens that will take longer to acquire. A new proof-of-reserves snapshot was published, with full cryptographic verification expected by 3 November.

The FBI attributed the theft to North Korea’s TraderTraitor group and released lists of addresses used to move the funds, primarily into Ethereum. Blockchain firms estimated that the bulk of the assets left Binance hot wallets in about 20 minutes. Stablecoin issuers froze portions of the stolen tokens on-chain, but the remainder continues to move. Binance has not yet released a full post-incident technical report detailing the intrusion path beyond an earlier description of a compromised DevOps engineer’s laptop that allowed unauthorised withdrawal transactions.

The controlled restart means users can again move Bitcoin and a limited set of other assets, but many networks remain closed until further security checks are completed. Temporary delays are expected because of volume. For the broader market the test is whether the phased reopening holds without further incidents and whether the remaining 5 percent of tokens can be replaced without prolonged restrictions. The exchange’s decision to cover the loss from its own resources has so far prevented a larger run on user confidence, but the full recovery of service will depend on how quickly the remaining networks clear the security reviews now under way.