Binance Reopens Bitcoin Withdrawals After $6.3 Billion Hack

Binance Reopens Bitcoin Withdrawals After $6.3 Billion Hack

Bitcoin goes first in a phased Sunday restart

Binance began restoring customer withdrawals on Sunday, Nov. 1, after suspending them following the theft of about $6.3 billion in tokens. The exchange said phase one would run between 06:00 and 09:00 GMT, starting with the Bitcoin network. In posts on X, Binance said additional networks and currencies would follow in phases and that updates would come through its official X channel.

FBI blames North Korea in the largest crypto theft ever

The FBI said on Saturday that the Democratic People's Republic of Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. Cybersecurity firm TRM Labs attributed the attack to TraderTraitor, North Korea's elite hacking unit, citing on- and off-chain intelligence and similarities with the $1.5 billion Bybit hack in February 2025. The Binance theft is the largest digital heist on record.

A compromised laptop, not leaked private keys

Binance said the incident may have involved a compromised DevOps engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawal transactions. The exchange said investigators were examining the laptop and other possible entry points, and that it had found no evidence that wallet private keys were exposed. Roughly $3 billion of the stolen assets was frozen on-chain.

Three company pots cover 95%, top tokens fully backed

Coverage has now reached about 95% of the affected amount, up from about 90% on Saturday, after about 80% on Friday. The replacement draws on three sources: the Secure Asset Fund for Users (SAFU), part of the Futures Insurance Fund, and the corporate treasury. Binance said it set aside more than $6.34 billion, including $5 billion in the affected cryptocurrencies. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed at 100%, and the company said it will absorb the loss rather than pass it to users. It also pledged to replenish SAFU to about $1 billion after transferring out 7,499 BTC, worth about $581 million.

Fifteen networks, new wallets, and likely delays

The first phase covers 15 networks: Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash, Dogecoin, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism, TON and Sui, with each route requiring its own security check. Binance updated its proof-of-reserves address list to newly generated wallets and said all withdrawals will be processed from the new addresses. The remaining 5% consists of less-liquid tokens outside the top ten by market ranking that will take longer to source through market and over-the-counter channels. Deposits operated normally throughout the incident. Binance cautioned that traffic spikes could cause delays.

Trust is the next test after the money is replaced

Co-founder Changpeng Zhao wrote on X that BTC withdrawals were live, while co-CEO Yi He said about half of SAFU funds were used. What matters next is whether all 15 networks open on schedule, how fast the illiquid remainder is fully covered, and whether the restart triggers a wave of withdrawals that slows the system. Replacing the tokens settles the balance sheet; persuading customers their funds are safe is the harder job.