Binance has resumed withdrawals in a phased rollout following one of the largest cyberattacks in cryptocurrency history. The exchange says it has already covered nearly all of the stolen funds — without passing any costs on to its users.
While the FBI points the finger at North Korea, the platform is working through a structured recovery plan to restore access to user assets. Here is everything we know so far.
A phased restart: Bitcoin first, other networks to follow
On November 1st, Binance confirmed the reopening of Bitcoin withdrawals, marking the beginning of a multi-step recovery plan. The exchange had suspended its services following an attack that occurred the previous Thursday, during which $6.3 billion worth of cryptocurrency was stolen — an unprecedented shock for the entire industry.
The decision to prioritize Bitcoin is no coincidence: it is the most requested asset among users over the past week, according to Binance‘s own data. The platform has since extended access to major blockchain networks, including Ethereum, BNB Chain, Solana, XRP Ledger and several other supported chains. Available assets include BTC, ETH, BNB, SOL, XRP, DOGE, ZEC, as well as the stablecoins USDT and USDC.
Binance has cautioned that availability remains gradual: some users may still experience temporary delays, network congestion, or failed withdrawal attempts. The official guidance is to wait a few minutes before trying again. Deposits, for their part, were never interrupted during the incident.
SAFU, treasury, OTC: how Binance is absorbing the financial blow
On the financial side, Binance published an update stating that it had covered approximately 95% of the affected assets, up from 90% in its previous communication. To achieve this, the exchange is drawing on three separate sources: the Secure Asset Fund for Users (SAFU) — its emergency reserve fund — the futures insurance fund, and its corporate treasury.
The remaining 5% consists primarily of low-liquidity tokens, which take time to acquire through open-market purchases and OTC (over-the-counter) transactions. Binance has unequivocally reaffirmed that customers will bear no financial losses resulting from the theft. It is a strong stance, designed to contain panic and preserve user confidence in an already strained market environment.
This capacity to absorb such a shock speaks to the strength of Binance‘s balance sheet, but it also raises serious questions about security governance at large-scale centralized exchanges. The fact that an attack of this magnitude was able to occur at all reignites the debate around the structural limitations of custodial platforms.
TraderTraitor: the North Korean group at the center of the FBI investigation
The FBI has formally attributed the attack to the group known as TraderTraitor, an entity linked to North Korea that has already been implicated in several major thefts across the crypto ecosystem. The federal agency has called on companies in the sector to block any transactions connected to the wallet addresses identified as compromised.
Blockchain analytics firms have been mobilized to trace the stolen funds and attempt to limit their laundering. This type of on-chain tracing operation has become a standard response to institutional-scale hacks, though its effectiveness remains limited when dealing with state-sponsored actors who have access to advanced obfuscation capabilities.
The reopening of withdrawals represents a significant milestone both symbolically and operationally, but a full restoration of services remains contingent on each network being validated by Binance‘s security teams. This incident is part of a broader pattern of attacks attributed to North Korean groups, which are estimated to have stolen several billion dollars worth of cryptocurrency in recent years, according to assessments from both the FBI and the United Nations.
