# Binance reopens withdrawals as FBI blames North Korea

> Binance began phased withdrawals Sunday after its record $6.3 billion hack and says 95% of losses are replaced. The FBI now blames North Korea.

By Subhajit | 2026-11-01 | Tech | Savvy VibeZ
Web page: https://savvyvibez.com/post/binance-reopens-withdrawals-as-fbi-blames-north-korea

## Key takeaways

- Binance began phased withdrawals Nov. 1, starting with bitcoin and 15 other blockchains, three days after the $6.3 billion hack.
- Binance says it has replaced about 95% of the affected assets from company funds, up from 90%; that is not the same as recovering stolen money.
- The FBI said Oct. 31 that North Korea's TraderTraitor group stole more than $6 billion, with the Secret Service and IRS-CI.
- No restart date for remaining networks, and Binance.US impact is not addressed in the reports we read.

Binance began reopening withdrawals on Sunday, Nov. 1, 2026, three days after the record $6.3 billion hack of the world's largest crypto exchange. The company says it has now replaced about 95% of the stolen assets, and the FBI said Saturday that North Korea was responsible. Details were still moving as of 6 a.m. ET.

## What we know

According to CoinDesk, Binance started a phased restart in a window that ran from 6 a.m. to 9 a.m. UTC (1 a.m. to 4 a.m. ET). Bitcoin withdrawals came back first, with assets on 15 other blockchains in the same first phase. TokenPost reports that by mid-morning ET some withdrawals were working on seven networks: Bitcoin, Ethereum, BNB Smart Chain, XRP, Base, Dogecoin and Optimism. Not every asset on each network is back yet, and Binance warned of delays while traffic is heavy.

Binance says coverage of the affected amount rose to about 95% from 90% a day earlier. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, the company says. The missing 5% is in less liquid tokens that take longer to buy at scale.

## The FBI's attribution

On Saturday the FBI said North Korea stole more than $6 billion from Binance on or about Oct. 29, according to Fox Business and The Next Web. The bureau tied the theft to the group it calls TraderTraitor, the same activity it blamed for the $1.5 billion Bybit theft in February 2025. It said it was working with the U.S. Secret Service and IRS Criminal Investigation, and that it had seen the stolen assets being converted mostly into ether. The BBC notes that North Korea has always denied involvement in such attacks.

Earlier, TRM Labs and Chainalysis had pointed to the same group. This is the first public confirmation from U.S. federal investigators.

## What is not confirmed yet

The 95% figure means Binance has replaced assets from its own funds, including its SAFU emergency reserve, its futures insurance fund and its corporate treasury, according to TokenPost. It does not mean 95% of the stolen money has been recovered. Binance froze about $3 billion on Friday, and the rest is being traced. The remaining networks have no restart date. And none of the reports we read say what the hack means for Binance.US customers.

## Why it matters for U.S. readers

U.S. agencies are now openly part of the chase, and the FBI asked crypto services to block addresses the hackers are using. TokenPost also puts Binance's net outflows at about $1.26 billion over 24 hours on Sunday, so some customers were pulling money out the moment the doors opened.

**Our take:** Paying users back this fast is unusual, and it is the main reason the restart looks calm. The harder test is the next few weeks, to see whether withdrawals stay steady once the easy networks are done. We will update this story if Binance or the FBI adds verified details.

## Related reading

- [Binance hack hits $6.3B as analysts link North Korea](/post/binance-hack-hits-6-3b-as-analysts-link-north-korea)
- [Binance pauses withdrawals after suspected multibillion hack](/post/binance-pauses-withdrawals-after-suspected-multibillion-hack)

Picture credit: Logo: Binance (public domain). Design: Savvy VibeZ