Binance withdrawals resume in phases after FBI names North Korea

Customers locked out since Thursday finally got a door back. Binance withdrawals resume on Sunday in a staged reopening, the first real test of whether the exchange's promise to absorb the largest crypto theft on record holds up when users can actually move their money.

What happened

The first window ran from 06:00 to 09:00 UTC on November 1, or 1 a.m. to 4 a.m. ET, according to TokenPost and a Binance update relayed by ChainCatcher. Bitcoin, ether and BNB led the list, which also covered TRX, SOL, XRP, ZEC, DOGE and TON plus the POL, AVAX, ARB, BASE, OP and SUI networks. Binance said it ranked assets and networks by user demand over the past week and would add the rest after security and stability checks, warning that heavy traffic could cause delays or failed requests at first. Deposits were never halted.

On Saturday the exchange told CNBC it had restored backing for about 90% of the roughly $6.3 billion in tokens taken from its hot wallets, drawing on its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. It stressed that this is replacement, not recovery from the attacker. Late on Saturday, Reuters reported, Binance raised the figure to 95%, saying the remaining 5% sits in less liquid tokens that take longer to source.

The same evening the FBI said the North Korean state-backed unit known as TraderTraitor carried out the theft and had been seen converting stolen assets into ether ahead of what it called further laundering stages.

Why it matters

A withdrawal freeze is where exchange trust usually breaks, so the reopening matters more than any reserve snapshot. Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed one for one, which covers the coins most customers hold. Holders of smaller tokens face the longest wait.

The FBI finding also changes expectations. Our earlier pieces on the Binance security incident and the TraderTraitor attribution explained why funds moved by this group are rarely returned in full; the burden of making customers whole therefore sits with Binance's balance sheet rather than with investigators.

How the attackers got in is still unclear. Binance first pointed to a compromised engineer's laptop, while co-CEO Richard Teng later described a more complex process, CNBC reported.

The reopening also tests Binance's account of where the money came from. It said it is buying the remaining tokens through market and over-the-counter channels until coverage reaches 100% for every asset, and that it will absorb the loss rather than pass it to users. TRM Labs had pointed to North Korea before the FBI did, noting small Tornado Cash withdrawals that funded an operator wallet and signatures collected in advance and executed in one burst, the same pattern seen in the Bybit theft. Because Binance withdrawals resume before the investigation is finished, the exchange has to show its systems are clean while the investigation continues.

What's next

Watch whether the first window clears without long queues, and how quickly the second batch of networks follows. TokenPost's phase-one schedule lists the covered assets.

If Binance withdrawals resume smoothly across all major networks this week, attention will shift to the last 5% of unreplaced tokens and to any regulatory fallout from the breach.

A stumble, such as repeated pauses or tight limits, would quickly revive the outflow fears that hit crypto stocks on Friday.