Binance says it has resumed some withdrawals after the October 29, 2026, theft of more than $6 billion in cryptocurrency. The FBI attributes the attack to North Korea’s TraderTraitor operation. Binance’s recovery figures and withdrawal updates are separate claims, not findings confirmed by the bureau.
- Withdrawals: Bitcoin came back first, followed by selected assets on Ethereum and BNB Smart Chain.
- Binance’s account: The exchange says it replaced about 95% of affected assets. That does not mean it recovered 95% of the stolen funds.
- FBI attribution: The bureau says TraderTraitor converted stolen assets mainly into Ethereum and may move funds through DeFi and instant-swap services.
Withdrawals return in stages
Crypto.news reported that Binance resumed withdrawals on November 1 for USDT, USDC and ETH on Ethereum, and for USDT, USDC and BNB on BNB Smart Chain. Bitcoin withdrawals had reopened earlier, after nearly three days of restrictions.
Binance’s reported plan was to restore access one network at a time, following security checks. Its first recovery window was set for 06:00 to 09:00 UTC, with 15 networks initially identified for assessment. Other withdrawal routes remained unavailable, and Binance had not said when they would reopen. Deposits reportedly continued during the restrictions.
These are Binance’s operational updates as reported by crypto.news. The FBI alert concerns the theft and alleged laundering, not the exchange’s withdrawal status. Reopening some routes is welcome news for customers, but it does not prove that every network has passed security checks or that the incident is fully resolved.
Replacement is not the same as recovering stolen funds
Binance said it had replaced approximately 95% of affected assets, up from previously reported figures of 80% and 90%. The exchange said most of the remaining assets were less-liquid cryptocurrencies. These tokens can be difficult to buy in large quantities without pushing up their market price. Binance said it was sourcing them through exchanges and over-the-counter trading desks.
The 95% figure refers to Binance’s reported replacement of affected assets. It does not show that Binance or investigators recovered 95% of the stolen cryptocurrency. Nor does the available accounting explain exactly how Binance measured the affected assets.
Binance also said balances of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, and that customers would not bear the financial losses. The exchange was reported to have reserved $6.34 billion in company funds to cover losses. The money came from its Secure Asset Fund for Users, corporate treasury holdings and part of its Futures Insurance Fund.
Those assurances come from Binance. The figures describe different things: the FBI says more than $6 billion was stolen, while the reported $6.34 billion is the amount Binance set aside to cover losses. The information available does not provide a full accounting that reconciles the two amounts.
Binance also said it had published a Proof of Reserves snapshot taken at 00:00 UTC on October 31, with a more complete zero-knowledge proof expected by November 3. Proof of Reserves is meant to help customers assess whether an exchange holds assets equal to customer balances. A planned disclosure is not a complete account of a theft or a guarantee against future losses.
What the FBI says about the alleged attackers
The FBI attributes the theft to North Korea’s TraderTraitor operation, the name the bureau uses for the hacking activity. Investigators observed the attackers converting stolen assets primarily into Ethereum, the FBI says. The bureau also expects further movement through decentralized finance (DeFi) protocols and instant-swap services. That is a warning about possible future activity, not confirmation that the attackers had already used those routes.
The FBI, U.S. Secret Service and IRS Criminal Investigation urged cryptocurrency businesses and blockchain operators to block transactions involving addresses linked to the attackers, including funds derived from those addresses. The FBI says its listed addresses “are holding or have held assets” linked to the operation. That distinction matters: a listed address may no longer contain funds.
The request covers intermediaries such as DeFi services, instant exchanges, blockchain analytics firms and node operators, the infrastructure providers that help blockchain networks process and relay transactions. Blocking funds tied to an investigation can hinder laundering, but the identification must be accurate. Funds can pass through multiple transactions, and a broad label is no substitute for evidence linking a particular transfer to the theft.
The FBI’s attribution is an official U.S. government finding. The information described publicly does not include the underlying forensic evidence or explain how the attackers gained access. The FBI alert outlines the attribution and observed asset movements, but does not provide a technical account of the exploit.
Trump’s comments preceded the FBI’s attribution
On October 30, Trump told White House reporters, “We don’t know, we are looking into it, ” when asked whether a North Korean group was responsible, according to SBS News. He also said Binance believed it would recover the funds. The FBI later attributed the theft to TraderTraitor, so Trump’s remarks and the bureau’s conclusion reflect different points in the investigation.
Key questions and answers
-
Which withdrawals resumed?
Bitcoin reopened first. Binance then reportedly resumed USDT, USDC and ETH withdrawals on Ethereum, and USDT, USDC and BNB withdrawals on BNB Smart Chain.
-
How much was stolen?
The FBI says more than $6 billion in virtual assets was stolen from Binance on or about October 29, 2026. SBS News reported a figure of $6.3 billion.
-
Did Binance recover 95% of the stolen funds?
That is not what the reported figure shows. Binance said it had replaced approximately 95% of affected assets. Replacement is not the same as recovering stolen cryptocurrency.
-
Who does the FBI blame?
The FBI attributes the theft to North Korea’s TraderTraitor operation. The information described publicly does not include the forensic evidence behind that conclusion.
-
When will the remaining withdrawal routes reopen?
Binance had not announced a date. Its reported plan was to restore routes after security checks on each network.
-
How much was withdrawn after services resumed?
No withdrawal totals or exchange netflow figures were reported. Wallet movements can also include internal transfers, so they do not necessarily represent customer withdrawals.
The return of selected withdrawals is a relief, but key questions remain: how the breach happened, how Binance calculated the assets it replaced, and how much of the stolen cryptocurrency can still be traced or recovered. Until those details are clearer, the reopening marks a step toward normal service, not a clean bill of health.
