Binance began allowing customers to withdraw some major cryptocurrencies again on Sunday, November 1, after a hacking attack resulted in the theft of more than $6 billion in assets. The exchange had halted user withdrawals following the attack and is restoring access in stages, with the first phase beginning on Sunday.
By 5 a.m. Eastern Time, withdrawals were available for Bitcoin, Ethereal, BNB, XRP, Base, Doge and Optimism, according to the company. Binance announced the initial reopening on X and said access to other assets and networks would follow in phases as security checks were completed. The announcement marked a partial restoration of withdrawals following the suspension.
The theft is thought to be the largest heist ever. Binance ranks as the world's biggest cryptocurrency exchange by daily trading volume, and news of the attack was followed by sharp price declines across most major cryptocurrencies on Friday. Sunday's reopening came after those losses in the broader cryptocurrency market.
Binance has sought to reassure customers by saying it would cover 90% of the losses with its own funds. The company said it would use that money to purchase tokens, replenishing a large share of the assets taken in the attack. Its stated commitment covers most of the losses rather than the full amount stolen.
In a statement released Saturday, the FBI attributed the attack to North Korea. The bureau said the theft of more than $6 billion in virtual assets from Binance occurred on or around October 29, 2026. Its announcement confirmed earlier suspicions raised by private investigators and analysts about who was responsible.
Those investigators and analysts had pointed to TraderTraitor, a group affiliated with Pyongyang. The same group has also been blamed for stealing $1.5 billion from the Bybit cryptocurrency platform in February last year.
The FBI said it had observed actors associated with TraderTraitor converting stolen assets into Ethereum. It expected further laundering through additional conversions using decentralized finance services and instant swap services. The bureau's statement distinguished between conversions it had already observed and the further movement of funds it anticipated.
The bureau also called on private sector entities to block transactions involving addresses used by TraderTraitor actors to launder the stolen assets. Its request extended to transactions derived from those addresses.
