Binance reopens withdrawals, says 95% of losses covered

Binance, the world's largest cryptocurrency exchange, began letting customers withdraw funds again on Sunday, November 1. It reopened Bitcoin ↗ 0.11% withdrawals first and said more assets would follow in phases. The exchange says it has now replaced about 95% of the roughly $6.3 billion in tokens stolen in what is believed to be the largest digital heist on record.reuters.com

The reopening is Binance's first major step toward normal operations since it froze withdrawals after the October 29 breach. The FBI has blamed that attack on North Korea.cbsnews.com

A phased reopening

Binance posted on its status page shortly after 0600 GMT that withdrawals had started. The first phase covers 15 crypto assets, including Bitcoin, ether Ethereum ↗ 0.73%, XRP ↗ 0.24% and Dogecoin ↗ 0.13%. "First batch network now opened in phase one of withdrawals is $BTC bitcoin network," the exchange wrote on X.afp.com+1

By 5 a.m. Eastern time, withdrawals had also returned for ether, BNB ↘ 0.04%, XRP and Dogecoin, plus the Base and Optimism networks. Binance said it would "continue to restore additional assets and networks in phases as security checks are completed". It is ordering the restorations by how much users wanted to withdraw each token over the past week. It also warned that congestion and delays are likely during the rollout.cbsnews.com+1

How the losses were covered

Binance said it had covered about $6 billion of the stolen crypto by buying replacement tokens with company money. That is up from the 90% it reported on Saturday. The money came from three places: its $1 billion Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund, and its corporate treasury. Co-CEO Yi He said half of the SAFU fund would be used, and the company has promised to refill it to about $1 billion. The remaining 5% of stolen tokens are less liquid and may take longer to buy back. Separately, Binance said it had found about $3 billion of affected assets that partners were working to freeze as of Friday.bbc.com+1

"Binance will absorb the financial impact of the stolen funds, not our users," the company said.afp.com

North Korea blamed

On Saturday, the FBI named the North Korean state-backed unit TraderTraitor as the attacker. The same group was blamed for the $1.5 billion theft from Bybit in February 2025. The FBI said it had seen the hackers converting stolen funds into ether and expected "further laundering". Blockchain analysis firms TRM Labs and Chainalysis said most of the theft took place in about 20 minutes. President Donald Trump was more cautious about the attribution. "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," he said.reuters.com+1

Co-CEO Richard Teng has said the attack involved several points of entry, starting with a compromised engineer's laptop. He said the hackers used a "self-destruct mechanism" to hide their tracks. Binance also expects to finish a full cryptographic check of its reserves by November 3.crypto.news+1