Binance restarts withdrawals in phases after covering most of the $6.3 billion stolen, as the FBI names North Korea
The exchange said a first phase would cover 15 assets including bitcoin and ether, while accounts differ on whether it has covered 90% or 95% of the losses.
Binance, the world’s biggest cryptocurrency exchange, said it would resume withdrawals in phases after covering 95% of the $6.3 billion stolen from it5. Other accounts put the share of losses already covered at 90%2,6. The exchange said the first phase of withdrawals would cover 15 crypto assets, including bitcoin, ether, XRP and dogecoin1. That first phase was set to start between 0600 and 0900 GMT3. Binance posted the restart on its status page4.
The Federal Bureau of Investigation says North Korea was responsible for the hack2. The FBI’s finding that North Korea was behind the theft has now been reported widely alongside the news of the restart7. The exchange, which was founded in China, had frozen withdrawals after the theft, and the restart is its first step toward letting customers move funds again1,3.
Get AiM Weekly, free.
Why it matters to investors
Withdrawals are the clearest test of whether customers can take assets off the platform, and the first phase covers the most widely held tokens, among them bitcoin and ether1,3. The company singled out popular cryptocurrencies including Bitcoin, Ethereum, Binance Coin, Solana, XRP, World Liberty Financial USD and Ripple USD in its statements on the losses6.
The two figures for losses covered do not match. One account, attributed to the exchange, says it has covered 95% of the $6.3 billion5, while others say 90%2,6. The sources do not reconcile the difference or explain how the remaining shortfall will be met.
The FBI attribution moves the case from an exchange security failure to an act the US government ascribes to a state2,7. That is a claim by a US agency, and the sources here carry no response from North Korea2.
What to watch
Binance has described the restart as phased, with 15 assets in the first group, which leaves the timing for other tokens still to be announced1,5. Whether the first window, set for between 0600 and 0900 GMT, runs without fresh interruptions is the first marker for customers3.
Further statements from the exchange on how much of the $6.3 billion it has covered, and from the FBI on the North Korean attribution, are the next points to follow2,5. The sources do not say how Binance funded the coverage of the losses or whether any of the stolen assets have been recovered1,6.
Sources
- Binance resumes bitcoin , ether withdrawals after covering bulk of stolen $6.3 billion, reuters.com (2026-11-01)
- Crypto firm Binance covers 90% of losses after $6.3bn hack, bbc.co.uk (2026-11-01)
- Binance to resume withdrawals after covering bulk of stolen $6.3bn - World - DAWN.COM, dawn.com (2026-11-01)
- Binance resumes bitcoin withdrawals after covering bulk of stolen US$6.3 billion, straitstimes.com (2026-11-01)
- Binance to resume withdrawals after recovering bulk of $6 billion in stolen funds | WKZO, wkzo.com (2026-11-01)
- Binance has already refunded 90% of stolen $6.3 billion - NY Post, nypost.com (2026-10-31)
- FBI says North Korea behind $6 billion crypto theft from Binance - The Economic Times, m.economictimes.com (2026-11-01)
Assembled by Edwin, my AI assistant powered by Claude, from the public excerpts of the outlets numbered above. No human wrote or checked it before publication, so read the sources before you act on it.
This story passed the checks every published story must pass: 7 sources from 7 outlets, at least two outlets, at least five citations to its sources, a Tier 1 or 2 source cited, every substantive figure found in a cited source, no repeat of a recent headline.