Binance Reopens Bitcoin Withdrawals as Hack Recovery Proceeds

Binance began reopening withdrawals on November 1, starting with bitcoin on the Bitcoin network, according to the company's statement reported by AFP. The news agency's Sunday report quotes Binance identifying that network as the first batch opened in phase one. Reuters independently reported the resumption of bitcoin withdrawals. This moves the recovery story beyond an announced restart window, but it does not establish that every asset and network is available or that every customer's transfer has completed.

The FBI attributed the theft of more than $6 billion in virtual assets from Binance to North Korea in an October 31, 2026 cyber alert. The bureau identifies the activity as TraderTraitor and dates the theft to on or about October 29. The bureau has moved beyond its earlier acknowledgment of an investigation by publicly naming the state it holds responsible and describing the movement of stolen assets. It is an agency attribution, rather than a criminal conviction or an announcement that the money has all been returned.

The FBI says it and partners at the U.S. Secret Service and IRS Criminal Investigation observed the actors converting stolen assets primarily into ether. It expects further laundering through decentralized-finance and instant-swap services. The notice asks exchanges, blockchain analytics companies, node operators and other virtual-asset businesses to block transactions connected to listed addresses. The agency describes those addresses as holding or having held stolen assets; the list is an investigative resource, not a public reimbursement ledger.

Binance's November 1 recovery notice set an initial target window of 06:00–09:00 UTC for a phased withdrawal restart. AFP subsequently reported that the Bitcoin network had opened. Deposits remain open, according to the company. Availability still needs to be checked for each asset and network. The notice retains an earlier 90% replenishment figure but later gives 95% as the newer figure. That is Binance's report about replacement funding, not a claim that investigators recovered 95% of the stolen coins.

The new attribution also has a precedent. In a February 26, 2025 alert, the FBI attributed approximately $1.5 billion stolen from Bybit on or about February 21 to North Korea and used the same TraderTraitor designation. That older notice described conversions into bitcoin and other assets across multiple blockchains and sought help disrupting laundering. It supplies documented background for the current response without proving that every technical step in the two attacks was identical.

The initial explanation points to a potentially compromised laptop belonging to a DevOps engineer. Binance said an attacker may have used that access to enter a service container and submit unauthorized withdrawals. It reported finding no evidence that wallet private keys had leaked and said a technical post-mortem would follow once the investigation was complete. A later Binance News update described additional entry points beyond the initial laptop explanation, a development also reported independently by Decrypt. The full attack path remains under investigation. An early assessment of an access path is not a final, independently established root cause.

Independent Associated Press reporting on October 31 corroborates the FBI announcement and the company’s replenishment statements. AP also reported that President Donald Trump, speaking that evening, said investigators were still learning about the case and questioned whether North Korea’s involvement was established. His comments and the FBI’s published attribution are separate statements. The bureau’s written notice remains the primary record of its assessment; a report of the president’s uncertainty should not silently replace it.

Binance founder Changpeng Zhao also commented publicly, according to AP. He said he no longer managed the exchange and expected user funds to be covered. His remarks explain why the founder remains part of the public response, but they should not be confused with a statement that he currently runs the company. The cover photograph shows Zhao at a June 2022 conference; it is not a picture of the incident or its investigation.

For American readers, the provider distinction remains essential. In Reuters’ October 30 reporting, Binance.US, a separate exchange, said it was not affected. That dated statement concerns a different platform. The international exchange’s incident and phased withdrawal plan should not be presented as proof of a loss, outage or recovery at every service using the Binance name. The relevant operational question is which provider, asset and network a specific notice actually covers.

Sources: Binance — October 30 original security-incident update ↗ · Associated Press — company response and founder comments ↗ · Binance News — official October 30 deposit and withdrawal service update ↗ · Binance News — subsequent attack-path investigation update ↗ · Decrypt — independent report of additional breach points ↗ · FBI — October 31 original Binance attribution and laundering alert ↗ · Binance — November 1 phased withdrawal plan and replenishment update ↗ · Associated Press via ABC News — October 31 attribution report and presidential comments ↗ · FBI — February 26, 2025 original Bybit attribution alert ↗ · AFP — November 1 report quoting Binance on Bitcoin withdrawal reopening ↗ · Reuters — November 1 independent report of resumed withdrawals ↗

The $6.3 billion impact estimate and the roughly $3 billion frozen figure are not two amounts to add together. Binance describes the frozen assets as affected funds immobilized with blockchain partners. The chart here reproduces that historical October 30 company snapshot and its approximate values, rather than a current total of frozen assets. It does not label the difference as a final loss, and it does not treat a freeze as money already credited back to customers.

TRM Labs’ original investigation supplies a separate measurement. Its report says an attacker moved approximately $6.36 billion from Binance wallets across ten blockchains, with most transfers occurring in about 20 minutes beginning at 20:05 UTC on October 29. TRM values transfers at asset prices when they occurred and identifies its findings as a snapshot through 00:30 UTC on October 30. That method and cutoff help explain why its numbers should be read with their own labels rather than silently substituted for a later company estimate.

TRM’s original report attributed the attack to North Korea’s TraderTraitor group with high confidence, citing on-chain and off-chain intelligence, and assessed the activity as pointing to compromised hot-wallet signing infrastructure. The FBI’s October 31 notice now supplies a separate official attribution. That later announcement changes the status of the attribution story; it does not automatically validate every detail of a private firm’s reconstruction. The bureau’s short alert does not publish a completed technical post-mortem of Binance’s systems.

Bitquery’s separate tracing report describes approximately $6.3 billion leaving 17 hot wallets on nine chains between 20:04 and 23:56 UTC. Its account distinguishes token freezes from assets still controlled by the attacker and explains that dollar values reflect transfer-time prices. The difference between its nine-chain accounting and TRM’s ten-chain accounting remains a methodological difference in the sources reviewed here. VIRVIB has not reconciled their wallet classifications or independently repeated either firm’s complete transaction analysis.

Bitquery also describes an important reason the asset mix changes during recovery efforts: some stablecoins can be frozen by their issuers, while an attacker may swap them into other assets before a restriction arrives. Its tracing follows those conversions rather than assuming that the coins now in a receiving wallet are identical to the coins originally removed. A large ether balance at a later time therefore need not mean that the same amount of ether was initially taken from Binance.

VIRVIB analysis: a recovery ledger needs several separate columns—what left, how it was valued, what was immobilized, what was returned and what the company replaced. Each answers a different question. Subtracting one provisional headline number from another may produce arithmetic, but it cannot establish customers’ final shortfall without matched definitions and a completed accounting. The figures will remain provisional until the parties publish evidence that connects those stages.

Binance’s replenishment commitment addresses a different part of the accounting. Its November 1 notice says it is buying remaining affected assets through market and over-the-counter channels, while some less-liquid tokens take longer to source. Restoring backing with company resources is not the same process as obtaining stolen assets from an attacker. The FBI’s request to block laundering can therefore remain important even as the exchange reports progress replacing assets. Neither measure alone establishes the final amount returned through law enforcement.

Sources: Binance — October 30 original security-incident update ↗ · TRM Labs — original on-chain investigation and attribution assessment ↗ · Bitquery — original transaction tracing and methodology ↗ · FBI — October 31 original Binance attribution and laundering alert ↗ · Binance — November 1 phased withdrawal plan and replenishment update ↗

The incident raises a practical question about what an exchange balance represents. The SEC’s investor-education staff explains that a crypto wallet generally stores the private keys used to authorize transactions, rather than storing the crypto assets themselves. With third-party custody, a provider manages access to those keys. With self-custody, the holder takes responsibility for managing them. That is a difference in control and responsibility, not a promise that either arrangement eliminates every risk.

The same SEC bulletin distinguishes internet-connected hot wallets from cold-storage options that are generally offline. It notes the convenience of online access alongside cyber exposure, while physical cold-storage devices can be lost, stolen or damaged. Both self-custody and third-party custody can involve hot or cold wallets. The archival hardware-wallet photograph illustrates one storage category; it does not show equipment used by Binance or identify the device involved in the breach.

During an incident, authentic communication becomes part of account security. The FTC explains that phishing messages often impersonate familiar companies, claim an account problem or suspicious activity, and urge recipients to follow a link or supply information. Its guidance is to contact the company through a website or phone number already known to be genuine, rather than using the contact details in an unexpected message. It also recommends software updates and multifactor authentication as layers of protection.

Those precautions should not be read as a finding that a particular Binance customer was phished. The company’s reviewed explanation concerns an engineer’s computer and an internal service, with the full attack path still under investigation. Separating consumer precautions from the incident’s actual technical cause prevents a useful security reminder from becoming an unsupported accusation about how this attack began.

The next substantive evidence will be the promised technical post-mortem, updated reserve disclosures and further service notices confirming asset-and-network availability. The November 1 reopening is a milestone in restoring access, not proof that every service has returned or every pending transfer has settled. The FBI has publicly attributed the theft, but its alert does not announce a completed recovery, a prosecution or final customer reimbursement. Keeping those milestones separate lets readers distinguish a service announcement, replacement backing and recovery of stolen assets.

Sources: Binance — October 30 original security-incident update ↗ · SEC investor education staff — crypto custody basics, December 12, 2025 ↗ · FTC — how to recognize and avoid phishing scams ↗ · FBI — October 31 original Binance attribution and laundering alert ↗ · Binance — November 1 phased withdrawal plan and replenishment update ↗ · AFP — November 1 report quoting Binance on Bitcoin withdrawal reopening ↗