Binance Restores Crypto Withdrawals After FBI Blames North Korea for Record $6.3B Heist

Key points

• Binance announced on Sunday that it has reopened withdrawals for Bitcoin, Ethereum, and BNB Smart Chain, marking the first phase of restoring user access after the incident.
• The exchange stated it has fully backed 100% of major tokens including BTC, ETH, USDT, and BNB, absorbing the financial impact of the theft to protect users.
• The FBI confirmed late Saturday that North Korean actors were responsible for the theft, noting that stolen assets were converted into Ethereum for laundering.
• Binance is using its Secure Asset Fund for Users and corporate treasury to replenish the remaining 10% of assets, which consist of less liquid tokens outside its top ten holdings.
• The breach, valued at $6.3 billion, remains the largest cryptocurrency heist on record, with initial investigations pointing to a complex intrusion rather than a single compromised laptop.

Background

This incident follows a rapid escalation in late October 2026, when Binance first reported a suspected breach that froze over $2.5 billion in assets. By October 30, the exchange confirmed the full $6.3 billion theft, suspending all deposits and withdrawals. Earlier reports suggested a compromised DevOps engineer’s laptop, but co-CEO Richard Teng later clarified the attack involved a more complex process. Blockchain intelligence firm TRM Labs had previously linked the attack to the North Korean group TraderTraitor, noting that assets were moved across 10 blockchains in approximately 20 minutes. Industry partners, including Tether and Circle, froze over $2.3 billion in related assets to prevent further movement of the stolen funds.

How outlets are covering it

CNBC reports that Binance has resumed withdrawals for major networks and is absorbing the financial loss, while the FBI has officially blamed North Korea. Blockchain News confirms the reopening of Bitcoin withdrawals but notes that Bitcoin is trading below key moving averages, reflecting market caution. While CNBC emphasizes Binance’s commitment to full coverage through its insurance fund, the secondary source highlights the broader market volatility and technical indicators suggesting bearish structure despite the withdrawal restoration. Both sources agree on the scale of the theft and the involvement of North Korean actors, but differ in focus: CNBC details the financial remediation and FBI attribution, while Blockchain News focuses on the immediate market reaction and price action.

Why it matters

The restoration of withdrawals signals a critical step in stabilizing confidence in the world’s largest cryptocurrency exchange after a historic breach. The FBI’s attribution to North Korea highlights the growing threat of state-sponsored cyberattacks in the crypto sector. Binance’s decision to absorb the loss using its insurance fund and corporate treasury sets a precedent for how major exchanges may handle future large-scale security incidents, potentially influencing regulatory expectations and user trust in digital asset platforms.

What to watch

Binance plans to continue sourcing the remaining 10% of stolen assets through market and over-the-counter channels until full coverage is achieved. The exchange will maintain transparent reporting on its progress while continuing its investigation into the attack. Market participants will monitor Bitcoin’s price action relative to key resistance levels, as the exchange’s actions may influence broader cryptocurrency market sentiment.