Binance Restores Withdrawals After Covering 90% of Record $6.3B Hack

Key points

• Binance stated it has covered 90% of the $6.3 billion loss using corporate funds, with the remaining 10% potentially taking longer to source.
• The exchange resumed withdrawals for Bitcoin, Ethereum, BNB, XRP, Base, Doge, and Optimism on Sunday, marking the first phase of a phased restoration.
• The FBI officially blamed North Korea's TraderTraitor unit for the October 29 attack, noting hackers converted stolen assets into Ethereum for laundering.
• Binance co-CEO Richard Teng confirmed the breach involved multiple actors using sophisticated methods, including a self-destruct mechanism to hide tracks.
• The US Secret Service and IRS Criminal Investigation are working with private partners to freeze and trace the remaining stolen assets.

Background

This incident follows a series of major cyber threats in 2026, including a $1.5 billion theft from Bybit in 2025, also attributed to North Korea. Earlier this week, initial reports suggested a smaller $2.5 billion breach, but the total loss escalated to $6.3 billion. The hack triggered a broader sell-off in crypto-related equities, including an 11% drop in Coinbase shares, amid fears of AI-driven hacking waves.

How outlets are covering it

While all outlets agree on the scale of the theft and North Korean involvement, they emphasize different aspects. The BBC and CBS News focus on Binance's financial recovery and the resumption of withdrawals, highlighting the company's pledge to protect users. Fox Business highlights the geopolitical dimension, noting President Trump's cautious response and expert warnings about an upcoming 'AI hacking bloodbath.' The New York Times provides a granular view of the internal response, describing a 'war room' of 100 participants on internal messaging platforms. The FBI and US Secret Service emphasize the technical laundering process, urging exchanges to block specific wallet addresses to prevent further movement of funds.

Why it matters

The $6.3 billion theft is the largest in crypto history, testing the resilience of the world's largest exchange. The FBI's attribution to North Korea and the subsequent industry-wide call to block associated addresses signal a shift toward coordinated defensive measures. The incident also raises concerns about the security of digital assets and the potential for AI-enhanced cyberattacks to target major financial institutions.

What to watch

Binance plans to continue restoring withdrawals for additional assets in phases as security checks are completed. Authorities will continue to trace and freeze the remaining 10% of stolen assets, while the industry monitors for further laundering attempts through decentralized finance platforms. The investigation into the specific breach points, including the compromised engineer's laptop, remains ongoing.