Binance reopens withdrawals as FBI blames North Korea for $6.3B hack

Binance began restoring withdrawals on Sunday, Nov. 1, three days after the Binance hack and withdrawal pause. A day earlier, the FBI formally attributed the theft to North Korea and published hundreds of wallet addresses it wants the crypto industry to block.

The exchange's Recovery Update #4 on binance.com set the first phase for 06:00 to 09:00 UTC and listed 15 networks. Bitcoin went first, at about 06:20 UTC, according to Binance's posts on X. By 07:49 UTC, the exchange said ETH, USDT and USDC on Ethereum and BNB, USDT and USDC on BNB Smart Chain were also available. Solana, Tron, XRP, TON, Polygon, Arbitrum, Base and others are on the phase-one list but open one by one.

Binance says it picked the order using the past week's withdrawal demand. It warns that requests may be slow during the rollout and that a failed withdrawal on a listed network can be retried after a short wait. Deposits were never paused. All withdrawals now leave from newly generated wallets, which Binance has added to its proof-of-reserves address list.

On money, the exchange says it has covered about 95% of the roughly $6.3 billion taken, up from 90% in its previous update. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, per Binance's reserves snapshot. The missing 5% sits in tokens outside that top ten, which Binance says are harder to buy in size on the market and through OTC desks. It has promised a post-incident report once the investigation ends.

The FBI's alert on fbi.gov says North Korea stole more than $6 billion from Binance on or about Oct. 29. The bureau calls the group TraderTraitor. Working with the Secret Service and IRS Criminal Investigation, it says the hackers have been converting stolen assets mostly into ETH and are expected to launder them through DeFi and instant swap services.

That makes the next phase a test for infrastructure that usually claims to be neutral. The FBI asks THORChain node operators, RPC providers, instant exchanges, DeFi services and analytics firms to block transactions with, or derived from, the listed addresses. The list runs to more than 600 Ethereum-format addresses.

Chainalysis wrote on chainalysis.com that the attacker swapped $325 million in stablecoins into $285 million in ETH over about 20 minutes to get ahead of issuer freezes, which started by 5:14 p.m. ET on Oct. 29. The firm puts the theft at about $6.4 billion and says stolen funds mixed on-chain with money from last month's Bitget exploit. It also reported automated laundering patterns, with many addresses first receiving exactly 1 TRX before passing funds on. The Binance haul alone exceeds the total in a study showing crypto lost billions to hacks in two years.

Binance has not said when phase two starts or which networks it will cover.