Binance, the world's largest cryptocurrency exchange by trading volume, began reopening customer withdrawals on Sunday, November 1, after saying it had covered 95% of the roughly $6.3 billion in tokens stolen in last week's record hack. The first phase opened between 0600 and 0900 GMT (11:30 am to 2:30 pm IST), with Bitcoin on its native network leading the way.
The restart comes a day after the FBI publicly blamed TraderTraitor, a North Korean state-backed hacking unit, for the attack. For millions of users, including a large number of Indian crypto traders, it is the first sign that funds frozen since the breach are starting to move again.
What Binance Has Said
In a post on X late on Saturday, Binance said it had sourced 95% of the stolen tokens. The remaining 5%, it explained, is made up of "less liquid" assets that may take longer to buy back in the required quantities. A day earlier, the exchange had said it had set aside more than $6.34 billion of company money to cover the losses.
Binance has repeatedly stressed that customers will not bear the cost. "User funds remain safe. Binance will absorb the financial impact of the stolen funds, not our users," the company said.
How the phased reopening works
Rather than switching everything back on at once, Binance is restoring withdrawals network by network. It said it is prioritising tokens based on user demand over the past week, and that every network and asset pair is checked for stability and security before it reopens.
- Phase one: Bitcoin withdrawals on the Bitcoin network were the first batch opened on Sunday.
- Next in line: According to Binance's update, the first phase also covers major tokens such as ether, BNB, Solana, XRP and dogecoin, which are being switched on in stages.
- Later phases: Less liquid tokens that make up the uncovered 5% are expected to take longer. Binance has not yet shared a timetable for them.
Key Facts at a Glance
| Exchange | Binance (world's largest by daily trading volume) |
| Amount stolen | About $6.3 billion in tokens |
| Company reserve set aside | More than $6.34 billion |
| Share covered so far | 95% |
| Withdrawals restart | November 1, 2026, from 0600–0900 GMT |
| First network reopened | Bitcoin (BTC) network |
| Blamed by FBI | TraderTraitor, a North Korean state-sponsored unit |
The FBI's North Korea Link
On Saturday, the FBI said TraderTraitor was behind the theft. The agency said law enforcement had watched members of the group converting stolen assets into ethereum and that it expected "further laundering" of the funds. Private blockchain investigators had pointed to the same group before the FBI's statement.
North Korea has for years denied using state-linked cyber units for theft or espionage, and its diplomatic missions did not respond to requests for comment. Security researchers and Western governments, however, have long tied a string of large crypto thefts to Pyongyang, saying the money helps fund its weapons programmes. Prices of most major cryptocurrencies fell sharply on Friday when the scale of the hack became clear.
What It Means for Indian Users
Binance is registered with India's Financial Intelligence Unit and is widely used by Indian traders, many of whom have had balances stuck since withdrawals were paused. The reopening means that, network by network, they should be able to move coins to other wallets or exchanges again.
A few practical points for users in India:
- Check the withdrawal status for each coin and network inside the app before sending; a coin may be live on one network but not another.
- Expect delays and higher queues in the first hours, as many users try to withdraw at once.
- Be alert to phishing. Large hacks are often followed by fake "refund" or "claim" messages. Binance's official app and website are the only places to check balances.
- Remember that crypto gains in India are taxed at 30%, with 1% TDS on transfers, regardless of the exchange used.
What Happens Next
The big open questions are how quickly Binance can source the last 5% of less liquid tokens and whether any of the stolen funds can be frozen or recovered as they move through laundering routes. The FBI's warning about further laundering suggests investigators will be tracking the money closely across blockchains and exchanges.
For the wider crypto market, the episode is another reminder that even the largest platforms are prime targets. How smoothly Binance completes its phased reopening over the coming days will shape how much trust it can win back from users.
Comments (0)