The exchange’s reopening plan marks progress for customers, while an FBI attribution to North Korea underscores the continuing challenge of recovering stolen funds.
MARKET INSIDER — Binance said it would begin restoring cryptocurrency withdrawals on Sunday after covering 95% of the approximately $6.3 billion in tokens stolen from its platform. The announcement offers customers a path toward regaining access to their assets, although it does not establish that investigators have recovered 95% of the original stolen funds. The exchange said less-liquid tokens account for the remaining shortfall and could take longer to source. Separately, the FBI attributed the attack to North Korea’s TraderTraitor cyber operation, adding a formal U.S. government assessment to the ongoing investigation.
Key Highlights
- Binance scheduled its first withdrawal reopening phase for Sunday, including bitcoin, ether, BNB, Solana, XRP and dogecoin.
- The exchange said it had covered 95% of the stolen tokens; the remaining assets are harder to source in sufficient quantities.
- The FBI attributed the theft to North Korea-linked TraderTraitor and warned that laundering efforts would continue.
Withdrawal access to return in stages
Binance said the first phase would begin between 06:00 and 09:00 GMT on November 1, equivalent to 1 p.m.–4 p.m. Vietnam time. The initial group includes several of the exchange’s most widely traded cryptocurrencies, alongside other tokens.
The announcement sets out a reopening timetable rather than confirming that withdrawals have already resumed for every listed asset or network. Customers’ access will depend on the implementation of the phased restart. Reuters reported the planned reopening on Sunday morning. (reuters.com)
Binance said the remaining 5% consists of less-liquid assets that may take longer to obtain in the required quantities.
That explanation highlights an operational challenge following a large exchange theft: restoring access requires having the relevant tokens available, rather than simply holding an equivalent amount of cash or another cryptocurrency.
Covering losses is different from recovering stolen funds
The most important distinction in Binance’s update is between replenishing assets and retrieving the tokens taken by attackers.
An exchange can cover a shortfall using its own resources, replacement purchases or recovered assets. Those processes may help restore customer access, but they have different consequences for the exchange’s finances and the investigation.
The supplied announcement does not provide a detailed breakdown of how Binance reached the 95% figure. It therefore should not be interpreted as evidence that almost all the stolen cryptocurrency has been seized from the perpetrators.
Earlier reports described substantial amounts being frozen with help from token issuers and industry partners. Frozen assets, however, are not necessarily available for immediate use: returning them can require additional technical and legal steps.
For customers, the immediate milestone is the ability to withdraw. For investigators, the separate objective remains securing assets still controlled by the attackers or their intermediaries.
FBI formally attributes the attack to North Korea
In an October 31 statement, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or around October 29. It identified the malicious cyber activity as TraderTraitor.
The bureau said it and its partners at the U.S. Secret Service and IRS Criminal Investigation had observed attackers converting stolen assets primarily into ether. It anticipated further laundering and urged cryptocurrency service providers and analytics firms to help block transactions associated with identified addresses. (fbi.gov)
The statement strengthens the attribution beyond the assessments previously offered by private blockchain investigators. It does not mean the recovery operation is complete.
North Korea has long denied using state-linked cyber operations for financial theft, espionage or revenue generation. Its diplomatic representatives in Geneva and China did not respond to Reuters’ requests for comment.
Why the remaining tokens may take longer
Liquidity determines how readily an asset can be bought or sold without substantially moving its price.
Widely traded cryptocurrencies generally have more available supply across trading venues. Smaller tokens may have thinner order books, fewer active sellers or a larger proportion of supply held outside readily accessible markets.
Consequently, restoring a relatively small portion of the stolen assets can still require considerable time. Aggressive replacement purchases could also push up acquisition costs.
Binance’s explanation concerns sourcing the affected tokens. It does not, by itself, establish the exchange’s remaining net financial loss or the ultimate cost of making customers whole.
Restoring confidence will require more than reopening
A successful withdrawal restart would be an important operational milestone. The next test is whether transfers proceed reliably as access expands across assets and networks.
Further disclosures could clarify how much cryptocurrency has been recovered, how much has been replaced using other resources, and what remains outstanding. A final account of the security failure and the measures taken to address it would also help customers assess the platform’s resilience.
The announced reopening and the FBI’s laundering warning can both be true: Binance may restore customers’ access while investigators continue pursuing stolen funds elsewhere in the financial system.
