Binance Restarts Withdrawals After $6.3 Billion Hack Blamed on North Korea

The attack hit Binance on October 29, taking approximately $6.3 billion from the world's largest cryptocurrency exchange. CNA described it as what is believed to be the largest cryptocurrency heist in history.

The reported route into the exchange involved a compromised employee laptop and a hijacked transaction-signing system, according to Times Now. That account said attackers drained wallets across 10 blockchains. Those technical details remain a reported account, rather than a complete public explanation of the breach.

After the October 29 theft, Binance suspended withdrawals, according to ABC. The interruption left customers waiting for access while the exchange worked toward reopening.

On October 31, the FBI attributed the theft to North Korea, The Next Web reported. The bureau identified the activity as TraderTraitor, according to The Verge.

The attribution connects the Binance attack to an established cryptocurrency theft operation. Deutsche Welle reported that the FBI identified the same actors as responsible for a $1.5 billion Bybit hack last year.

Binance said on October 31 that it had set aside more than $6.34 billion in company funds to cover the losses, according to NDTV. That commitment is separate from whether investigators or the exchange have recovered the actual stolen assets.

By November 1, withdrawals were restarting in phases. Le Monde reported that Binance had opened its first round of withdrawals, while CBS said the phased reopening depended on security checks.

Withdrawals have resumed, but access is not yet unrestricted. TechCrunch reported that some withdrawals remain restricted and processing may be delayed. Binance says users will not bear the losses.

Reports differ on the amount restored and how to describe it. The Guardian reported that Binance had replaced 90% of the stolen amount. The Defiant put replenishment at about 95%, with less-liquid tokens making up the remainder, while TechCrunch described 95% as recovered. Those accounts do not establish that 95% of the stolen funds were retrieved from the attackers.

Customers have also moved money out since reopening. The Block reported $3.64 billion in net outflows, which Binance said represented 2.1% of its $171 billion in assets. The exchange said withdrawal volumes declined after an initial spike.

The immediate question is when the remaining withdrawal restrictions and delays will end. The phased reopening remains subject to security checks, according to CBS, and The Defiant reported that less-liquid tokens accounted for the amount still to be replenished.

Investigators are also following the stolen assets. Mint reported that the FBI said law enforcement had observed members of the group converting stolen assets into ether. Tracking those movements is distinct from recovering the money.