Binance began gradually restoring withdrawals on 1 November after suspending them following a cyberattack in which about $6.3bn in assets was stolen. According to France 24, withdrawals through the Bitcoin network were the first to resume. This does not mean all services are back: access to other networks and assets is due to return in stages.
The exchange says the pace of reopening will depend on stability and security checks, as well as user demand. For customers waiting to access their funds, the distinction matters: withdrawals becoming available on one network does not mean every type of cryptocurrency can already be withdrawn.
Company pledges to cover losses
The Guardian reports that Binance says it has replenished 90% of the stolen assets. The company explained that the remaining tokens are less liquid, meaning purchasing them could take longer. Replenishing assets and restoring withdrawals are two separate parts of bringing the platform back into operation.
Both outlets also report Binance’s pledge to use about $6.34bn of company funds to cover the losses. The exchange says users will not bear the financial consequences of the theft. These remain company statements, however, rather than findings from an independent audit presented by the outlets.
We previously covered the scale of the incident in our report on the attack on Binance involving $6.3bn in digital assets. The latest development is the start of the withdrawal reopening process, not confirmation that operations have been fully restored.
FBI points to North Korea-linked group
According to The Guardian and France 24, the US Federal Bureau of Investigation (FBI) attributed the attack to TraderTraitor, a group linked to North Korea. The FBI statement quoted by The Guardian places the theft at around 29 October 2026. That is an approximate date for the earlier attack; withdrawals began resuming on Sunday 1 November.
There is no confirmation at this stage that all networks and assets have been reopened. Binance’s announced return to withdrawal services remains a phased process, dependent on further security checks.
