Binance Reopens Withdrawals After $6.3B Hack

Binance reopened bitcoin withdrawals in phases after a record $6.3 billion hack the FBI ties to North Korea, while bitcoin fell about 5% below $77,000.

Lead

What Happened to Binance?

Attackers breached Binance's wallets in what the company described as a complex attack, and the exchange suspended withdrawals as it assessed the damage. The FBI said North Korean operatives laundered the proceeds by converting stolen assets into Ethereum. The agency did not detail how the intrusion occurred.

TraderTraitor is the same unit blamed for the $1.5 billion theft from the Bybit exchange in February 2025. At $6.3 billion, the Binance theft is more than four times that previous record.

How Much of the Loss Has Binance Covered?

Binance says it has replaced about 95% of the affected assets, up from 80% and then 90% over the preceding days. The exchange said it would absorb the financial impact itself rather than pass it to customers.

The company drew on its Secure Assets Fund for Users, a reserve of roughly $1 billion held in bitcoin. It also used its corporate treasury and its futures insurance fund. The remaining gap is about 5% of the stolen total, roughly $315 million.

Why Did Bitcoin Fall on the News?

Bitcoin dropped about 5% to below $77,000 on Friday, October 30, after the breach became public, because the theft raised the risk of forced selling and shook confidence in the largest trading venue. A hack of this size can also trigger liquidations in leveraged positions and prompt users to move holdings off exchanges.

The decline extended into the weekend before the coverage update and the phased reopening steadied sentiment. Bitcoin recovered toward $78,000 as the exchange confirmed progress on reimbursements.

How Are Withdrawals Being Restored?

Withdrawals are returning network by network rather than all at once. The bitcoin network reopened first, followed by Ethereum and BNB Smart Chain. Binance said further assets would come online progressively as security checks are completed on each chain.

A staged restart limits exposure if attackers still hold access in any part of the system. It also manages the risk of a rush of redemptions at an exchange that has just lost a large share of its reserves.

Security and Geopolitical Dimension

North Korea's state-linked hackers have become a significant source of hard currency for Pyongyang, which faces broad international sanctions. Stolen crypto is typically converted into more liquid assets and moved through mixers and cross-chain bridges to obscure its origin. The Binance case is the second record-setting theft attributed to the same group in under two years, which points to a persistent capability against even well-resourced custodians.

For exchanges, the episode strengthens the case for tighter key management, segregated reserves and faster incident disclosure. For regulators, it adds weight to proof-of-reserves and custody standards.

Outlook

Binance's near-term task is completing the remaining withdrawal phases and closing the final 5% coverage gap. Bitcoin's direction depends on whether withdrawals proceed without disruption and whether flows out of the exchange stay orderly. Law enforcement attention now turns to tracing the laundered Ethereum, though prior North Korean thefts have shown that most funds are rarely recovered.