Binance has begun restoring cryptocurrency withdrawals in phases after covering approximately 95% of the assets affected by its $6.3 billion security breach, marking a major step in the exchange’s recovery efforts.
The world’s largest cryptocurrency exchange announced on November 1 that it would progressively reopen withdrawals for selected digital assets and blockchain networks after completing security assessments and checks on its affected services. Deposits remained operational throughout the process, according to Binance.
The announcement follows a security incident on October 29, when an attacker moved approximately $6.3 billion in cryptocurrency from Binance-linked wallets across 10 blockchain networks.
Binance said it would absorb the financial impact of the stolen assets rather than pass the losses on to customers.
Binance restores withdrawals in phases
In its latest recovery update, Binance said the first phase of withdrawals would include Bitcoin (BTC), Ether (ETH), BNB, Solana (SOL), XRP, Dogecoin (DOGE), and selected stablecoins and other tokens across supported networks.
The exchange said it was taking a phased approach to ensure that each network and asset was ready before withdrawals resumed. It also warned that users could experience delays or longer processing times during the initial rollout because of high transaction volumes.
Additional assets and networks will become available as Binance completes its operational and security checks. Users have been advised to confirm the status of their preferred asset and network before initiating withdrawals.
The temporary withdrawal suspension was introduced after the breach as Binance worked to contain the incident, assess the damage and secure its withdrawal infrastructure.
The exchange said its teams had reviewed affected services, revoked compromised address authorisations and continued working with law enforcement and blockchain intelligence partners to trace the stolen funds.
Binance says 95% of affected assets are covered
Binance said it had increased the proportion of affected assets covered from approximately 90% in its previous update to 95%.
The exchange had earlier set aside more than $6.34 billion in company funds to cover losses from the incident. Its recovery effort has involved using company resources and reserves, including its Secure Asset Fund for Users (SAFU), while purchasing replacement tokens through cryptocurrency markets and over-the-counter transactions.
Binance said the remaining five per cent consists of tokens outside its top 10 affected assets. These tokens have lower market liquidity, making it more difficult to acquire the required quantities quickly.
The exchange said it would continue purchasing the outstanding assets until all affected balances were fully covered. It also confirmed that balances in several major assets, including BTC, ETH, USDT, BNB, SOL, USDC, XRP and ZEC, were fully backed.
Covering the affected balances is not the same as recovering 95% of the stolen cryptocurrency. Binance is using its own resources to replace the value of affected assets, while the effort to trace, freeze and recover the original stolen funds continues separately.
The exchange also published an updated Proof of Reserves snapshot and said it would provide further verification after the full proof-generation process was complete.
FBI attributes the attack to North Korea-linked hackers
The US Federal Bureau of Investigation (FBI) has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. The agency said the attackers were converting stolen assets into Ether and warned that further laundering activity could follow.
Binance’s initial investigation suggested that the breach may have involved a compromised laptop belonging to a DevOps engineer. The attacker allegedly used access to an internal service to submit unauthorised withdrawal transactions.
The exchange said it had found no evidence that wallet private keys were leaked. However, it has yet to publish a full technical post-incident report explaining every stage of the attack.
The FBI’s attribution adds to the growing scrutiny of North Korea-linked cyber operations targeting cryptocurrency platforms. Binance and its industry partners are continuing to work with law enforcement to trace the stolen funds and identify opportunities to freeze or recover assets.
Binance faces a critical recovery phase
The phased reopening of withdrawals is an important milestone for Binance following the breach, which disrupted customers’ ability to move funds off the exchange.
However, restoring withdrawal access does not conclude the recovery process. Binance still needs to source the remaining less-liquid tokens, complete security checks across additional networks and continue its efforts to trace the original stolen assets.
The incident has also put renewed attention on the security of centralised exchanges and the systems used to authorise transactions. The attack demonstrated how a compromise involving internal infrastructure can potentially lead to substantial losses, even without confirmed evidence of leaked wallet private keys.
Binance has pledged to cover the financial impact of the breach and said the losses will not be passed on to users. Its next steps will involve completing the remaining asset coverage, expanding withdrawal availability and publishing a detailed account of the incident once its investigation is finished.
For now, the exchange’s latest update signals progress on restoring services, but the full recovery and investigation remain ongoing.
Read also: Tether freezes $1.57B in USDT linked to Binance hack