Binance began reopening withdrawals on Sunday, November 1, three days after attackers drained about $6.3 billion from the exchange in the largest crypto hack on record. The FBI has pointed to North Korea, while Binance says it has already replaced roughly 95% of the stolen assets.
Withdrawals Return in Phases
Bitcoin was the first network to resume, with withdrawals going live at 06:20 UTC. Ethereum and BNB Smart Chain followed at 07:49 UTC, with USDT, USDC, ETH and BNB among the supported assets. The first phase covers 15 blockchain networks, ranked by user demand over the past week. Binance has not given a fixed timetable for the second phase, and says remaining services will return as security checks are completed, with updates posted in its official announcements .
The exchange also said all withdrawals will now start from newly generated wallets, which are being added to its public proof of reserves list.
How Binance Is Covering the Loss
Binance said it set aside more than $6.34 billion to cover the breach. The money comes from three sources: the SAFU emergency fund, the Futures insurance fund and the corporate treasury. The exchange reported 80% coverage in an early update, then 90%, and later about 95%. The 95% figure is Binance’s own and has not been independently verified.
Binance also says about $3 billion of the stolen assets has been frozen. The company has not yet published a final accounting of losses.
FBI Points to North Korea
The FBI has blamed North Korea for the theft, and Binance thanked the bureau’s cyber branch for its support. Blockchain analytics firm TRM Labs previously attributed the attack to the North Korea-linked TraderTraitor group. According to reports, the attackers took over a main Ethereum hot wallet and quickly split the funds across multiple addresses while exchanges and analysts raced to freeze them.
The attack pushed October hack losses to about $6.48 billion across 56 incidents, according to PeckShield data cited by CoinDesk. A single event accounted for nearly all of it.
Proof of Reserves Slips to Tuesday
Binance published a new snapshot based on balances recorded at 00:00 UTC on October 31, and its public Proof of Reserves page is where users can verify their balances. The full zero-knowledge proof takes an estimated 40 to 50 hours to generate and is now expected on Tuesday, November 3, a day later than first promised. It covers only the ten tokens Binance describes as fully backed, which lets holders of those assets verify that their balances are backed at least 1:1.
Market Reaction
The market has so far taken the recovery plan at face value. Bitcoin was trading around $77,000 over the weekend, down about 4% on the week, while BNB lost less than Bitcoin, Ether or Solana over the same period. The Crypto Fear and Greed Index stood at 30, in the fear zone, on October 31.
The timing is sensitive. US midterm elections take place on November 3, and the October jobs report on November 6 will shape expectations for a possible Federal Reserve rate hike in December. President Trump said the administration is looking into the Binance hack, and calls for tighter crypto rules have grown since the attack.
What to Watch Next
- Whether Binance delivers the full proof of reserves on November 3.
- The timeline for the second phase of withdrawals and for remaining assets and networks.
- Any independent verification of the 95% coverage claim.
- Further freezes or recoveries of the stolen funds.
