Something big changed in the Binance story this weekend. The FBI has now named who it blames. And Binance has started letting people take out bitcoin again.
Binance is the world's largest crypto exchange. In plain terms, it is a platform where people trade and store digital coins.
What happened
Late on Thursday, 29 October 2026, about $6.3 billion in digital assets was taken from Binance. Reuters, citing blockchain analysis firms TRM Labs and Chainalysis, says most of the theft unfolded in around 20 minutes.
By Friday, Binance said about $3 billion had been located, working with industry partners. That does not mean all of that money is back in customers' hands. It means those assets had been tracked down or frozen, according to the company.
Then came the naming. On Saturday, 31 October, the FBI said the North Korean state-linked unit known as TraderTraitor was responsible. The Hindu BusinessLine, reporting the FBI statement on 1 November, notes the same actors were behind the $1.5 billion Bybit hack last year.
The FBI said it had seen the stolen assets being changed mainly into ether. Ether is a widely used cryptocurrency. The FBI also warned that the group is expected to try to move the money further through DeFi and instant swap services. DeFi is short for decentralised finance, meaning financial services that run without one central company in charge. Instant swap services are tools that quickly change one coin into another.
Because of that risk, the FBI asked crypto exchanges, blockchain analytics companies and others to block transactions linked to a list of addresses connected to the theft.
Then, on Sunday, 1 November, came the next step for customers. Binance said on its status page shortly after 0600 GMT that planned withdrawals had begun. The first phase covers 15 cryptoassets, including bitcoin, ether, XRP and dogecoin. Other withdrawals are to follow in phases.
Binance said it had covered $6 billion of the stolen crypto, or 95%, using company money to obtain replacement tokens. On Saturday, the figure reported was 90%. The Sunday update puts it higher, at 95%.
Binance has also said it set aside around $6.34 billion of company funds internally to cover the losses, and that it will bear the financial impact itself. The money for the replacement tokens included money from its $1 billion Secure Asset Fund for Users, known as SAFU, an emergency fund meant to protect customers after a security breach, as well as its corporate treasury. Co-CEO Yi He said on Saturday that 50% of SAFU funds would be used, and the company committed to replenishing the fund to about $1 billion.
The other co-CEO, Richard Teng, has described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity. That is Binance's account of how the attack worked.
Why it matters
This is described as the largest crypto theft on record, and by analysts as possibly the biggest financial robbery ever. Binance has 335 million registered users globally and about $162.8 billion in assets under custody as of its 2025 annual report, according to Reuters. So when withdrawals stop, a lot of people notice. When they restart, it matters too.
Naming an attacker also matters in a different way. It turns a company security failure into a law-enforcement and international story, with other exchanges now asked to block linked money. But naming is not the same as recovering the money. The next part of the story will be about whether frozen funds can actually be returned.
What is confirmed
The FBI statement on 31 October attributes the theft to TraderTraitor, a North Korean unit. The theft took place on or around 29 October, at about $6.3 billion, with most of it unfolding in around 20 minutes. About $3 billion had been located by Friday, according to Binance. Withdrawals began on Sunday, 1 November, with 15 cryptoassets in the first phase. Binance says it has covered $6 billion, or 95%, and has set aside around $6.34 billion in company funds. The FBI says it observed stolen assets being changed mainly into ether, and it has asked others to block linked addresses.
What is still unknown, or disputed
The detailed evidence behind the FBI attribution is not set out in the Reuters and Hindu BusinessLine reports. Pyongyang has for years denied using state-linked cyber units for financial theft, Reuters notes, and its mission in Geneva and embassy in China did not respond to requests for comment. US President Donald Trump said on Saturday that the US was still not certain if North Korea was involved, telling reporters: "We don't know if it's North Korea — but if it is, we'll talk to North Korea about it."
It is also not yet clear when the remaining 5% will be fully covered. Binance says those assets are less liquid, meaning they are harder to obtain quickly in the amounts needed, and they may take longer to source. The timing of later withdrawal phases, and whether the frozen $3 billion leads to a full recovery, is also not yet confirmed.
Original source: Reuters, 1 November 2026, "Binance resumes bitcoin withdrawals after covering bulk of stolen $6.3 billion" — https://www.reuters.com/legal/government/binance-resumes-bitcoin-withdrawals-after-covering-bulk-stolen-63-billion-2026-11-01/ — with the FBI statement of 31 October 2026 reported by The Hindu BusinessLine on 1 November 2026.
Do you think naming the attackers will help get the stolen money back, or will it mainly push exchanges to tighten their own security first?