Bottom line up front: The Binance withdrawal restart is targeting Sunday, November 1, after the exchange said it has replenished roughly 90% of the customer balances drained in last week’s record $6.3 billion hot-wallet hack — while the FBI pinned the theft on North Korea’s TraderTraitor crew.
Binance’s hot wallets were hit on October 29 in what security firms TRM Labs and Chainalysis call the largest crypto theft on record. Rather than wait for stolen funds to resurface on mixer-heavy chains, the exchange refilled affected balances from its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and corporate treasury. In plain terms: the till was restocked, not the thief caught.
What the Binance withdrawal restart actually involves
Reporting through October 31 and November 1 puts coverage near 90%, with Binance continuing to buy the remaining affected tokens until coverage reaches 100%. The Sunday resume of user withdrawals is a target conditioned on security checks — not a done deal, and worth watching hour by hour.
One nuance worth internalizing: the 90% figure is Binance’s own account of balance coverage. It does not mean 90% of the stolen cryptocurrency was recovered. Customer-facing balances are being made whole from company war chests while law enforcement traces the remainder.
FBI names North Korea’s TraderTraitor
The FBI attributed the record theft to North Korea-linked actors operating under the TraderTraitor banner — aligning with earlier assessments from TRM Labs and Chainalysis, who pegged North Korea’s 2026 haul at $7.4 billion and cumulative steals at $12.8 billion. Tether and Circle, meanwhile, froze billions in attempted exit liquidity, as we covered when the hack broke.
Official attribution raises the stakes: sanctions enforcement, exchange compliance pressure, and a longer tail of frozen addresses all follow from an FBI naming.
What traders should watch next
- Whether the Sunday withdrawal restart clears its security checks on time — delays would read as unfinished containment.
- Binance’s proof-of-reserves report, scheduled to land Monday, as the independent receipts test.
- Any second-wave freezes from issuers as stolen funds hop chains.
For the broader exchange landscape, the episode compresses the industry’s favorite talking point — proof of reserves — into a live stress test. Refilling user balances buys trust; publishing verifiable reserves keeps it.
Sources: Cointelegraph (November 1, 2026), Binance statements, FBI; prior assessments by TRM Labs and Chainalysis.
