Binance Reopens Withdrawals on 15 Networks as Backing Hits 95%
Binance started reopening withdrawals on 15 networks on Nov. 1 and says 95% of the $6.3B stolen in the hack has been replenished. The FBI, joined by the Secret Service and IRS-CI, wants node operators and swap services to block the stolen ETH.
Binance started reopening withdrawals on Nov. 1. Phase one rolls out progressively between 06:00 and 09:00 UTC, after the exchange completed its security and operational checks. The exchange now says 95% of the funds hit in the roughly $6.3 billion theft have been replenished, up from 90% in its Saturday update.
The first phase covers 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Dogecoin, Polygon, Arbitrum, Base, Optimism and Sui. More networks and tokens follow when Binance deems them ready. Deposits stayed available throughout. For background on the breach itself, see our earlier coverage.
Users should expect temporary delays as traffic returns, Binance warned.
BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed. The remaining 5% is less-liquid tokens that are taking longer to source through market and OTC purchases. Binance has promised to absorb the loss itself rather than pass it to users, and plans a full post-incident report once the investigation concludes.
The FBI wants the off-ramps shut
The FBI has already pinned the theft on North Korea. Its news release, issued Saturday, tracks the activity as "TraderTraitor" and says the group has most recently been converting stolen assets mostly into ETH. The Bureau expects further conversion through DeFi protocols and instant swap services as laundering moves into more advanced stages.
The release urges THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions with, or derived from, the listed addresses. The Secret Service and IRS Criminal Investigations joined the appeal. The practical ask is simple: choke the off-ramps before the ETH gets swapped into something harder to trace.
CZ thanked the agencies for their involvement and assistance.
President Donald Trump said he would look into the hack and talk to North Korea if its responsibility is confirmed.
What it means
For traders, the near-term question is flow, not solvency. Reopening withdrawals on 15 networks at once means outbound traffic, and Binance itself is flagging delays. Meanwhile the FBI's warning about instant swaps and DeFi puts a spotlight on exactly the venues the stolen ETH is expected to hit next.
The attribution fits a pattern. A CertiK report attributed more than $2 billion of an estimated $3.4 billion in 2025 crypto losses to North Korea-tied groups, across 79 of 656 incidents. Between 2016 and early 2026, North Korea-linked actors stole an estimated $6.75 billion across 263 incidents, per CertiK citing Taylor Monahan. By that count, this single theft comes close to everything North Korea-linked hackers took in the previous decade.
