Binance resumes crypto withdrawals after major hack blamed on North Korea

Resuming withdrawals means Binance has reopened the ability for customers to transfer cryptocurrency away from its platform. It suspended that function after the hack to protect remaining funds and investigate the damage. The change matters because customers regain access to assets they could not move during the suspension.

Binance said the first withdrawal phase opened the Bitcoin network. It planned to restore other networks and asset pairs gradually, using recent user-demand data. Before reopening each one, the company said it would complete stability and security checks.

This does not mean every withdrawal was instantly available. Binance described a phased process, while also saying user funds remained safe and that it would absorb the stolen funds' financial impact. The pace of reopening depends on network and asset checks, so access may return at different times for different cryptocurrencies.

The attack affected more than $6 billion in cryptocurrency and was described as the world's largest digital heist. The FBI said more than $6 billion in virtual assets were stolen from Binance. That scale makes the incident significant for users, markets, and the exchange's ability to absorb losses.

Binance said it had set aside more than $6.34 billion in company funds to cover losses. It also said this represented coverage of 95% of the $6.3 billion in tokens stolen from its platform. The company stated that users would not bear the financial impact.

The figures show Binance is presenting the theft as a company-funded loss rather than a direct customer loss. Still, the article reports that major cryptocurrency prices fell sharply after news of the attack. The size of the event and its market reaction make the exchange's repayment promise central to restoring confidence.

A phased reopening lets Binance test each cryptocurrency network and asset pair before restoring full access. After a theft affecting more than $6 billion, reopening everything simultaneously could make it harder to identify problems or contain another security issue. Careful sequencing therefore matters for protecting users and the exchange.

Binance said it was prioritizing tokens according to user-demand data from the previous week. Bitcoin was the first network opened in phase one. The company said every network and asset pair would be restored only after stability and security checks were completed.

The immediate reality is that withdrawal access is uneven. Bitcoin users could begin using the reopened network, while other assets remained subject to later phases. Binance did not provide a complete timetable for every network in the article. Its approach links reopening speed to demand, technical stability, and security results rather than a single broad switch.

A hack of this size can damage confidence because it raises questions about whether an exchange can protect assets and keep withdrawals working. It can also trigger rapid selling, especially when users fear further losses or blocked access. The article directly reports that most major cryptocurrency prices fell sharply after the attack became known.

For users, the immediate concern is access to funds. Binance suspended withdrawals, then reopened them gradually. Binance said user funds remained safe and promised to absorb the stolen funds' financial impact. Those assurances may reduce harm, but customers still had to wait while networks underwent checks.

For exchanges, the incident can increase pressure to demonstrate strong security and financial capacity. The article does not measure longer-term effects on prices or customer behavior. However, the combination of a record-sized theft, a withdrawal suspension, and a sharp market fall could make confidence harder to rebuild, even after withdrawals resume.

TraderTraitor is described as a Pyongyang-affiliated group linked to the theft. The FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29, 2026. This attribution matters because the article links the hack to North Korea's wider record of high-profile cyber thefts.

The FBI said it observed TraderTraitor actors converting stolen assets into Ethereum. It expected them to launder the assets further through decentralized finance and instant swap services. Those observations form the public basis given in the article for connecting the group to the stolen funds and North Korea.

The attribution is not presented as universally accepted. Donald Trump said he did not know whether North Korea was involved. The FBI urged private companies to block transactions connected to the addresses used by the actors. The article also says such thefts are believed to help finance North Korea's weapons program.

Cryptocurrency laundering means moving stolen digital assets through transactions designed to make their origin harder to follow. Decentralized finance platforms can provide automated trading, lending, or exchange functions without one central operator. Instant-swap services can rapidly exchange one cryptocurrency for another. These steps may create a more complicated transaction trail.

The article gives a specific example: the FBI observed TraderTraitor actors converting stolen assets into Ethereum. It expected the actors to continue laundering them through decentralized finance and instant swap services. The FBI urged private-sector companies to block transactions involving addresses linked to that activity.

The article does not explain the precise services, amounts, or sequence used. In practice, investigators can examine public blockchain records, while companies may screen addresses and refuse suspicious transfers. The forward challenge is speed: stolen assets can be converted or moved quickly, while exchanges and other services attempt to identify and block connected transactions.

A blockchain is a shared digital record of transactions. A cryptocurrency wallet manages access to assets associated with blockchain addresses. The private key is a secret credential used to authorize transactions. The blockchain then records the transfer, allowing the network to recognize the new controlling address.

If an attacker obtains or controls a private key, the attacker can usually create valid transactions that move the associated funds. The network generally checks whether the transaction is authorized by that key, not whether the person using it is the rightful owner. That is why protecting keys is central to cryptocurrency security. Losing a key can also prevent legitimate access.

The article does not state whether the Binance theft involved stolen private keys, compromised systems, or another method. It only reports the theft, the withdrawal suspension, and the FBI's attribution. Binance's phased reopening and security checks show the practical response after a major breach, but the article provides no technical post-mortem.