Binance Phases Withdrawals After $6.3B North Korea Theft
Binance has covered about 95% of the stolen funds, and the FBI attributes the breach to North Korea's TraderTraitor group.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Do you trust crypto exchanges to keep your money safe?
Binance began phased withdrawals on Sunday, November 1, 2026, processing $4.65 billion against $1.01 billion of deposits, a net outflow of $3.64 billion. The exchange has covered around 95% of the $6.3 billion stolen in a prior theft, which the FBI has formally attributed to North Korea's TraderTraitor group. This is an operational settlement, not a new product.
Why it matters
The FBI attribution places the theft within a state-linked intrusion campaign rather than an ordinary exchange hack, which shapes how exchanges and node operators are being asked to respond. Phased withdrawals and the coverage of most stolen funds show how large centralized venues are absorbing losses to restore liquidity.
The figures come from exchange withdrawal and deposit flows, with the $6.3 billion theft attribution drawn from FBI findings. Binance processed $4.65 billion in withdrawals against $1.01 billion in deposits, while the remaining share of the stolen total has not been addressed in the source.
The players
Binance
The world's largest crypto exchange by volume, running a centralized trading platform and custody operations for user funds.
TraderTraitor
A North Korea-linked hacking group that the FBI has formally attributed the $6.3 billion theft to.
Thorchain
A decentralized cross-chain liquidity protocol through which onchain tracing showed about $242 million of the stolen funds moving.
The details
Binance is processing withdrawals in phases rather than all at once, which limits the pressure any single batch places on the exchange's reserves. The stolen funds were moved across chains, and onchain analyst SomaXBT traced around $242 million of them through the Thorchain network, a decentralized exchange protocol that swaps assets between blockchains. The FBI, Secret Service and IRS Criminal Investigation have asked node operators, the computers that validate and relay transactions, to block addresses tied to the hackers.
Timeline
Sunday, November 1, 2026: Binance began phased withdrawals.
Friday, October 30, 2026: U.S. spot bitcoin ETFs lost $643 million.
Tuesday, November 3, 2026: U.S. midterm elections.
Friday, November 6, 2026: Jobs report.
The Tech Race
The FBI's attribution of this theft to TraderTraitor places it in a line of North Korea-linked crypto intrusions that law enforcement has tracked across exchanges. Binance's coverage of about 95% of the loss shows how the largest venues are competing to restore user confidence after a state-level breach.
Users withdrawing from Binance are being processed in phases, so timing of access to funds depends on the batch schedule. Exchanges and node operators may also see new requests to block flagged addresses as the investigation continues.
The takeaway
The attribution and the coverage of most losses show how the scale of a state-linked theft is now being handled by exchange balance sheets rather than by users alone. Watch whether the remaining roughly 5% of stolen funds is addressed and whether the FBI-requested node blocks are implemented.
Further reading
For background on how state-linked groups target crypto platforms, see the Cybersecurity coverage.
Source note: This article includes information reported by CoinDesk.
Live Poll
Do you trust crypto exchanges to keep your money safe?
