Binance resumes withdrawals after $6 billion crypto shock: What users need to know

In a statement, Binance said it was preparing to resume the first phase of withdrawals on November 1, 2026, between 06:00 and 09:00 UTC.

“Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services,” the company said.

Binance said it had prioritised networks and asset pairs based on user demand over the past week, with services being restored only after completing the necessary stability and security checks.

“More networks and assets will be added as they become ready. Users can confirm availability on the withdrawal page or the network status page, and may see temporary delays or longer processing times during the initial rollout given traffic volume. Failed attempts can be retried after a short while,” the statement added.

Binance covers 95% of funds affected by hack

On the recovery front, Binance said it had now covered approximately 95% of the impacted amount, up from around 90% in its previous update.

“Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are 100% backed and verifiable through the proof-of-reserves snapshot,” the company said.

The remaining 5% involves tokens outside the top 10 by liquidity, which take longer to source at scale through market and over-the-counter (OTC) channels, it added.

Binance said it had suspended withdrawals as a precautionary measure to contain potential losses, assess the impact of the attack and complete security checks.

The company also said its teams had conducted enhanced security reviews, verified withdrawal infrastructure, coordinated with law enforcement agencies and industry partners to trace and recover the stolen funds, and replenished affected assets using company resources.

North Korean hackers suspected

Meanwhile, cybersecurity experts and cryptocurrency intelligence firms have pointed to North Korea as the possible source of the attack.

Blockchain intelligence firm TRM Labs attributed the incident to TraderTraitor, an elite North Korean hacking group, citing what it described as strong on-chain and off-chain intelligence.

“TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” the firm said in a statement.

TRM Labs added that it was tracking the movement of the stolen funds and alerting industry partners through its Beacon Network.

Singapore-based blockchain tracking firm Pangolin Intelligence also said it believed North Korean hackers were behind the incident.