Binance Says It Has Recovered or Covered 95% of Record $6.3 Billion Crypto Theft

GLOBAL — Cryptocurrency exchange Binance says it has recovered or covered 95% of the digital assets stolen in a record-breaking $6.3 billion heist and is preparing to resume customer withdrawals in phases, as investigators examine an attack the FBI has attributed to a North Korean state-linked cyber unit.

The scale of the incident makes it one of the most consequential security events in the history of digital assets. The theft has placed renewed attention on the security of exchange wallets, the speed at which stolen tokens can move across blockchain networks and the ability of large platforms to protect customers when a breach occurs.

Reuters reported on November 1 that Binance planned to restart withdrawals in stages. The exchange said the initial phase would cover major assets including bitcoin, ether, BNB, Solana, XRP and dogecoin. Binance said the remaining portion of the stolen value involved less-liquid assets that could take longer to obtain in the quantities needed.

What Binance says it has recovered

Binance has said it recovered or covered approximately 95% of the $6.3 billion in tokens involved. The wording matters: recovery can mean assets have been traced, frozen or returned, while coverage can mean the company uses its own resources to make customers whole. Those are different mechanisms, and the exchange's full accounting will be important for customers and regulators seeking to understand how the losses were addressed.

The company has said the remaining 5% consists of assets that are less liquid and may take more time to source. In practical terms, a token with limited trading volume can be difficult to obtain in a large quantity without moving its market price. A platform may therefore need to arrange liquidity carefully rather than purchase the entire amount immediately.

Binance's commitment to cover customer losses is an important reassurance, but customers and market participants will still want clear information about the incident, the source of funds used for reimbursement, the timeline for full withdrawals and any changes made to prevent a similar event.

FBI attribution and the alleged attackers

The FBI has attributed the attack to TraderTraitor, a cyber group linked by US authorities to North Korea. Reuters and the Associated Press reported that investigators identified the group as responsible for the theft. North Korea has historically denied using state-linked cyber operations for criminal revenue or espionage, and the allegations should be understood as the assessment of US investigators rather than a judicial finding made in a public trial.

Attribution in cybercrime investigations is complex. Investigators examine wallet movements, malware, infrastructure, transaction patterns, operational methods and links to earlier incidents. Blockchain records can make transfers visible, but identifying the people directing an operation requires combining technical evidence with intelligence and investigative work.

The FBI has urged cryptocurrency exchanges and blockchain businesses to identify and block transactions connected to addresses associated with the theft. That request reflects the importance of cooperation across the digital asset ecosystem. A single exchange cannot stop every movement of stolen funds if the assets are routed through multiple services, bridges or decentralised protocols.

Why the scale matters

A theft measured in billions can affect confidence far beyond one company. Crypto markets depend on users believing that platforms can safeguard assets, process withdrawals and respond transparently to emergencies. When withdrawals are paused, even temporarily, customers may worry about whether their balances are accessible and whether other platforms could face similar vulnerabilities.

Large incidents can also prompt regulators to examine custody rules, governance, disclosure standards and the adequacy of internal controls. Exchanges often hold assets on behalf of customers, which creates responsibilities that resemble those of financial custodians even when the assets and technical systems differ from traditional banking.

For institutions considering digital assets, the event reinforces the need to assess operational risk alongside market volatility. A token's price can fluctuate, but the possibility that a wallet or approval process is compromised is a separate risk. Institutions need to understand who can authorise transfers, how approvals are verified, where private keys are held and how unusual activity is detected.

How stolen cryptocurrency can be moved

Blockchain transactions are recorded on public ledgers, which can allow investigators to follow the movement of funds. However, visibility does not mean that recovery is straightforward. Criminals may divide assets into smaller transfers, move them across networks, use exchange services or attempt to convert them into other tokens. Each additional step can complicate tracing and increase the number of companies that need to cooperate.

Investigators have warned that the stolen assets could be converted and laundered through a variety of channels. The FBI's request for industry assistance is designed to make it harder for attackers to turn stolen tokens into spendable funds. Exchanges can screen deposits and withdrawals against known addresses, while analytics firms can help identify suspicious transaction patterns.

Decentralised finance services introduce further complexity because some protocols operate through automated smart contracts rather than a central company able to freeze an account. Even so, service providers, developers, validators and liquidity platforms may have technical or governance mechanisms that can help respond to known illicit activity, depending on how the system is designed.

What customers should look for

Customers should rely on official exchange notices for withdrawal availability and avoid links or messages claiming to offer special recovery assistance. Major incidents attract impersonation scams in which criminals pose as support staff, investigators or recovery firms and ask victims to share passwords, recovery phrases or authentication codes.

Users should never disclose seed phrases or private keys to anyone claiming to help recover assets. They should enable strong multi-factor authentication, use unique passwords, review account activity and verify that any communication comes from the platform's official channels. These steps cannot prevent every platform-level breach, but they reduce the risk of separate account compromises.

For businesses holding digital assets, the incident is a reminder to avoid concentrating all funds in a single hot wallet. Risk controls can include cold storage for long-term holdings, multi-party approval, transaction limits, independent monitoring and documented emergency procedures. The correct design depends on the business's needs and should be tested before a crisis occurs.

What happens next

The immediate test is whether Binance can restore withdrawals safely and provide a clear explanation of how it covered the missing value. Investigators will continue tracing the stolen funds and asking other services to block suspicious transfers. The longer-term test is whether the incident leads to stronger custody practices across the industry.

The event does not prove that all cryptocurrency platforms are unsafe, but it demonstrates that the security of digital assets depends on much more than the blockchain itself. Wallet design, access controls, staff procedures, incident response and cooperation between companies all matter. A public ledger can help investigators follow stolen assets, yet prevention remains the most effective protection for customers.

Reporting note: This article reflects Binance's public statements and reporting by Reuters and the Associated Press on November 1, 2026. The FBI has attributed the attack to TraderTraitor; this is an official investigative assessment. Binance's recovery and coverage figures are company-reported.