Binance’s Nov. 1 recovery notice is the primary source for the phased reopening window and its claim that it has replenished about 95% of the impacted value. The company describes these funds as covered or replenished, not as assets recovered from the hackers; its reserve and customer-balance statements have not been independently audited here. Reuters independently reported the same-day plan and the $6.3 billion estimate. The Associated Press reported the FBI’s attribution to TraderTraitor, a North Korean state-sponsored unit. Withdrawal availability is asset- and network-specific, and the announcement warned that processing could be delayed. Both images are dated archive context: a physical Bitcoin token and lock from 2022, and Binance co-founder Changpeng Zhao speaking at Web Summit in Lisbon on Nov. 2, 2022. Neither depicts the breach or current withdrawal operations.
A controlled return for withdrawals
Binance said Sunday it was preparing to reopen withdrawals in phases after temporarily suspending them during a security breach that the company valued at about $6.3 billion. Its first phase was scheduled for between 06:00 and 09:00 UTC on Nov. 1, with access returning progressively across selected assets and blockchain networks.
The exchange warned that processing may be slower and that a listed asset may not be immediately available on every network. The announcement is a plan for a controlled restart, not confirmation that every customer can withdraw every token. Users were directed to check the status of the particular asset-network pair they use.
What ‘95% covered’ means
Binance said it had replenished about 95% of the value affected by the theft, up from 90% in its previous update. It said company resources were being used to replace the stolen tokens and that users would not bear the financial loss. The statement described the funds as covered or replenished; it did not say that 95% of the stolen crypto had been traced or recovered from the attackers.
The company said less-liquid tokens made up the remaining 5% and would take longer to source at the needed scale. It also said balances of several major assets were fully backed. Those are company disclosures, not an independent audit of every affected balance or a completed forensic account of the theft.
A security investigation continues
The FBI said the attack was carried out by TraderTraitor, a state-sponsored North Korean hacking unit, according to Reuters and the Associated Press. Binance has not yet published a final technical report; it said it would do so after the investigation is complete.
The breach exposed how an exchange’s withdrawal controls and hot-wallet operations can become a systemic risk for customers even when transactions settle on public blockchains. For now, the practical test is whether the staged reopening remains stable and whether the company can document how funds were taken, frozen, replaced and protected against another attack.
Sources
3 references
- Binance SupportSecurity Incident | Recovery Update #4: Withdrawals Resume in PhasesPrimary update on the planned 06:00–09:00 UTC first withdrawal phase, eligible networks, delays and the company’s stated 95% replenishment · 2026-11-01
- ReutersBinance to resume withdrawals after recovering bulk of $6 billion in stolen fundsIndependent reporting on the breach, phased restart and FBI attribution; the article’s wording about ‘covering’ is distinguished from recovery in this report · 2026-11-01
- Associated PressFBI blames North Korea for stolen billions from Binance in biggest hack in historyIndependent account of the FBI’s public attribution to TraderTraitor and background on the breach · 2026-10-31
