Binance Plans a Phased Withdrawal Restart After Its $6.3 Billion Hack as the FBI Blames North Korea: What Crypto Investors Should Know

Three days after the largest crypto theft on record, Binance says customers will be made whole and withdrawals are coming back in stages, while U.S. investigators have named the attackers.

When can Binance users withdraw their crypto again?

Binance said early on Sunday, Nov. 1, that it was preparing to restart withdrawals in phases between 6:00 and 9:00 a.m. UTC that day, starting with major networks such as Bitcoin, Ethereum, BNB Smart Chain and Solana. It said it had covered about 95% of the stolen amount and that users won't bear the losses.

That update, Recovery Update #4, was published early on Nov. 1. Phase one also lists Tron, XRP, Zcash, Dogecoin, TON, Polygon, Avalanche, Arbitrum, Base, Optimism and Sui, with other networks to be added "once they are ready." Binance warned that users may see delays because of heavy traffic and said deposits were never affected. CoinDesk had reported on Saturday that the exchange was on track to reopen withdrawals on Sunday.

What happened in the Binance hack?

The theft happened on or about Oct. 29, according to the FBI. Binance estimates about $6.3 billion in crypto was taken, while the blockchain analytics firm Elliptic puts the total at $6.43 billion, "more than four times the $1.46 billion stolen from Bybit in 2025." Elliptic said the haul included 18,270 bitcoin plus large amounts of the stablecoins USDT and USDC. A stablecoin is a token designed to hold a steady value, usually $1.

CoinDesk noted that the stolen bitcoin alone, worth about $1.4 billion, is more than Tesla's 11,509 bitcoin. Binance's early investigation pointed to a compromised engineer's laptop, though co-CEO Richard Teng later said investigators found additional points of breach. We covered the first market reaction in our story on Coinbase, Robinhood and Strategy shares falling after the hack.

Who does the FBI say was behind it?