Binance, the world's largest cryptocurrency exchange, resumed withdrawals on Sunday, 1 November 2026, after covering 95 per cent of the $6.3 billion in tokens stolen in the largest digital heist on record. The exchange said on its status page shortly after 06:00 GMT that planned withdrawals had begun, starting with 15 cryptoassets including bitcoin, ether, XRP and dogecoin, with other assets to follow in phases.

Binance said it had covered $6 billion of the stolen cryptocurrency by using company money to buy replacement tokens, drawing on its $1 billion Secure Asset Fund for Users, its Futures Insurance Fund and its corporate treasury. It has set aside around $6.34 billion of company funds to cover the losses and says it will bear the financial impact. About $3 billion of the affected assets had been located and frozen with industry partners as of Friday.

FBI names TraderTraitor

The FBI said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the theft, which unfolded in around 20 minutes late on Thursday. Law enforcement observed members of the unit converting stolen assets into ether, and expects further laundering through decentralised finance and instant-swap services. The FBI, the US Secret Service and the IRS Criminal Investigation division have asked exchanges and service providers to block transactions linked to the attackers' published addresses.

Attribution is not unanimous

Pyongyang has for years denied using state-linked cyber units for financial theft, and Binance itself has said its investigation has not attributed responsibility to any individual. US President Donald Trump said on Saturday that the US was still not certain North Korea was involved. The remaining 5 per cent of stolen tokens consists of less liquid assets that may take longer to source, Binance said, and a proof-of-reserves update is expected on Tuesday.