ECONOMY · CRYPTO
Key Facts
- What is new Binance began reopening customer withdrawals in stages on Sunday 1 November 2026.
- The cover Binance says it has already replaced about 95% of the stolen customer assets.
- The suspect The FBI said on Saturday 31 October that North Korea’s TraderTraitor group did it.
- What is left The other 5% sits in tokens that are harder to buy in large amounts.
Binance, one of the world’s largest cryptocurrency exchanges, began paying out customer withdrawals again in stages on Sunday 1 November 2026. This comes three days after hackers took about US$6.3 billion from the exchange on Thursday 29 October.
The FBI said on Saturday 31 October that North Korea was responsible for the theft, which answers the question we left open in our first report. Our first report said that no government had yet confirmed who was behind it.
What Happened on Sunday
Binance said the first phase of the restart began at 06:00 UTC on Sunday and covered 15 coins and networks, among them bitcoin, ether and XRP. Binance said it would reopen the rest in stages.
Binance said each network and asset would reopen only after stability and security checks. The order of reopening followed recent user demand.
Binance data show that between 06:00 and 15:30 UTC customers withdrew about US$4.65 billion and deposited about US$1.01 billion, a net outflow of about US$3.64 billion. That is roughly 2% of the assets the exchange held on 28 October.
Who Pays for the Loss
Binance says it will absorb the loss itself instead of passing it on to customers. It says it has replaced about 95% of the stolen customer assets with company funds, including part of its emergency reserve (the SAFU fund), up from about 90% a day earlier.
That means Binance restored the backing with its own money, not that the stolen funds came back. The remaining 5% is in tokens that are less liquid, so they take longer to buy in the amounts needed.
Live Market IntelligenceCrypto — Live Market Board
Rio Times · Live Market Intelligence
Crypto — Live Market Board
+0.67%
| Instrument | Last | Change | YoY | Prev. | High | Low | Volume |
|---|---|---|---|---|---|---|---|
| BTC | 80,543 | +0.67% | -29.41% | 80,007 | 80,550 | 79,380 | 21,816,416,256 |
| ETH | 2,348 | +1.18% | -43.00% | 2,320 | 2,349 | 2,295 | 8,316,267,520 |
| SOL | 100.98 | +0.22% | -49.19% | 100.75 | 101.04 | 99.17 | 2,110,777,984 |
| XRP | 1.32 | +1.04% | -49.89% | 1.31 | 1.32 | 1.29 | 1,574,615,552 |
| BNB | 750.98 | +1.29% | -34.10% | 741.42 | 751.10 | 733.56 | 1,470,316,160 |
| ADA | 0.21 | -0.30% | -69.21% | 0.21 | 0.21 | 0.20 | 190,120,672 |
| DOGE | 0.08 | +0.78% | -60.98% | 0.08 | 0.08 | 0.08 | 441,746,112 |
| AVAX | 8.84 | -1.36% | -56.54% | 8.96 | 8.96 | 8.67 | 289,961,824 |
| LINK | 11.47 | +0.80% | -37.04% | 11.38 | 11.47 | 11.23 | 248,509,440 |
| DOT | 0.99 | -2.05% | -68.52% | 1.01 | 1.01 | 0.98 | 109,918,912 |
| LTC | 56.59 | -0.13% | -43.06% | 56.66 | 56.87 | 55.70 | 169,852,160 |
| BCH | 290.36 | +3.57% | -47.81% | 280.36 | 292.52 | 277.47 | 195,939,216 |
| TRX | 0.33 | -0.51% | +9.69% | 0.33 | 0.33 | 0.33 | 371,519,040 |
| XLM | 0.17 | +0.21% | -47.60% | 0.17 | 0.17 | 0.17 | 107,134,680 |
| HBAR | 0.08 | -1.56% | -58.82% | 0.08 | 0.08 | 0.08 | 55,674,584 |
| NEAR | 4.62 | +2.60% | +97.50% | 4.50 | 4.64 | 4.39 | 630,712,192 |
| ATOM | 1.61 | -1.48% | -49.28% | 1.64 | 1.64 | 1.60 | 30,012,314 |
| AAVE | 132.37 | -2.36% | -43.78% | 135.57 | 135.87 | 129.56 | 246,790,448 |
Who Is Blamed
The FBI said North Korea stole more than US$6 billion from Binance on or about 29 October 2026 and named the hacking unit TraderTraitor, a group run by the North Korean state. The FBI has said the same unit stole about US$1.5 billion from the exchange Bybit in February 2025, in an earlier FBI alert.
The FBI says the thieves are turning the stolen assets mostly into ether, and it expects them to launder the money through decentralized finance platforms (crypto services with no central company) and instant swap services (sites that trade one coin for another within minutes). It asked companies that run such services to block transactions linked to the addresses the group uses.
What It Means for You
For US readers the main figure is the market: bitcoin closed Friday 30 October at US$77,192, down 4.79% on the week, as we reported in our daily crypto wrap. On the first day customers took out about US$3.64 billion net, the first test of how much trust the exchange kept.
For savers in Latin America and Africa, who often hold dollar-linked tokens on exchanges like Binance, the reopening is good news only in part. Only the first 15 coins and networks are open, so not every balance can move yet.
What Is Not Known
Binance has not published a full report on how the attackers got in, though it has named a compromised engineer’s laptop as a possible entry point. The FBI did not say how either.
The total is also unclear: Binance puts it at about US$6.3 billion, while the FBI says more than US$6 billion. It is not known how much can still be frozen or recovered, or when every network will reopen.
A published cause, full cover of all tokens or a seizure by US authorities would change the picture. A new pause in withdrawals would too.
More: Latin America news in English, every day from The Rio Times.
Frequently Asked Questions
Can I Withdraw My Money From Binance Now?
Partly. Binance restarted withdrawals in stages on Sunday 1 November 2026, starting with 15 coins and networks, and testing continues for the rest.
Will Binance Cover the Stolen Money?
Binance says it will absorb the loss and has replaced about 95% of the stolen customer assets. It has committed to covering the rest, but this is a company pledge and not a legal guarantee.
Who Stole the Money From Binance?
The FBI said on Saturday 31 October 2026 that North Korea was responsible and named the hacking unit TraderTraitor. Binance has not published a full report on how the attackers got in.
Sources: FBI, alert on the Binance theft (31 October 2026); FBI, alert on the Bybit theft (2025); Binance, public statements on withdrawals and cover (31 October and 1 November 2026).
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error · Editorial responsibility: Matthias Camenzind, Editor-in-Chief