Cryptocurrency exchange Binance has begun gradually restoring customer withdrawal services following a massive security breach involving the reported theft of digital assets worth approximately ₹59,900 crore (around $6.3 billion). The exchange started reopening selected withdrawal channels on November 1, 2026, as it continues security checks and efforts to replenish affected assets.
The phased restoration began at 06:00 GMT and covered an initial three-hour window. Binance said the rollout was designed to manage transaction demand, reduce pressure on its infrastructure and ensure that its systems remained stable while technical reviews continued.
The breach had prompted the exchange to temporarily suspend withdrawal services as a precautionary measure. The latest move represents a gradual return to normal operations rather than an immediate restoration of every withdrawal option.
Selected Cryptocurrencies Receive Withdrawal Access
Binance is prioritising withdrawal services based on customer demand patterns observed during the week before the restoration.
According to the supplied report, the exchange has confirmed full reserve backing for several major digital assets, including Bitcoin, Ethereum, Tether, BNB, Solana, USD Coin, XRP, USD1, RLUSD and Zcash.
The company said customers can monitor reserve information through its public verification platform.
The remaining reported shortfall of approximately 5% concerns less-liquid, non-core tokens. Binance is seeking to replenish these assets through spot-market purchases and over-the-counter transactions.
The exchange has also stated that customer balances remain secure and that it will absorb the financial losses arising from the incident. It reportedly replenished nearly 95% of the stolen assets using its own balance sheet.
These assurances are significant for customers seeking clarity about the availability of their funds. However, the phased nature of the restoration means withdrawal access may depend on the specific cryptocurrency and network involved.
FBI Attributes the Attack to North Korea-Linked TraderTraitor
The breach has also triggered an international investigation. On October 31, the U.S. Federal Bureau of Investigation (FBI) formally attributed the theft to TraderTraitor, a cyber unit it linked to North Korea.
According to the FBI, investigators observed the attackers converting significant amounts of the stolen cryptocurrency into Ethereum. The agency warned that further attempts could be made to move the assets through decentralised finance platforms and instant-swap services.
The attribution follows earlier assessments by blockchain intelligence companies that had linked the incident to the same group. North Korea has historically denied involvement in state-sponsored cyber theft and financial operations.
Investigation Examines Multiple Security Weaknesses
Binance's initial review reportedly focused on the possibility that an employee's engineering laptop had been compromised. Subsequent findings indicated that investigators were examining additional points of entry across the company's systems.
The exchange has also reported that attackers used measures intended to conceal traces of their activity. Binance has maintained that its private keys remained secure, while continuing to work with law enforcement and blockchain specialists to trace the stolen assets.
The company has said it will publish a more comprehensive post-incident assessment after the forensic investigation is completed. The precise sequence of events and the full extent of the security weaknesses have not yet been publicly established.
Billions in Withdrawals Follow Restoration
The reopening of withdrawal services was followed by substantial customer activity. Reuters reported that Binance processed approximately $4.65 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT on November 1.
The resulting net outflow was around $3.64 billion, equivalent to approximately 2.1% of the assets managed by the exchange, according to the company's figures. Binance said withdrawal activity was beginning to stabilise after the initial surge.
The figures indicate that restoring withdrawal access was an important operational milestone, but also that customers were actively moving funds following the incident.
What the Breach Means for the Cryptocurrency Industry
The incident has renewed attention on the cybersecurity risks faced by large digital-asset exchanges. Platforms that hold and process substantial volumes of cryptocurrency must maintain strong controls over digital wallets, employee access, transaction approvals and monitoring systems.
For the wider industry, the case also demonstrates the importance of incident response, transparent customer communication and coordination with law enforcement and blockchain analysis specialists.
Binance has said it will bear the financial impact of the stolen assets rather than pass the losses on to customers. However, the remaining less-liquid token shortfall and the ongoing investigation mean that the recovery process is not yet fully complete.
The coming weeks will be important in determining how much of the stolen cryptocurrency can be traced or recovered and what additional security measures Binance introduces. The incident also highlights the role of financial investigation and forensic support in examining complex financial irregularities and digital-asset-related incidents.