Binance update: 95% of stolen assets covered and withdrawals resume in phases, FBI blames North Korea’s TraderTraitor unit

What happened

We first flagged this on October 29, 2026 — here’s what changed. Update Nov 1, 2026, 08:00 ET: Added Binance’s Recovery Update #4 — coverage of the stolen assets rising from 80% to 90% and then to about 95%, phase-one withdrawals resuming on November 1 across 15 networks, the October 31 proof-of-reserves snapshot, and the FBI’s October 31 attribution of the theft to North Korea’s TraderTraitor unit. In that update, published on November 1, Binance said the first phase of withdrawals would run between 06:00 and 09:00 UTC that day, reopening selected assets network by network — bitcoin on the BTC network; ether, USDT and USDC on Ethereum; BNB, USDT and USDC on BNB Smart Chain; and further listed pairs on Tron, Solana, XRP Ledger, Zcash, Dogecoin, TON, Polygon, Avalanche C-Chain, Arbitrum, Base, Optimism and Sui — with each combination reopened only after stability and security checks, and more networks and assets to follow. Deposits stayed open throughout and were not affected. Binance said withdrawals had been paused as a precaution while it contained the loss, assessed the impact, reviewed the affected services and verified its withdrawal infrastructure, and warned that the phased restart may bring temporary delays or longer processing times.

The money side moved in steps across the weekend. Binance said it had set aside more than $6.34 billion in company funds for the incident, drawn from its corporate treasury, a partial deployment of its Secure Asset Fund for Users (SAFU) and part of its futures insurance fund, and that the replenishment ratio rose from about 80% to 90% in its third update and to about 95% in the fourth. The remaining roughly 5% is in tokens outside the ten largest affected assets, which Binance says are less liquid and take longer to source at the required scale through market and over-the-counter purchases. Separately, on Saturday, October 31, the FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack, and that members of the unit had been observed converting stolen assets into ether, with further laundering expected. That is the first law-enforcement attribution in this incident: our original report noted that TRM Labs and Chainalysis had both attributed the attack to TraderTraitor while Binance itself had not attributed it to anyone.

Who is affected

The same customers as in the original report: Binance users worldwide whose balances sit on the exchange. Customers holding the ten largest affected tokens — BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC — are the ones Binance says are now backed 100%, and they are first in line in the phased withdrawal restart. Customers holding the remaining, less liquid tokens are still waiting on the last roughly 5% of the replenishment, and customers on networks outside the phase-one list are still waiting for their withdrawal route to reopen. No customer personal data has been reported taken in this incident, and nothing in this update changes that: what was stolen was cryptocurrency from Binance’s own transaction wallets.

How serious

For customers, the concrete change is that access is coming back — in phases, not all at once. A balance in a phase-one asset on a phase-one network can be withdrawn again once that combination passes Binance’s checks; a balance anywhere else stays locked until its phase arrives, and Binance has given no date for the later phases. The coverage figures are still Binance’s own reporting: the exchange published a proof-of-reserves snapshot taken on October 31, but the full cryptographic proof is still to come, and until it lands the 95% figure rests on the exchange’s word and the reserve snapshot, not on completed independent verification. The FBI’s attribution raises the stakes on the recovery side rather than the customer side — the bureau expects further laundering of the stolen assets, which is part of why roughly $3 billion frozen by industry partners matters. The standing scam risk from our original report is unchanged and is sharpest right now: a phased restart is exactly the moment fake “withdrawals reopened — verify your wallet” pages and fake support accounts do their work.

What to do now

Check whether your asset and network are actually open before you try to withdraw: use the withdrawal page or the network status page inside the official Binance app or on Binance’s official website, which you open yourself — never a link from an email, a text, a social-media reply or a search ad. If a listed withdrawal fails during the first phase, Binance says to wait a short while and try again; delays are expected while traffic is high. Do not act on any message that offers to unlock, expedite or verify your withdrawal for a fee, and never enter a wallet recovery phrase or private key anywhere in connection with this incident: no legitimate step in the restart requires one. If you hold one of the less liquid tokens still in the uncovered 5%, there is nothing to claim or file — Binance says it is buying those assets itself and that users will not bear the loss.

Sources: Binance, Security Incident Recovery Update #4, November 1, 2026 · Reuters, November 1, 2026 · Original report: Binance breach (October 29, 2026)