Binance resumes some withdrawals after a major cryptocurrency theft
Where it stands
Binance began restoring some cryptocurrency withdrawals on 1 November after a theft from its digital wallets. The exchange lets people buy, sell and hold digital assets. It had restricted withdrawals while checking the security of affected systems. Bitcoin, ether and some stablecoin withdrawals have resumed. Other services are returning in stages, so reopening does not mean every asset can already be moved out. Binance says it has replaced 95% of the affected assets using company funds. Buying replacement tokens covers a shortfall for customers; it does not mean the thieves returned those tokens. The US Federal Bureau of Investigation attributes the theft to North Korea. Its statement concerns more than $6 billion stolen on or about 29 October. This is the agency’s investigative finding. The incident raises two connected questions: how an exchange protects assets it holds, and how authorities pursue stolen assets across borders.
Background
A person can hold cryptocurrency through an exchange instead of managing transfers independently. In that arrangement, the exchange controls the systems used to keep and move the assets. The customer therefore depends on both the exchange’s records and its ability to honour a withdrawal. Cryptocurrency transfers require digital authorisation. A private key is secret information that allows its holder to authorise movement of assets. Protecting the systems that use these keys is therefore central to custody. A weakness at an exchange can expose customer assets even when the underlying cryptocurrency network continues to work. This distinction matters in the Binance case. TRM Labs traced transfers from exchange wallets to addresses controlled by an attacker. Its assessment points to a compromise of the exchange’s signing systems. It does not establish that the underlying Bitcoin network itself stopped working. After such a theft, two separate tasks follow. Investigators try to trace and recover the stolen assets. The exchange must also restore secure access and meet its obligations to customers. Replacing missing assets with company money can help with the second task while the first remains unfinished. A frozen asset is also different from a recovered asset. Freezing restricts movement where the relevant operator has that power. Returning the asset to its rightful owner requires further action. These distinctions explain why a large recovery claim needs careful reading.
How it developed
-
29 October 2026; theft identifiedHow it started
The theft exposes the systems used to authorise transfers
TRM Labs traced a large movement of assets from Binance wallets to attacker-controlled addresses. The firm linked the incident to a compromise of wallet-signing systems. Binance restricted withdrawals while investigating the breach. This affected customers’ ability to move assets out of the exchange. The interruption concerned access through the company’s platform, rather than a general shutdown of cryptocurrency networks.
-
31 October 2026Official response
The FBI attributes the attack to North Korea
The FBI identified North Korea as responsible and described the activity as TraderTraitor. It called on cryptocurrency businesses to help block transactions linked to the identified stolen assets. The statement makes an investigative attribution; it does not announce that all stolen funds have been recovered. Tracing assets and securing their return remain separate steps.
-
1 November 2026New fact
Withdrawals restart while replenishment continues
Binance reopened withdrawals for some assets and said others would follow in phases. The company says it is purchasing replacement tokens with its own funds. Less readily available assets take longer to source. For customers, this is a partial restoration of access after the suspension. Availability still depends on the asset and network being reopened.
Why it matters for UPSC
Connect exchange custody with cybersecurity and consumer protection. Distinguish tracing, freezing, recovering stolen assets and replacing customer balances. Explain why cross-border digital transfers require cooperation between investigators and service providers.
Key terms
Sources (3)
- TRM Labs · Analysis of the Binance theft1 Nov, 8:36 pm
- FBI · official · North Korea responsible for Binance attack1 Nov, 8:36 pm
- Reuters / Business Standard · Binance resumes withdrawals after replenishing most affected assets1 Nov, 8:36 pm