Binance Reopens Withdrawals on 87 Networks, Targets the Rest Next Week

Key Facts

Binance said on November 14 that it had reopened withdrawals on 87 networks during the week, the latest step in restoring services after a digital asset theft in an attack the Federal Bureau of Investigation attributed to North Korea. The exchange said it was targeting the resumption of withdrawals across all remaining networks and assets by the end of next week. This continues the gradual restart it began in early November, following security checks and service-readiness tests. Networks where service has resumed include Cardano, Avalanche and Litecoin, as well as Aptos, NEAR, Stellar and Algorand. Binance said it was "continuing to make progress in restoring withdrawal services," adding that the end of next week was a target for completing the remaining step.

Binance said withdrawal availability varies by network and asset, and transactions may face temporary delays or take longer as service restoration expands because of traffic volumes. It advised users to check the status of the network and asset before starting a withdrawal. In its first update, the exchange said the order in which assets would be restored would take into account user demand data from the previous week. It also said each asset and network pair would be reinstated after passing stability and security checks. The reopening of the remaining networks is therefore tied to the progress of those checks and the service-restoration sequence announced by the company.

Binance began the first phase of withdrawal restoration on November 1, within a window it said would run from 06:00 to 09:00 UTC. The announcement followed security checks and readiness tests, according to the company. In an update that day, Binance said it had covered about 95% of the affected amount, compared with about 90% in its previous update. It added that the remaining 5% involved tokens outside the top ten it had identified, and that it was continuing to buy the assets needed to cover them. It also said balances of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were fully backed, and that it would absorb the financial losses resulting from the stolen funds.

The Federal Bureau of Investigation attributed the theft of more than $6 billion in virtual assets from Binance to North Korea, saying the incident occurred around October 29 and naming the activity TraderTraitor. In Reuters' account of the attack, the exchange's co-chief executive Richard Teng said the attackers manipulated the transaction approval system to move funds from an internet-connected hot wallet without going through the usual approval controls. Binance said in a November 12 update that it had allocated more than $6.34 billion in company funds to cover the losses. It said the funding came from part of the SAFU fund, part of the futures insurance fund and the company treasury. In the same update, it said it had completed coverage of the affected assets and would replenish SAFU to about $1 billion.

On proof of reserves, Binance said the snapshot dated November 12 covered 198 tokens, and that preparing the full zero-knowledge proof was expected to take about 40 to 50 hours. The FBI said entities linked to TraderTraitor were converting the stolen assets mainly into Ether and might use decentralized finance services and instant exchanges to continue laundering them. On November 12, the Associated Press said U.S. authorities and the private sector had frozen more than $2.7 billion of the stolen funds. The agency added that the Justice Department had obtained a court order to seize or restrict more than $1.2 billion of that total. On service, Binance warned that some transactions could be delayed as it completed the reopening of networks.

Binance said affected assets it no longer supports would be subject to delisting procedures, and holders would receive coverage. It also said it would publish an incident report with further details after the investigation is complete. According to the company, completing withdrawals on the remaining networks and assets is still targeted for the end of next week. Until then, it asked users to check the status of the network and asset before withdrawing, given possible differences in availability or processing time. The follow-up report will be published after the investigation concludes, according to the company's initial service-restoration announcement.