Binance began allowing withdrawals on Sunday after a three-day pause caused by a hack that emptied its hot wallets.

Bitcoin withdrawals reopened at 09:20 Kenyan time, followed at 10:49 by ETH, USDT and USDC on the Ethereum network and USDT, USDC and BNB on the BNB Smart Chain.

The exchange said the remaining assets will be released in phases once security checks are completed, without giving a timetable.

The FBI announced at 01:36 that a North Korean state-linked hacking group called TraderTraitor was responsible for the theft of more than $6 billion in virtual assets from Binance.

The loss is the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

Binance co-chief executives Yi He and Richard Teng later estimated the loss at about $6.3 billion (KSh818 billion) in a Recovery Update posted on Friday.

Independent tracing firms TRM Labs, Chainalysis and Elliptic placed the amount between $6.36 billion and $6.43 billion across ten or eleven blockchains.

Binance reported that about $3 billion (KSh390 billion) of the stolen coins are frozen, mainly stablecoins that issuers can block.

The exchange set aside more than $6.34 billion of its own money to cover the loss, of which $5 billion was already held in the same tokens that were taken.

Coverage of the loss rose from 80 per cent on Friday to 90 per cent on Saturday and 95 per cent on Sunday.

Binance says ten tokens – BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC – are fully backed, while the remaining 5 per cent of smaller tokens are being repurchased on the market and through OTC deals.

The funds used to cover the breach came from Binance’s treasury, its Secure Asset Fund for Users (SAFU) and part of its Futures insurance fund.

SAFU held 15,000 BTC; 7,499 of those left on Saturday evening, valued at about $584 million (KSh75.8 billion), leaving a balance of 7,500 BTC, and Binance plans to refill SAFU to roughly $1 billion.

The Futures insurance fund contributed the portion above the level required by Binance’s rules, with the exchange noting that no platform can completely avoid auto-deleveraging.

Binance repeatedly assured customers that user funds were safe, stating that the hot wallet contained only the exchange’s own money and that customer assets are stored in cold wallets.

However, Binance’s own Proof of Reserves snapshot after the top-up showed 3,654,922 ETH in the hot wallet against a liability of 3,654,919 ETH, a margin of fewer than three coins, while the attacker had taken roughly 200,000 ETH.

New wallets were added to the reserve list on Sunday, and Binance expects the full proof of reserves report, covering the ten fully backed tokens, by Tuesday November 3 (UTC).

The investigation initially suggested a compromised DevOps engineer’s laptop gave the attacker access to a service container, and later identified additional breach points and a self-destruct mechanism that erased tooling and traces.

Binance said the attacker exploited the Ethereum EIP-7702 delegation feature, which the company described as a known multi-signature protocol, although the feature does not require multiple signatures.

Tether blacklisted the attacker’s main address at 00:01 on Friday, ahead of Binance’s announcement of the withdrawal pause.

Tracing firm Elliptic estimated that about $3.21 billion of the stolen assets cannot be frozen, while Bitquery counted roughly $3.1 billion, including 18,270 BTC that has not moved since 23:48 on Thursday.

Elliptic also reported that between $38 million and $67 million in TRX tokens have left the traced wallets, with none yet sent to an exchange or mixer.

Chainalysis chief executive Jonathan Levin and TRM Labs both said the attack was likely carried out by the DPRK group TraderTraitor, while Binance’s own investigation has not assigned responsibility.

The FBI’s statement attributes the theft to TraderTraitor, noting that the group is converting the stolen coins primarily into ETH and laundering them through DeFi and instant-swap services.

US authorities, including the FBI, Secret Service and IRS, are asking those services and exchanges to block transactions linked to the attacker’s addresses, which the FBI published.

Binance thanked the FBI at 08:05 for its assistance.

The Abu Dhabi Financial Services Regulatory Authority, which licensed Binance in December, said it is engaging closely with the exchange and monitoring the incident.

Kenya’s Binance peer-to-peer market continued operating during the pause, with 58 ads at 11:15 on Sunday offering USDT for M-Pesa at roughly KSh130 per USDT.

Kenyan crypto operators must meet a licensing deadline of Wednesday November 4, requiring them to keep customer assets separate and sufficiently funded, a requirement Binance aims to demonstrate with its upcoming proof of reserves.

Users are warned to ignore unsolicited offers on WhatsApp or Telegram to accelerate or “unlock” withdrawals.

As of 11:15 on Sunday November 1, 2026, the exchange rate was USD 1 = KSh129.90 and Bitcoin traded at USD 77,865.