Binance, the world’s largest crypto exchange by daily trading volume, said on Sunday 1 November that customer withdrawals had resumed, beginning with the Bitcoin network, four days after a theft of about $6.3 billion that the company has called the largest in crypto history. According to an AFP report published by Yahoo Finance, Binance said it had set aside more than $6.34 billion of its own funds to cover the loss and that it, not its customers, would absorb the financial impact (Yahoo Finance/AFP, 1 November). Bitcoin traded at 78,106.83 on Coinbase at about 07:08 UTC on Monday, up roughly 1% from Friday’s close and 4.6% below the 81,890 it reached on Thursday.
What changed over the weekend
The AFP report says Binance planned to open its first withdrawal phase between 06:00 and 09:00 GMT on Sunday and that the phase went live on the Bitcoin network. The exchange is restoring assets in order of how heavily customers used them over the previous week, and each network and asset pair comes back only after stability and security checks. In other words, the reopening is not a switch but a queue: a customer who holds a smaller token on a less-used network may wait longer than one holding bitcoin. The same report quotes Binance’s statement on X that user funds remain safe.
On coverage, the company’s line has moved over three days. CNBC’s headline on Saturday said 90% of stolen user assets were covered (CNBC, 31 October); the AFP report’s summary says Binance covered 95% of the $6.3 billion. We could not open the CNBC article in full and have no on-chain or audited breakdown, so we treat 90% and then 95% as Binance’s own successive claims, not verified facts. Our Field Guide #72 lays out five checks for exactly this kind of statement, and on those checks Binance’s claim was, as of Sunday, mostly unverified.
The attribution question
The FBI said on Saturday that the theft was carried out by TraderTraitor, a North Korean state-sponsored group, that it had seen the actors converting stolen assets into ether, and that it expected further laundering through decentralised-finance protocols and instant-swap services. It urged private-sector companies to block transactions tied to the addresses the group uses (Yahoo Finance/AFP). Two blockchain-analytics firms had reached a similar conclusion: Elliptic’s write-up is headlined “North Korea likely behind the $6.4 billion Binance hack” (Elliptic) and TRM Labs’ is headlined “North Korea steals $6.36 billion from Binance in the largest hack in history” (TRM Labs).
The political picture is less settled. AFP reports that President Donald Trump, speaking late on Saturday at his Florida residence, said he was not concerned about the incident and that it was not yet known whether North Korea was responsible. That sits awkwardly beside the FBI’s statement the same day, and we have not seen an explanation of the difference; one reading is that the President was distinguishing a law-enforcement attribution from a formal government determination, but that is our speculation, not something either side has said. We take the question up in Field Guide #73, which sets out how to weigh an official attribution.
Video: a news report on Binance’s resumption of withdrawals, published 1 November 2026. A second report, from DawnNews English, is further down.
What is still unanswered
- How the attackers got in. Earlier in the week Binance pointed to a potentially compromised engineer’s laptop and said it had found no evidence that private keys were exposed, while a security firm, Blockaid, said a hot-wallet key was involved. We flagged the conflict in our first report and have seen no independent post-mortem since.
- A reserves report. Our Field Guide #71 pre-registered a Binance reserves report for Monday 2 November. We searched for one at about 07:10 UTC and found none, and the AFP report does not mention it, so we cannot say whether it is on schedule.
- The last 5%. The AFP summary says 95% is covered. What the remaining 5% consists of, and when it is replaced, has not been published in anything we read.
- Laundering. The FBI expects further movement through DeFi and swap services; any freezes or seizures by exchanges and stablecoin issuers would be the first concrete sign of recovery.
Bitcoin’s reaction so far
| Coinbase UTC day | Open | High | Low | Close |
|---|---|---|---|---|
| Thu 29 Oct | 81,249.32 | 81,890.00 | 77,699.00 | 77,780.33 |
| Fri 30 Oct | 77,782.75 | 78,634.80 | 76,141.02 | 77,180.42 |
| Sat 31 Oct | 77,180.42 | 77,645.12 | 76,954.57 | 77,423.98 |
| Sun 1 Nov | 77,423.98 | 78,298.82 | 77,370.00 | 78,230.55 |
| Mon 2 Nov (open candle, 07:08 UTC) | 78,232.49 | 78,762.30 | 77,906.03 | 78,057.34 (spot 78,106.83) |
The pattern is a contained rebound: bitcoin has gained about 2.6% from Friday’s low of 76,141.02 to the 78,106.83 ticker (our arithmetic), while staying inside the band between that low and Thursday’s high. The weekend candle that coincided with the withdrawal restart closed higher by 1.0%. One weekend is not evidence that the market has priced the event; in our study of eight past exchange hacks and halts, the larger moves came over the following week, and the seven-day mark for this event falls on Saturday 7 November.
Sources: Yahoo Finance/AFP, 1 November, CNBC, 31 October, Elliptic, TRM Labs, CNN, 30 October. Previously: our Sunday report.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day) and the Coinbase spot ticker pulled by Bitcoin Mastery at about 07:08 UTC on Monday 2 November 2026; the 2 November candle is still open at that time, so the latest price is the 78,106.83 ticker and the last completed daily close is Sunday 1 November (78,230.55). Long-history bitcoin figures are Yahoo Finance BTC-USD monthly closes. Third-party figures are attributed to their source and date. Binance’s coverage percentage and set-aside figure are its own claims as relayed by the outlets named; we have not verified them on-chain.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.