The largest crypto heist on record entered its recovery phase on Sunday. Binance, the world’s biggest exchange by trading volume, said it would begin restoring customer withdrawals in stages from 06:00 to 09:00 GMT on 1 November, after replacing most of the roughly $6.3 billion of assets stolen four days earlier (The National; Investing.com). The same day the FBI attributed the theft to North Korea’s state-backed TraderTraitor group, which it also blamed for the $1.5 billion Bybit theft in 2025. Bitcoin traded at about $77,845 on Coinbase at 07:03 UTC, roughly 5% below the 81,890 it touched on Thursday, hours before the incident became public.
What Binance announced
According to The National, Binance posted late on Saturday that the first phase of withdrawals would run between 06:00 and 09:00 GMT on Sunday and cover bitcoin, ether, BNB, Solana, XRP, dogecoin and other assets, with more to follow “progressively” as security and readiness checks are completed. Investing.com, which gives the same window as 2 p.m. to 5 p.m. Singapore time, adds that Binance is ordering assets by customer withdrawal demand over the previous week, so the most-requested coins come back first. Deposits, the company says, were never suspended. No timetable for later phases was given in either report.
On the money, the two reports differ slightly, which is itself worth noting. The National says Binance has covered 95% of the $6.3 billion and that the remaining 5% is made up of less liquid assets that may take longer to source in the required amounts. Investing.com says the exchange has replaced “about 90%” of the stolen cryptocurrency. CNBC’s headline on Saturday said 90% of the losses were covered, and Bloomberg’s Sunday headline described the phased restart (CNBC, 31 October; Bloomberg, 1 November); we could not open either article in full. The most likely explanation is that the figure rose from about 90% on Saturday to 95% by Sunday, but none of the reports we read says so, and we have seen no on-chain or audited breakdown. Our Field Guide #72 sets out five checks for exactly this kind of “we have covered the losses” statement.
Who stole it, according to the FBI
The FBI said on Saturday that the theft was carried out by TraderTraitor, a North Korean state-sponsored hacking unit, and that law enforcement had observed members of the group converting the stolen assets into ether; it expects further laundering through related technology (The National). Investing.com notes the same group was linked to the 2025 Bybit theft of $1.5 billion, which the FBI attributed to North Korea in a public service announcement at the time (FBI IC3 alert I-022625-PSA). TRM Labs, a blockchain-analytics firm, has published an analysis titled “North Korea steals $6.36 billion from Binance in the largest hack in history” (TRM Labs); the 6.36 figure differs from Binance’s $6.3 billion by about 1%, a gap that is normal when firms price tokens at different times. Elliptic also published a write-up (Elliptic).
How the attackers got in is still partly open. Binance has said investigators are examining a potentially compromised software engineer’s laptop and other possible entry points, and that it has found no evidence that private wallet keys were exposed (Investing.com). Earlier in the week, Blockaid, a security firm, said a hot-wallet key was involved, a claim we flagged as unresolved in our first report. Both statements cannot be fully right, and neither has yet been confirmed by an independent post-mortem.
Video: Sky News report on the suspected North Korean theft from Binance, published 30 October 2026.
How Binance says it will absorb the loss
Binance’s co-chief executive Richard Teng said losses could be covered from crypto holdings the company has built up from operating revenue, and co-chief executive Yi He said annual revenue would be enough to absorb the impact, according to Investing.com. Binance’s Secure Asset Fund for Users (SAFU), set up in 2018, has typically held about $1 billion; the same report cites DefiLlama data showing Binance holds about $135 billion in assets, against roughly $29 billion at OKX. The company’s line is that customers will not bear the financial losses and that user funds remain safe. If the numbers hold, that is a very different outcome from the exchange failures of 2022; whether they hold is what a reserves report would show, which is why we are watching for the report our Field Guide #71 pre-registered for Monday 2 November. None of today’s articles we read mention it, so we do not know whether it is still on schedule.
Where bitcoin trades
| Coinbase UTC day | Open | High | Low | Close |
|---|---|---|---|---|
| Wed 28 Oct | 80,799.50 | 81,715.01 | 80,270.68 | 81,249.31 |
| Thu 29 Oct | 81,249.32 | 81,890.00 | 77,699.00 | 77,780.33 |
| Fri 30 Oct | 77,782.75 | 78,634.80 | 76,141.02 | 77,180.42 |
| Sat 31 Oct | 77,180.42 | 77,645.12 | 76,954.57 | 77,423.98 |
| Sun 1 Nov (to 07:03 UTC) | 77,423.98 | 77,900.00 | 77,370.00 | 77,834.01 (last candle); ticker 77,844.70 |
Bitcoin has now spent three sessions in a narrow band of about 76,100 to 78,600, after falling 7.0% from Thursday’s high of 81,890 to Friday’s low of 76,141.02 (our arithmetic on the table above); the current price is 4.9% below that high. Equity markets were hit harder on Friday: the Nasdaq Composite fell 2.86% to 25,437.00 on a separate earnings shock, as we reported in our Saturday market note. The weekend reaction in bitcoin has been calm so far, though a reopening of withdrawals can bring large flows in either direction. In the eight past exchange hacks or halts we studied in our analysis, bitcoin’s median move a week later was −8.6%, with only two of eight higher; the seven-day mark for this event is Saturday 7 November, which we will add to that table.
What to watch
- Whether phase two follows quickly and which assets it covers: the order Binance restores coins in is a rough guide to where customers want to leave.
- Any net exchange-outflow data from on-chain firms in the first 24–48 hours after the restart; we will only quote figures that name a method and a date.
- The reserves report, a post-mortem that settles the laptop-versus-hot-wallet question, and any statement from regulators; none had appeared in the sources we read by 07:05 UTC.
- The last 5%: what the less liquid assets are, and by when Binance expects to replace them.
Sources: The National, 1 November, Investing.com, CNBC, Bloomberg, TRM Labs, Elliptic, FBI IC3.
Method: bitcoin prices, highs, lows and closes are Coinbase Exchange candles (UTC day) pulled by Bitcoin Mastery at about 07:05 UTC on Sunday 1 November 2026; the 1 November candle is still open at that time, so the “latest” price is the 07:03 UTC ticker (77,844.70) and the last completed daily close is 31 October (77,423.98). Index, gold, yield and long-history bitcoin figures are Yahoo Finance daily closes (US cash-session closes of Friday 30 October). Third-party figures are attributed to their source and date. Binance’s coverage percentage is its own claim as relayed by the outlets named; we have not verified it on-chain.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.