Which cryptocurrencies were included in Binance’s first withdrawal phase after the $6.3 billion theft?

Binance said the initial phase would include bitcoin, ether, BNB, Solana, XRP, dogecoin and other tokens. The exchange planned to begin the phase between 0600 and 0900 GMT on Sunday.

Why could Binance take longer to recover the remaining stolen tokens?

Binance said the unrecovered 5 percent consisted of assets that were less liquid and could take longer to source in the required amounts.

What did the FBI say TraderTraitor did with the stolen Binance assets?

The FBI said law enforcement observed members of the North Korean state-sponsored unit converting stolen assets into ethereum. It also said it expected further laundering through related technology.

Binance to resume withdrawals after recovering bulk of $6 bil. in stolen funds

Listen

Summary

Binance said it would resume withdrawals in phases after covering 95 percent of the $6.3 billion in tokens stolen from its platform, with the first phase starting between 0600 and 0900 GMT on Sunday. The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored unit. Binance said the remaining 5 percent consists of less-liquid assets that may take longer to source.

Key Facts

The first withdrawal phase was set to include bitcoin, ether, BNB, Solana, XRP, dogecoin and other tokens.
The FBI said law enforcement observed TraderTraitor members converting stolen assets into ethereum.
The FBI said it expected further laundering of the assets using related technology.
Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue.
North Korea’s mission in Geneva and embassy in China did not respond to requests for comment.

By Reuters

Published Nov 1, 2026 2:08 pm KST
Updated Nov 1, 2026 2:10 pm KST

Binance logo and hacker code are seen in this illustration taken Oct. 30. Reuters-Yonhap

Binance, the world’s biggest cryptocurrency exchange, said it would resume withdrawals in phases after covering 95 percent of the $6.3 billion in tokens stolen from its platform in the world's largest digital heist, which the FBI has tied to North Korea.

Binance said phase would start between 0600 and 0900 GMT on Sunday and include bitcoin, ether, BNB, Solana, XRP, dogecoin and other tokens.

The remaining 5 percent of stolen tokens consists of assets that are less liquid and may take longer to source in the required amounts, Binance posted on X late on Saturday.

The FBI said on Saturday the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.

Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue. Its mission in Geneva and embassy in China did not respond to requests for comment.

Members of the unit were observed by law enforcement converting stolen assets into the cryptocurrency ethereum, the FBI said in a statement, adding that it expects "further laundering" of the assets through the use of related technology.

Explore More