The FBI has linked the theft of more than $6 billion from crypto exchange Binance to the North Korean-linked group TraderTraitor. The exchange has announced a phased resumption of cryptocurrency withdrawals and said it has restored about 95% of affected assets. Access to operations will be opened gradually — by individual networks and cryptocurrencies.

In a statement dated October 31, the US Federal Bureau of Investigation attributed the attack to North Korea. The agency refers to this North Korean cyber activity by the name TraderTraitor.

According to the FBI and partner agencies, the attackers are converting the stolen assets primarily into Ethereum (ETH). Investigators expect further money laundering through decentralized financial services and instant exchange platforms. Crypto market participants have been urged to block transactions related to the hackers' published addresses.

This is the official attribution of the attack. The agency did not report any arrests of perpetrators or recovery of the entire stolen amount.

Binance dates the hack to October 29 and estimates losses at roughly $6.3 billion. According to the exchange's update of November 1, the start of the first phase of resuming withdrawals is scheduled for between 06:00 and 09:00 UTC — 08:00 to 11:00 Kyiv time.

The first phase covers 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, Tron and XRP. The Ethereum network will allow withdrawal of ETH, USDT and USDC, while Tron will support TRX and USDT. The remaining networks and assets will be added as they become ready.

The announced launch window does not mean simultaneous restoration of all operations. Binance suggests checking the withdrawal page to confirm the availability of a specific cryptocurrency on the chosen network. During the initial phase, there may be delays due to load. According to the company, deposits remained available.

Separately, the exchange reported that the share of restored assets has grown from 90% to about 95%. The remaining 5% consists of less liquid tokens, which are harder to purchase in the required volume.

Earlier, Binance announced the allocation of over $6.34 billion of its own funds to cover the losses. Among the sources of restoration, the company cited corporate reserves, part of the user protection fund SAFU, and part of the futures market insurance fund.

Covering losses with exchange resources does not mean the return of what was stolen by hackers. Binance is purchasing crypto assets to replace the lost ones and promises to absorb the financial damage itself. At the same time, restoring reserves and opening withdrawals are separate processes: even a secured balance does not guarantee that operations on all networks are already available.

Sources: FBI, Binance — recovery plan for withdrawals, Binance — covering losses