Binance says it is aiming to restore cryptocurrency withdrawals across all remaining networks and assets by the end of next week, after reopening services on 87 networks during the latest stage of its recovery from a security breach that the FBI has linked to North Korea. The company’s November 14 update marks another step in the phased restoration, but it does not mean every affected asset is currently available for withdrawal.

Rows of server racks inside a data centre
Server racks inside a data centre, illustrating the infrastructure behind digital-asset services. Photo by Carl Lender, CC BY 2.0; source.

In its official recovery update published on November 14, Binance listed 87 networks on which it had reopened withdrawals during the week. It said it would aim to reopen the remaining networks and assets by the end of the following week, while warning that users could experience temporary delays or longer processing times as traffic increases during the rollout.

Reuters reported that the exchange had resumed withdrawals in stages earlier in November after covering about 95 per cent of the $6.3 billion in tokens stolen in the October 29 incident. The company has said it will absorb the financial impact rather than pass the losses to customers.

Physical Bitcoin tokens photographed close up
Physical Bitcoin tokens. Photo by Tim Reckmann, CC BY 2.0; source.

What the latest recovery update confirms

The 87-network figure is a measure of network services restored, not a statement that 87 individual cryptocurrencies are the only assets involved. Each supported network can carry multiple assets, and availability can differ between a token and the blockchain network selected by a customer. Binance therefore directs users to check the withdrawal page or its network-status page for the specific asset-and-network combination before initiating a transfer.

The exchange has also cautioned that restoration is being carried out progressively after security and readiness checks. That approach is intended to reduce the risk of reopening a service before the relevant controls are in place. However, it means customers should not assume that an asset is withdrawable simply because other tokens on the same platform have become available.

How the $6.3 billion breach unfolded

The incident came to light on October 29, when Binance reported unauthorised withdrawals and temporarily suspended affected services while it investigated. In its initial statement, the company said the incident may have involved a compromised DevOps engineer’s laptop that gave an attacker access to a service container. Binance said it had found no evidence that wallet private keys had been leaked and estimated the impact at about $6.3 billion.

The Reuters investigation published on November 3 described a months-long operation involving compromised computers belonging to three software engineers. The reported methods included malicious software presented through a fake job interview and the theft of credentials that attackers later used to reach wallet systems. Binance said the incident involved multiple security failures and pledged to publish a fuller technical account after its investigation.

Rows of illuminated cryptocurrency mining machines inside a mining farm
A Bitcoin mining farm, used as an illustrative image of cryptocurrency infrastructure. Photo by Marko Ahtisaari, CC BY 2.0; source.

On October 31, the FBI publicly attributed the theft to TraderTraitor, a North Korean state-linked cyber operation. The bureau said investigators had observed the actors converting stolen assets primarily into ether and warned that further laundering through decentralised-finance and instant-swap services was expected. North Korea has denied responsibility, according to The Washington Post’s November 3 report.

Customer protection and the remaining questions

Binance has repeatedly said that customers will not bear the financial loss. Its initial incident statement said it would use company resources and its Secure Asset Fund for Users to cover the impact. The Associated Press reported that the exchange and blockchain partners had frozen roughly $3 billion in affected assets during the early response, while stablecoin issuers also froze funds associated with the incident.

Those assurances are important, but the full recovery still depends on several separate processes: replacing affected tokens, restoring each withdrawal route, completing security reviews, tracking stolen assets and publishing enough technical information for customers and outside specialists to assess what happened. A promise to cover losses does not by itself establish that every system weakness has been fixed.

Binance’s next-week target is therefore a company timetable, not a guarantee that every asset will be available at a specific hour. The exchange’s own notice says users should check current network status and expect possible delays while the restoration continues.

HeadlinesXtra Analysis

Reopening 87 networks is a meaningful operational milestone, but the most important measure for customers is whether the particular asset they hold can be withdrawn reliably and securely. The distinction between network restoration and asset availability should remain clear in public updates, especially when customers may interpret a broad reopening announcement as confirmation that all services have returned to normal.

The incident also shows why security at a major exchange cannot be judged only by whether private keys were exposed. Social engineering, compromised employee devices, internal permissions and transaction-authorisation systems can create serious risks even when the core key-management architecture remains intact. The investigation’s findings should lead to transparent disclosure of the attack path, independent security reviews and evidence that the corrective controls work.

For the wider cryptocurrency market, the episode is a reminder that the convenience of centralised exchanges comes with operational and counterparty risks. Customers should verify withdrawal availability through official status channels, avoid links sent by strangers and never share recovery phrases or authentication codes. The recovery target is encouraging, but confidence will depend on sustained service stability and a credible post-incident account.

Sources and Further Reading