What happened
Euronews reported on 2 November 2026 that Binance had begun resuming user withdrawals in phases after a major hack. Binance is described as the world's largest cryptocurrency exchange by daily trading volume. The exchange said it had seen withdrawals of around $4.7 billion on Sunday. Between 06:00 GMT and 15:30 GMT, it said it processed $4.65 billion in withdrawals and $1.01 billion in deposits. The resulting net outflow of $3.64 billion was about 2.1% of the total assets Binance managed.
The reported theft exceeded $6 billion in virtual assets. The FBI dated it to on or about 29 October 2026 and said North Korea was responsible, attributing the activity to TraderTraitor, a group associated with Pyongyang. The bureau said it had observed the actors converting stolen assets into Ethereum and expected further laundering through decentralised finance platforms and instant-swap services. It urged private-sector entities to block transactions with, or derived from, addresses the actors were using to launder funds.
Euronews also said TraderTraitor was the same group blamed for a $1.5 billion theft from Bybit in February of the previous year. That comparison is attribution context rather than evidence that the two incidents used the same method. The supplied account does not describe the exploit path at Binance, the initial point of compromise, or the controls that failed. It does establish that the FBI publicly connected the group to the reported theft and issued a laundering-related warning to private-sector entities.
Binance said it had used company funds to buy tokens to replenish 90% of what was stolen and had set aside more than $6.34 billion to cover losses. The article says the remaining 10% was less liquid. Withdrawals had been suspended after the attack and were returning in phases, with the first phase starting Sunday. The source does not provide a complete schedule for later phases, identify which assets or jurisdictions were included in each phase, or detail how individual customer claims would be resolved.
The attack shook markets: Euronews reported that most major cryptocurrencies fell sharply on Friday. Its reporting does not establish that the hack alone caused those price movements. US President Donald Trump questioned North Korea's involvement, telling reporters: “We don't know if it's North Korea.” Thus, the FBI's attribution and the president's public uncertainty coexist in the account; they should not be collapsed into a settled consensus.
What the archive adds
North Korea used LinkedIn to trick Binance engineer in $6.3 billion hack is earlier coverage of the same theft, describing a fake LinkedIn job interview used to breach Binance. The withdrawal resumption, Binance's stated replenishment and the reported outflow figures are new facts in a known story, not a separate incident.
Trend signal
This event does not materially support a SITE_PATTERNS thesis about AI agents or developer tooling. It is a major exchange-security incident, but the supplied reporting does not describe an AI system, agent runtime, or AI-specific operational boundary. No pattern link is warranted.
Connections to other events
The earlier Field Note on the Binance breach connects the newly reported withdrawal resumption to the account of how the exchange was penetrated: a fake job interview on LinkedIn. The current report adds the response and liquidity picture—phased withdrawals, Binance's stated replenishment and the measured net outflow—rather than another description of the initial intrusion.
The Euronews report also places the FBI's TraderTraitor attribution beside the group's alleged involvement in the earlier Bybit theft. That is a connection through the named group and the FBI's warning about conversion into Ethereum and possible laundering through decentralised services. It does not establish a shared technical exploit or prove that every reported asset flow is connected to that group.
Why it matters
Teams that connect agents or software workflows to crypto exchanges should treat custody and recovery as dependencies, not assume that API availability or account balances are insulated from a platform incident. A large operator can resume withdrawals in phases while users collectively move billions of dollars, creating operational and market exposure beyond the original compromise. Systems that rebalance, settle, pay contractors, or monitor collateral through an exchange can face a changed operating environment even after a withdrawal endpoint comes back.
The figures also show why incident communications need to distinguish gross withdrawals from net outflows: $4.65 billion left during the reported window, but $1.01 billion entered. For builders, the practical lesson is to define what their systems do when a venue pauses transfers, limits access or reports a loss. Keep human authorization, alternate settlement procedures and clear state checks outside an agent's assumptions. A resumed service is an operational signal, not by itself evidence that custody, liquidity and attribution questions are fully resolved.
Limits and uncertainty
This is Euronews' account of statements from Binance and the FBI, not an independent forensic report. The material does not explain the exploit path, identify the affected assets or customers, or show how Binance calculated the amount lost and replenished. It gives one withdrawal-and-deposit window, not a complete account of activity after withdrawals resumed.
The FBI attributed the theft to North Korea, while Trump publicly questioned that attribution; the supplied material does not resolve the disagreement. Nor does it establish the eventual recovery of the less-liquid remainder, the final customer impact, whether blocked addresses can be comprehensively identified, or whether withdrawals continued normally after the initial phased reopening.
Reader takeaway
Binance's phased reopening is a meaningful operational development, but it is not proof that the theft has been fully recovered or that the incident's attribution is uncontested. The clearest near-term indicators in the report are the exchange's stated 90% replenishment, the $3.64 billion net outflow in a defined window, and the FBI's laundering warning. Builders should plan for exchange access and custody to fail independently of their own software.
Open question
How will Binance account for the less-liquid 10% it says remains unreplenished, and what evidence will clarify the attack and attribution?