Binance withdrawals resume date: within 48 hours, as North Korea is blamed for $6.3bn hack
Binance now gives a restart window for withdrawals and says deposits work. Who investigators blame, what is frozen, and what it means for Pakistani users.
Binance says withdrawals should restart within 48 hours, which puts the window at around 9 AM Pakistan time on Sunday, 1 November. Since our first report on the hack on Friday morning, the exchange has also said deposits are working, and blockchain investigators have named a North Korean hacking group as the likely attacker.
When will Binance withdrawals resume?
Co-CEO Yi He posted a service update on X at 9:17 AM Pakistan time on Friday, 30 October: “We expect to begin resume withdrawal services in the next 48 hours.” About 20 minutes later Binance’s main account repeated the timeline, saying withdrawals “remain paused while our team completes a security revamp of the withdrawal service and its related addresses.”
That is a target, not a promise. Binance has not given an exact hour, and later updates said its investigation found more breach points beyond the engineer’s laptop it first blamed. If the clean-up takes longer, the date can slip.
Can I still deposit on Binance?
Both Yi He and the main account now say deposits “remain unaffected and continue to operate as normal.” That does not fit easily with Binance’s own notices overnight, which said all deposits and withdrawals were suspended. The exchange has not explained the change.
Our advice is simple: there is no reason to send fresh money to an exchange that cannot send it back out yet. Wait for withdrawals to work again.
Who hacked Binance?
Nobody has claimed the attack, and no government has formally named anyone. But the blockchain analysis firm TRM Labs said it links the theft “with high confidence” to TraderTraitor, a North Korean group. Security firm Blockaid said the methods were consistent with North Korean operations, and the well-known on-chain investigator ZachXBT pointed to the Lazarus Group, North Korea’s best-known hacking unit.
If that holds, it fits a pattern. The previous record crypto theft, about $1.5 billion from the Bybit exchange in February 2025, was blamed on the same North Korean groups by the FBI.
How much was stolen, and how much is frozen?
Binance puts the total impact at about $6.3 billion. Chainalysis, another analysis firm, estimates the amount taken at between $5.9 billion and $6.4 billion. Before the hack Binance held roughly $144 billion in customer assets, so the loss is about 4% of what it holds.
Around $3 billion is frozen. Tether chief executive Paolo Ardoino said Tether froze more than 1.57 billion USDT, and Circle chief executive Jeremy Allaire said Circle froze more than 800 million USDC. Binance says it will cover the rest from its SAFU emergency fund and company money.
The attacker has not sat still. On-chain records show the hacker borrowing at least 20,000 wrapped ether, about $44 million, on the lending app Aave using stolen USDT as collateral, and swapping coins through Uniswap.
What it did to prices
Bitcoin fell 4.8% on Thursday to below $77,000, Ether lost 5.7% and Binance’s own coin BNB dropped 8%. By Friday morning Bitcoin was back near $78,000 but BNB was still down about 4% on the day. Live prices are on our Money & Markets page.
What it means for Pakistan
Binance is how a large share of Pakistani crypto users, many of them freelancers paid in USDT, move money. The exchange is not yet fully licensed here: the Pakistan Virtual Assets Regulatory Authority (PVARA) gave Binance a no-objection certificate in December 2025 to prepare for a licence, and parliament made PVARA a permanent regulator under the Virtual Assets Act in March 2026. We found no statement from PVARA on the hack by Friday afternoon.
Until withdrawals restart:
- Do not pay anyone to “recover” funds. Binance has warned users not to trust unofficial links or messages about the incident.
- Use only the Binance app or binance.com for updates, and type the address yourself.
- Keep screenshots of any P2P trade that was open when withdrawals stopped.
This is information, not investment advice. The next thing to watch is whether withdrawals actually reopen on Sunday and whether Binance publishes the technical report and updated proof of reserves it has promised.
