The first phase was reported by the Times of India as scheduled to begin between 0600 and 0900 GMT on Sunday and to include several major tokens. The newspaper said the remaining 5% consisted of less-liquid assets that could take longer to obtain in the required quantities.
The theft has been described by the Times of India and France 24 as the world's largest cryptocurrency or digital-asset heist. Their accounts differ slightly in describing Binance's position: the Times of India says the exchange recovered or secured 95% of the stolen assets, while France 24 says it covered 95%.
The Financial Times reports that Binance will reimburse users whose assets were stolen. The Times of India also reported that the exchange had said it held enough of the relevant digital currencies to cover affected customers and had promised full reimbursement. The available reporting does not establish whether those reimbursements had already been completed.
The FBI attributed or linked the cyberattack to TraderTraitor, described in the reporting as a North Korea-linked or North Korean state-sponsored hacking group. That remains an FBI attribution rather than an independently verified conclusion in the available accounts.
The exact calendar date of the theft is not established in the reporting, and the accounts do not provide a single confirmed timetable for completing the withdrawal restart. They also leave unresolved whether all affected customers have been reimbursed and whether the 95% figure refers to assets recovered, secured or covered.