Binance crypto withdrawals resumed in phases on Sunday after the world’s largest cryptocurrency exchange suffered a record $6.3bn cyber theft on Thursday. The platform halted account transfers following the breach, which the FBI blamed on North Korean state-sponsored hackers, before using corporate reserves to cover user balances.
Key points
- Binance restored withdrawals across its Bitcoin, Ethereum, and Tether networks alongside several alternative tokens after security checks cleared.
- The exchange set aside more than $6.34bn from its treasury to replace customer funds, covering at least 90 percent of the stolen balances immediately.
- Federal investigators accused the North Korean hacking group TraderTraitor of directing the breach and laundering the proceeds through decentralised finance platforms.
- United States President Donald Trump disputed the attribution on Saturday night, saying officials were still investigating whether Pyongyang was involved.
How withdrawals are returning
Binance began reopening access to user accounts between 06:00 and 09:00 GMT on Sunday, starting with the Bitcoin network. The exchange said it evaluated transaction volume over the previous week to decide which networks to restore first.
By 10:00 GMT, customers could withdraw Bitcoin, Ether, BNB, XRP, Dogecoin, and tokens across the Base and Optimism networks. Binance cautioned that heavy transaction volumes could cause temporary delays and advised customers to reattempt failed transfers after a brief pause.
The exchange suspended outbound transactions on Thursday immediately after discovering unauthorised activity. In earlier coverage of the attack, FrontWord reported on how the Binance crypto heist of $6.3bn blamed on North Korean hacking squad shook digital asset markets, sending prices for major tokens lower on Friday.
Binance stated on social media that between 90 and 95 percent of the missing assets were already replenished through company reserves. The remaining portion could take longer to source in open markets without causing price distortions, according to the company.
The scale of the treasury backstop
To prevent runs on customer accounts, Binance committed more than $6.34bn in corporate funds to cover the shortfall. In a public message on Saturday, the company promised that “Binance will absorb the financial impact of these stolen funds, not our users.”
The company said all balances in Bitcoin, Ether, and Tether were fully covered, as were seven other heavily traded digital tokens. The decision to absorb the losses directly mirrors previous safety funds maintained by major exchanges, though none have operated at this scale.
The $6.3bn breach ranks as the largest digital theft in history. It far exceeds the previous record set in February 2025, when hackers took $1.5bn from the Bybit trading platform. The FBI linked that incident to the same state-backed group.
Investigation points to TraderTraitor
On Saturday, the FBI formally attributed the breach to the Democratic People’s Republic of Korea. Federal authorities named TraderTraitor, a hacking collective also known by private cyber intelligence firms as the Lazarus Group, as the primary culprit.
Investigators said they tracked the attackers converting stolen tokens into Ether almost immediately after draining the exchange’s wallets. The agency warned that the hackers would probably use decentralised finance protocols and instant swap services to obscure the movement of the money.
The FBI asked private companies and financial institutions to blacklist wallet addresses associated with the theft. Separately, the US Secret Service said on Friday that it was collaborating with industry specialists to trace and freeze assets linked to the attack.
Binance said that, with help from external security teams and law enforcement, it had already frozen roughly $3bn of the stolen tokens. Recovering those assets from blockchain networks remains complicated once funds move through liquidity pools.
Contradictions over the culprit
Despite the formal statement from the FBI, Donald Trump offered a different assessment on Saturday evening. Speaking to reporters at his home in Florida, the US president questioned whether North Korea was responsible.
“We’re learning about it. We don’t know if it’s North Korea – but if it is, we’ll talk to North Korea about it,” Trump said.
North Korean officials have routinely denied carrying out cyber attacks against foreign financial institutions and cryptocurrency platforms. Security agencies in the West maintain that stolen digital assets form a central funding source for the country’s weapons development programmes.
How the attackers breached Binance
Technical details from Binance indicate that the hackers gained entry through an employee’s computer before moving deeper into the exchange’s infrastructure.
Richard Teng, co-chief executive of Binance, said the intrusion involved multiple people using automated evasion tactics, including a self-destruct mechanism designed to erase evidence of their presence on company systems. While early reports suggested a single compromised engineer laptop was responsible, Binance later confirmed investigators had identified additional breach points.
Founded in 2017, Binance serves hundreds of millions of registered accounts worldwide and processes the largest daily trading volumes in the sector. The exchange said it will release a complete technical post-mortem once engineers and external investigators conclude their review.
