Binance, the world’s largest cryptocurrency exchange, has resumed withdrawals for bitcoin, ether, and certain stablecoins after covering 95 percent of the $6.3 billion in tokens stolen during a recent cyberattack. The incident, which unfolded over approximately 20 minutes late Thursday, is believed by analysts to be the largest crypto heist on record. The FBI has linked the operation to a North Korean state-sponsored hacking group known as TraderTraitor.
The exchange, founded in China, announced on Sunday that withdrawals for 15 cryptocurrencies, including bitcoin, ether, XRP, and dogecoin, had been restored, with additional assets to follow in phases. Bitcoin withdrawals recommenced shortly after 0600 GMT, alongside ether, Binance Coin (BNB), and some stablecoin withdrawals such as USDT and USDC. Binance stated it used company funds to replace $6 billion worth of stolen cryptocurrencies, primarily from its Secure Asset Fund for Users (SAFU), Futures Insurance Fund, and corporate treasury. The remaining 5 percent, composed of less liquid assets, are expected to take longer to recover.
The FBI revealed on Saturday its attribution of the attack to TraderTraitor, a North Korean cyber unit involved in financial theft and espionage, a claim consistent with prior large-scale thefts reportedly linked to Pyongyang. The bureau detailed observing the unit converting the stolen assets into ether and anticipated further laundering through various cryptocurrency technologies. North Korea has repeatedly denied involvement in cyber-related financial crimes; its missions in Geneva and China did not respond to requests for comment. Meanwhile, former US President Donald Trump expressed uncertainty regarding North Korea’s role, stating the US would address the issue diplomatically if the country were confirmed as the perpetrator.
Binance has collaborated with industry partners to freeze approximately $3 billion of the stolen funds. The company vowed to shoulder the financial impact of the breach, having earmarked around $6.34 billion internally to cover losses. Co-CEO Yi He indicated that half of the SAFU reserve would be deployed for this purpose and committed to replenishing the fund back to $1 billion. Her co-CEO, Richard Teng, described the breach as a “complex attack” involving a compromised laptop and malicious software designed to thwart forensic investigation.
Following the hack, cryptocurrency prices experienced a decline on Friday, although Binance reassured customers that their holdings remained secure. The platform serves 335 million registered users globally and held $162.8 billion in assets under custody according to its 2025 annual report. Founder Changpeng Zhao, who was previously convicted in the US for inadequate anti-money laundering controls before receiving a pardon last year, acknowledged the critical assistance of US law enforcement in tracking and freezing the assets. Zhao expressed appreciation for their efforts, noting their role in preventing further instability in the cryptocurrency market after the attack.