Binance Resumes Bitcoin Withdrawals After $6.3 Billion Hack

Binance has resumed withdrawals of Bitcoin, Ether and several other cryptocurrencies after a major cyberattack resulted in the theft of digital assets worth approximately $6.3 billion from the Cryptocurrency exchange. The company said it had used its own financial resources to replace around 95% of the stolen assets and would gradually restore withdrawals of the remaining affected cryptocurrencies.

The first phase of the withdrawal restoration began on Sunday, allowing users to access 15 cryptocurrencies, including Bitcoin, Ether, XRP and Dogecoin. The move came as investigators examined the attack, which the US Federal Bureau of Investigation (FBI) attributed to TraderTraitor, a North Korean state-sponsored hacking group.

Binance said it would bear the financial impact of the incident rather than transfer the losses to customers. The exchange has also been working with other cryptocurrency companies and law enforcement agencies to trace and freeze some of the stolen assets.

Binance Restores Withdrawals for 15 Cryptocurrencies

Binance began restoring cryptocurrency withdrawals in phases on Sunday. During the first phase, the exchange reopened withdrawals for 15 digital assets, including Bitcoin, Ether, XRP and Dogecoin.

Bitcoin withdrawals resumed shortly after 0600 GMT. Withdrawals of Ether, BNB and certain USDT and USDC stablecoins were also restored, allowing users to access several major digital assets again.

The company said withdrawals of the remaining affected cryptocurrencies would be enabled gradually. The phased approach is intended to allow Binance to arrange replacement tokens and manage the availability of assets that may be difficult to obtain in large quantities.

The suspension and subsequent restoration of withdrawals followed the discovery of the large-scale cryptocurrency theft. Binance’s decision to resume services is an important step in its response to the incident, although the exchange has indicated that the restoration process is not yet complete.

Binance Says It Has Replaced Around 95% of Stolen Cryptocurrency

Binance said it had covered approximately 95% of the cryptocurrency stolen in the attack, amounting to around $6 billion of the estimated $6.3 billion loss. The exchange used its own company funds to purchase replacement tokens and restore the affected assets.

According to the company, the remaining 5% consists of cryptocurrencies that are less liquid and harder to purchase in large quantities. Low liquidity means that buying or selling substantial amounts of an asset can be difficult without significantly affecting its market price.

This has made the final stage of the replacement process more complicated. Binance said it could take additional time to source the remaining tokens and complete the restoration.

The exchange has also worked with other cryptocurrency companies to identify and freeze some of the stolen assets. Binance said approximately $3 billion worth of affected assets had been located by Friday.

FBI Links the Attack to North Korean Hacking Group TraderTraitor

The FBI said on Saturday that the attack was carried out by TraderTraitor, a hacking group sponsored by the North Korean state. The group has been linked to cyber operations involving cryptocurrency theft and other activities intended to generate revenue for North Korea.

According to the FBI, investigators observed members of the group converting stolen cryptocurrency into Ether. The agency also warned that the hackers could use related technologies to move the assets through additional transactions and make them harder to trace.

Blockchain analysis firms TRM Labs and Chainalysis also identified similarities between the Binance incident and previous cyberattacks attributed to North Korea. These companies examine cryptocurrency transactions and blockchain records to follow the movement of digital assets between wallets and accounts.

The findings have added to concerns about the involvement of state-linked hacking groups in major cryptocurrency thefts. However, North Korea has repeatedly denied using state-linked cyber groups for espionage, financial theft or revenue generation.

According to Reuters, North Korea’s mission in Geneva and its embassy in China did not respond to requests for comment on the latest allegations.

Trump Says US Has Not Confirmed North Korea’s Involvement

Despite the FBI’s public attribution of the attack to TraderTraitor, US President Donald Trump said on Saturday that Washington had not yet established whether North Korea was responsible.

“We don’t know if it’s North Korea but if it is, we’ll talk to North Korea about it,” Trump told reporters.

His comments were subsequently posted by an official White House account on X. The statement came after the FBI identified the North Korean-linked group as responsible for the cyberattack.

The differing public statements highlight the distinction between the FBI’s attribution of the incident and the President’s remarks about the level of certainty surrounding North Korea’s involvement.

Hackers Stole Cryptocurrency in Around 20 Minutes

Most of the reported theft took place within approximately 20 minutes, beginning late on Thursday. The speed of the transactions and the methods used drew comparisons with previous large-scale cryptocurrency thefts attributed to North Korean hacking groups.

Blockchain research firms TRM Labs and Chainalysis said the attack displayed similarities to earlier cyber operations linked to North Korea. Their analysis focused on the movement of digital assets and transaction patterns associated with the incident.

Cryptocurrency transactions are recorded on blockchain networks, which can allow analysts to trace the movement of funds between digital wallets. However, tracing stolen assets does not necessarily mean that investigators can immediately recover them, particularly when attackers move funds through multiple transactions or use technologies designed to obscure their origins.

The FBI’s warning about the conversion of stolen assets into Ether has also raised concerns about the possibility of further movement and concealment of the cryptocurrency.

Binance Says It Will Bear the Financial Losses

Binance has repeatedly stated that it will take responsibility for the financial impact of the cyberattack. The exchange said it had internally allocated approximately $6.34 billion in company funds to cover the losses.

Rather than passing the cost of replacing the stolen cryptocurrency to customers, the company said it would use its own financial resources to restore the affected assets.

According to Binance, the replacement funds came from three sources:

• Secure Asset Fund for Users (SAFU): A reserve established by Binance to protect customers in the event of security incidents and other emergencies.
• Futures Insurance Fund: A company reserve used to support risk management in futures trading.
• Corporate treasury: Binance’s own company funds used to cover the remaining financial requirements.

The SAFU fund had previously been set at $1 billion. Binance co-CEO Yi He said on Saturday that the company would use 50% of the fund to help cover the losses caused by the attack.

The company also promised to rebuild the reserve and restore it to approximately $1 billion. The use of these funds forms part of Binance’s effort to reassure customers that the security breach will not result in losses being passed on to them.

Binance Co-CEO Calls the Incident a Complex Cyberattack

Binance co-CEO Richard Teng described the incident as a complex cyberattack involving a compromised laptop. A compromised device is one that has been accessed or controlled by an unauthorised party, potentially allowing attackers to obtain information or interfere with systems.

Teng also said the attackers used malicious software designed to delete evidence of their activities. Such software can make it more difficult for investigators to reconstruct the sequence of events and identify the methods used during an attack.

The company has been investigating how the breach occurred while working to recover or replace the affected assets. The incident has also highlighted the security challenges faced by cryptocurrency exchanges, which manage large amounts of digital assets and process transactions across multiple blockchain networks.

Cryptocurrency Prices Fell After News of the Hack

News of the cyberattack contributed to a fall in cryptocurrency prices on Friday. The scale of the reported theft and uncertainty surrounding the affected assets raised concerns among investors and users of the exchange.

Binance responded by reassuring customers about the safety of their funds and explaining how it planned to cover the financial impact. The exchange’s announcement that it had replaced most of the stolen cryptocurrency was part of its effort to restore confidence.

Binance is the world’s largest cryptocurrency exchange by trading activity, according to the supplied report. The company allows users to buy, sell and trade digital assets such as Bitcoin and Ether.

The exchange had 335 million registered users worldwide, according to company figures. It also held approximately $162.8 billion in customer assets, based on its 2025 annual report.

The size of its user base and the amount of cryptocurrency held on the platform underline the potential impact of a security incident of this scale on the wider digital asset market.

Binance Founder Thanks US Law Enforcement Agencies

Binance founder Changpeng Zhao thanked US law enforcement agencies for their assistance following the cyberattack. In a post on X, he acknowledged their role in helping track and freeze cryptocurrency linked to the incident.

Binance also expressed gratitude to the FBI after the agency publicly connected the attack to the North Korean hacking group TraderTraitor.

Zhao said US authorities had played an important role in tracing the stolen cryptocurrency and limiting the potential damage. He added that their work had helped prevent a larger decline in Bitcoin prices.

“A tweet can’t fully express our gratitude,” Zhao wrote on X.

Zhao previously faced a conviction in the United States for failing to maintain an effective anti-money laundering programme at Binance. US President Donald Trump pardoned him in October 2025.

What the Binance Hack Means for Cryptocurrency Users

The incident has renewed attention on the security risks associated with cryptocurrency exchanges and the challenges of protecting digital assets from sophisticated cyberattacks.

Although blockchain transactions are recorded on public networks, stolen cryptocurrency can be moved through multiple wallets and converted into other digital assets. This can complicate efforts to identify the people controlling the funds and recover the stolen tokens.

Binance’s decision to use company resources to replace most of the stolen assets is intended to limit the direct financial impact on its customers. However, the phased restoration of withdrawals shows that the process of arranging replacement tokens and reopening access to every affected cryptocurrency can take time.

For users, the immediate development is the restoration of withdrawals for Bitcoin, Ether and several other supported assets. Withdrawals of the remaining affected cryptocurrencies are expected to resume in phases as Binance completes the replacement process.

The investigation into the attack remains an important part of the response. The FBI’s attribution to TraderTraitor, the analysis by blockchain research firms and Binance’s internal investigation will be central to understanding how the breach occurred and where the stolen assets moved.

Binance Hack: Key Developments at a Glance

Binance’s withdrawal restoration marks a significant development after one of the largest cryptocurrency thefts described in the report. While the exchange says it has replaced most of the stolen assets and will absorb the financial losses, the remaining replacement process and investigation into the North Korean-linked attack are still ongoing.