Binance, the world’s largest cryptocurrency exchange, resumed withdrawals of Bitcoin, Ether and some stablecoins on Sunday. The decision came after hackers stole cryptocurrency worth around $6.3 billion from the platform.
Binance said it had covered around 95% of the stolen amount by using its own company funds to buy replacement tokens. The exchange also said withdrawals of other affected cryptocurrencies would resume in phases, as reported by Reuters.
First phase allows withdrawals of 15 cryptocurrencies
In the first phase, Binance restored withdrawals for 15 cryptocurrencies. These include Bitcoin, Ether, XRP and Dogecoin. Bitcoin withdrawals resumed shortly after 0600 GMT on Sunday.
Withdrawals of Ether, BNB and some USDT and USDC stablecoins were also restored. Binance said it would gradually allow users to withdraw the remaining affected cryptocurrencies.
Binance has replaced 95% of the stolen cryptocurrency
Binance said it had covered around $6 billion of the $6.3 billion stolen in the attack. The exchange used its own money to buy replacement tokens to cover the losses. The remaining 5% consists of cryptocurrencies that are harder to find and buy in large quantities.
Also read: US inflation rises to 3.6% in September, strengthening bets on Fed rate hike in December
Binance said these assets are less liquid, meaning they cannot be easily bought or sold without affecting their prices. The exchange said it could take longer to arrange the remaining tokens, according to Reuters.
The US Federal Bureau of Investigation (FBI) said on Saturday that a North Korean state-sponsored hacking group called TraderTraitor was responsible for the attack. The group has been linked to cyberattacks carried out to steal money and generate revenue for North Korea.
The FBI said it had observed members of the group converting the stolen cryptocurrency into Ether. It also warned that the hackers could use related technologies to move and hide the stolen assets further.
North Korea has repeatedly denied using state-linked cyber groups for espionage, financial theft and raising money. North Korea’s mission in Geneva and its embassy in China did not respond to requests for comment, according to Reuters.
Hackers stole the cryptocurrency in around 20 minutes
Most of the theft took place within around 20 minutes, starting late on Thursday. The speed and method of the attack were similar to previous major cryptocurrency thefts blamed on North Korea.
US blockchain research firms TRM Labs and Chainalysis said the attack showed similarities to earlier cyberattacks linked to the country. Blockchain analysis firms study cryptocurrency transactions to track how digital money moves between accounts. Analysts had also blamed North Korea for the Binance attack.
US President Donald Trump said on Saturday that the United States was still not certain whether North Korea was behind the attack. “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it,” Trump told reporters.
His comments were posted by an official White House account on X. This came after the FBI publicly identified the North Korean hacking group TraderTraitor as responsible for the attack.
Binance says it will bear the financial losses
Binance has repeatedly said that it will take responsibility for the financial impact of the hack. The exchange said it had internally set aside around $6.34 billion of company funds to cover the losses.
Also read: DoorDash to acquire Instacart in $17 billion deal to expand grocery delivery business
It has also worked with other cryptocurrency companies to freeze some of the stolen assets. Binance said around $3 billion worth of affected assets had been located by Friday. The exchange said it would use its own financial resources rather than pass the losses on to customers, according to Reuters.
Binance said the money used to buy replacement cryptocurrencies came from three sources. These included its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and its corporate treasury.
SAFU is a reserve created by Binance to protect customers in case of security problems or other emergencies. Binance had previously set aside $1 billion for this fund. Co-CEO Yi He said on Saturday that the company would use 50% of its SAFU funds to help cover the losses, according to Reuters. The company also promised to rebuild the fund and bring it back to around $1 billion.
Binance co-CEO calls the incident a complex cyberattack
Binance co-CEO Richard Teng described the security breach as a “complex attack”. He said the attack involved a compromised laptop, which means hackers had gained access to a device, according to Reuters.
The attackers also used malicious software designed to delete evidence of their activities. This made it more difficult for investigators to trace the attack and understand how it happened. The company has been working to investigate the incident and recover the stolen assets.
Cryptocurrency prices fell on Friday following news of the hack. Binance worked to reassure customers that their funds were safe despite the security breach. The company allows users to buy, sell and trade digital assets such as Bitcoin and Ether. Binance had 335 million registered users worldwide, according to the company. It also held around $162.8 billion in customer assets, according to its 2025 annual report.
Binance founder thanks US law enforcement agencies
Binance founder Changpeng Zhao thanked US law enforcement agencies for helping the company after the attack. In a post on X, Binance also thanked the FBI for its support after the agency linked the hack to North Korea.
Zhao said US authorities had played an important role in tracking and freezing the stolen cryptocurrency. He said their work helped limit the damage caused by the attack. Zhao added that the agencies deserved credit for helping prevent a bigger fall in Bitcoin prices.
“A tweet can’t fully express our gratitude,” Zhao wrote on X.
Zhao was previously convicted in the US for failing to maintain an effective anti-money laundering programme at Binance. US President Donald Trump pardoned him in October 2025.
