Binance has resumed withdrawals of bitcoin, ether, and selected stablecoins after replacing approximately 95% of the $6.3 billion in cryptocurrency stolen from the exchange, as the world’s largest digital asset trading platform works to restore normal operations following a cyberattack attributed by the FBI to North Korea.
The exchange said on Sunday that it had restored withdrawals in phases, prioritizing assets according to customer demand. The first phase covered 15 cryptocurrencies, including bitcoin, ether, XRP and dogecoin, alongside selected USDT and USDC stablecoin withdrawals. Bitcoin withdrawals resumed shortly after 0600 GMT, followed by ether, BNB and some stablecoin transactions.
Binance said it had used approximately $6 billion in company funds to purchase replacement tokens for the stolen assets. The remaining 5% consists of less liquid cryptocurrencies that may take longer to acquire in the required quantities.
Register for the next Tekedia Mini-MBA.
Register for Tekedia AI in Business Masterclass.
Join Tekedia Capital Syndicate and co-invest in great global startups.
The restoration of withdrawals marks a major step in the exchange’s response to one of the largest cryptocurrency thefts on record. However, the scale of the incident and the temporary restrictions on customer access have raised fresh questions about the security of digital asset platforms, the management of customer funds and the ability of exchanges to withstand major cyberattacks.
Binance said withdrawals were stabilizing after an initial surge in customer requests, while deposits remained substantial. The company reported net outflows of $3.64 billion, equivalent to about 2.1% of its assets, as of 1530 GMT on Sunday.
Crypto analytics platform DefiLlama reported higher outflows of $4.36 billion. Binance disputed the accuracy of that figure, saying the calculation did not account for transfers into a newly established company hot wallet. A spokesperson said the exchange’s latest update on X was closer to the actual position, although it also excluded transactions occurring after the update was published.
The difference highlights the difficulty of measuring exchange flows during periods of market disruption, particularly when internal wallet transfers can be interpreted as customer withdrawals. Binance said it was monitoring deposits and withdrawals as services returned in stages.
The FBI said on Saturday that the North Korean state-sponsored cyber unit known as TraderTraitor was responsible for the attack. The agency said investigators had observed members of the group converting stolen assets into ether and expected further laundering through related technology.
The attribution adds to a series of major cryptocurrency thefts linked by US authorities and blockchain investigators to North Korean cyber operations. Pyongyang has repeatedly denied using state-linked hacking units for espionage, financial theft and revenue generation. Its mission in Geneva and embassy in China did not respond to requests for comment.
US blockchain analysis firms TRM Labs and Chainalysis had also attributed the attack to North Korea. They said the bulk of the theft occurred within approximately 20 minutes late on Thursday, with the method bearing similarities to previous large-scale attacks linked to the country.
However, US President Donald Trump said on Saturday that Washington had not established whether North Korea was responsible.
“We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” Trump told reporters, according to comments published by a White House account on X.
The FBI’s attribution and Trump’s remarks therefore presented different assessments of the incident. The agency identified TraderTraitor as responsible, while the president said the US government was still uncertain about North Korea’s involvement.
The theft comes amid a broader increase in attacks targeting cryptocurrency platforms and digital asset holders. Researchers at TRM Labs estimated that attackers stole $2.9 billion in cryptocurrency across nearly 150 incidents last year, illustrating the persistent security risks facing the industry.
Binance Draws on Reserves and Corporate Funds to Replace Stolen Assets
Binance has repeatedly said it will absorb the financial impact of the breach rather than pass the losses to customers. The company said it had internally allocated approximately $6.34 billion to cover the stolen funds.
The replacement purchases were financed through several sources, including its $1 billion Secure Asset Fund for Users, known as SAFU, which was established to protect customers against losses arising from security breaches. Binance also used resources from its Futures Insurance Fund and corporate treasury.
Co-CEO Yi He said on Saturday that the company would use 50% of its SAFU funds for the recovery effort and replenish the reserve to approximately $1 billion.
The exchange has also worked with industry partners to freeze some of the affected assets. Binance said approximately $3 billion had been located by Friday, although freezing assets does not necessarily mean they can all be recovered or returned immediately.
Co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to erase evidence of its activity. Such techniques can complicate forensic investigations and make it harder to establish how attackers gained access, moved through systems, and transferred the stolen funds.
The incident has placed Binance’s financial resources and operational controls under scrutiny. The exchange reported 335 million registered users globally and approximately $162.8 billion in assets under custody in its 2025 annual report.
Binance founder Changpeng Zhao thanked US law enforcement agencies for helping track and freeze the stolen assets. In a post on X quoting the FBI’s statement, Zhao said their assistance had been important to the industry’s response.
“A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them,” he wrote.
Zhao was convicted in the United States of failing to maintain an effective anti-money laundering programme before receiving a presidential pardon from Trump last year.
Crypto prices fell on Friday as news of the hack emerged and Binance sought to reassure customers. The exchange’s resumption of withdrawals may ease immediate concerns about access to funds, but the scale of the theft leaves questions about the security of its systems and the effectiveness of safeguards across the wider cryptocurrency industry.