Binance resumes withdrawals after $6.3 billion hack

Bitcoin and 15 networks restored in first phase

Binance reopened withdrawals for 15 networks alongside the Bitcoin network during the first phase. The exchange stated: "First batch network now opened in phase one of withdrawals is $BTC bitcoin network.".

Binance also reopened withdrawals for Tron, Arbitrum, and Base, prioritising the most requested networks.

Exchange replaces 95% of stolen assets using company funds

Binance has replaced approximately 95% of the $6.3 billion in stolen tokens using its own capital. This figure represents an increase from the 90% recovery reported one day earlier.

The exchange is using its Secure Asset Fund for Users (SAFU), corporate treasury, and futures insurance fund to cover these losses. Binance announced that it has allocated $6.34 billion of its corporate capital to mitigate the potential consequences of the hack.

The 95% recovery figure reflects restored backing for user balances rather than funds recovered from the attacker. The exchange intends to absorb the financial impact rather than passing losses to users.

Users can verify these holdings through a proof-of-reserves snapshot available on the company website.

The remaining 5% of stolen assets consists of less liquid tokens outside the top ten. These assets require more time to source through market and over-the-counter (OTC) channels.

Last year, attackers stole $2.9 billion in cryptocurrency across nearly 150 separate attacks, according to blockchain analytics firm TRM Labs.

FBI attributes record theft to North Korean operatives

The FBI has attributed the $6.3 billion theft to North Korean state-sponsored operatives. Blockchain analytics firms identified the perpetrators as a North Korean-linked entity known as TraderTraitor.

This theft is the largest crypto hack on record, measuring roughly four times the size of the $1.5 billion Bybit hack that occurred in February 2025. The stolen assets included 18,270 BTC, 200,630 ETH, 1.875 billion USDT, 823 million USDC, 233.46 million XRP, and 970,500 SOL.

The FBI reported that the hackers are currently laundering the stolen funds by converting them into Ethereum. Investigators found similarities between this attack and previous North Korea-linked heists, including the April 2026 KelpDAO hack and the Bybit incident.

Common tactics in these operations include the use of Tornado Cash and the deployment of pre-staged operator wallets.

Complex attack involved compromised systems

Richard Teng, the co-CEO of Binance, characterized the event as a "complex attack" which utilized a compromised laptop and malware created to destroy traces of the operation. While Binance initially stated the attack may have started via a compromised DevOps engineer's laptop, Teng later clarified the process was more complex than a single engineer's permissions.

The theft occurred over approximately 20 minutes late on Thursday. Blockchain firms TRM Labs and Chainalysis noted similarities to prior attacks linked to North Korea. The hack resulted in an estimated loss of about $6.3 billion taken from Binance’s hot wallets. US President Donald Trump stated that the United States is not yet certain if North Korea was involved in the attack.

Stablecoin issuers freeze $2 billion in stolen funds

Tether and Circle have frozen more than $2 billion in stablecoins that were seized by the hackers. Approximately $3 billion of the stolen funds have been immobilized, primarily in stablecoins like USDT and USDC which issuers have the ability to block. TRM Labs reports that another $2.4 billion in cryptocurrency has moved beyond the reach of issuers.

Binance warns of potential delays during phased rollout

Binance is using a phased approach to restore withdrawals, prioritizing tokens based on user demand data from the past week to ensure stability and security. The exchange conducts security and stability checks on each network before reopening it for withdrawals. Binance said the speed of further withdrawal phases will depend on each blockchain passing its own security and stability checks.

Binance warned users that the phased rollout may result in congestion, longer processing times, and temporary delays. Deposits on the Binance platform have continued to function normally throughout the withdrawal suspension. The exchange is prioritizing the restoration of tokens based on user demand data from the previous week.

Exchange plans post-incident report and proof-of-reserves

Binance has promised to provide a full proof-of-reserves report to verify that the exchange holds the assets it owes to customers. The exchange intends to publish a post-incident report once its investigation into the hack is concluded.