Binance Withdrawals Restart After $6.3bn Theft as FBI Blames North Korea

Binance withdrawals are coming back online in phases after what is described as the largest cryptocurrency theft on record, a roughly $6.3bn haul that US authorities attribute to North Korean hackers. The exchange began restoring services on Sunday, days after a suspension that followed Thursday’s attack.

What Binance says it has restored

The world’s largest crypto exchange says it has already replaced about 95 percent of the affected assets. In a statement on X, the company said it “will absorb the financial impact of the stolen funds, not our users.” That promise is likely to matter to customers who feared losses from the breach, though the company has not said in the material available how it is covering the shortfall.

The reopening is gradual. Major assets such as Bitcoin and Ether are being restored first, along with some stablecoin services. Binance warned that heavy demand could cause delays, and told customers whose transactions fail to wait briefly and try again. More services will return only as security checks are completed.

The FBI’s attribution to North Korea

On Saturday, the FBI said North Korea was behind the theft and tied it to cyber-activity the agency tracks as TraderTraitor. According to the FBI, investigators have watched the attackers convert stolen assets mainly into ether, the token of the Ethereum network. The agency expects more laundering through decentralised finance platforms and instant crypto exchange services, channels that can make tracing and recovery harder.

The FBI also linked the same actors to the theft of about $1.5bn from the exchange Bybit in February 2025. If both attributions hold, the Binance incident would be a far larger repeat of an earlier pattern of state-linked attacks on crypto platforms.

How the breach happened remains unclear

Binance first suggested that a compromised employee laptop may have given the attackers their way in. It has since said investigators found additional points of breach, which suggests the intrusion was broader than first thought. The company says its investigation is continuing and that it will publish a detailed report once it concludes. Until then, the full technical picture, and any lessons for the wider industry, remain incomplete.

For now, Binance says its teams are working with law enforcement and industry partners to trace and recover the stolen funds. Customers watching for the full return of Binance withdrawals will have to rely on the exchange’s updates as each stage of security checks is finished. The pace of laundering the FBI describes may also determine how much of the stolen money can ever be recovered.

Explore more on this topic with Vexel Search.