Binance resumes withdrawals after record $6bn cyber theft attempt

Binance has gradually resumed withdrawals on Sunday after suspending them for more than two days following an unprecedented cyberattack in which hackers attempted to steal assets worth over $6 billion—the largest recorded theft in the cryptocurrency sector to date.

The platform halted withdrawals on Friday, Asia time, after discovering the breach.

The first phase of withdrawals began around 2 p.m. Singapore time and included Bitcoin, according to a company announcement on X.

This phase will cover 15 digital tokens, including Ethereum, as well as the two largest stablecoins: USDT (Tether) and USDC (Circle Internet Group).

Binance said it is taking a phased approach to reactivating withdrawals, prioritizing tokens based on user demand over the past week to ensure each network and asset pair is restored after stability and security checks.

The US Federal Bureau of Investigation (FBI) on Saturday accused North Korea of orchestrating the attack. In a statement, the FBI said members of the North Korean hacking group TraderTraitor—previously blamed for the 2025 Bybit exchange attack—converted most of the stolen assets into Ethereum.

The statement added that the assets are expected to be laundered through decentralized finance (DeFi) services and instant swaps, ahead of further money laundering stages. The FBI said it is working with the US Secret Service and the IRS Criminal Investigation unit.

Most major cryptocurrencies saw little price movement on Sunday, reflecting renewed investor confidence after Binance pledged to fully cover the losses. Bitcoin, which accounts for about 60% of the sector’s total market value, traded at around $77,800—down about 5% from its pre-attack high on Thursday.

Binance confirmed it has covered about 90% of the crypto assets stolen by the hackers, as part of its commitment to fully compensate customers.

The stolen assets included a mix of leading cryptocurrencies across 10 blockchain networks, such as Bitcoin and Ethereum. The platform stressed it would absorb the financial impact and not pass any losses onto users.

Co-CEO Richard Teng said in a video posted Friday that Binance is able to cover the losses thanks to investing part of its revenues in cryptocurrencies.

Co-CEO Yi He also confirmed that Binance’s revenues this year will fully cover the value of the lost assets.

Haseeb Qureshi, managing partner at Dragonfly, said the rapid response reflects the maturity of the sector.

Concerns are growing over the use of artificial intelligence in cyberattacks, with some security experts believing North Korean hackers used AI tools to gather intelligence on targets and carry out social engineering tactics.

Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic have also attributed the attack to North Korean hackers.

Recent weeks have seen other cyberattacks targeting the prediction market Polymarket, South Korean financial firms Mirae Asset Global Investments and Daishin Securities, and Japan’s GMO Internet Group crypto exchange.

Binance holds assets valued at around $135 billion, far exceeding its competitors; OKX, for example, holds about $29 billion, according to DefiLlama data.

In 2018, Binance established the Secure Asset Fund for Users (SAFU), an emergency insurance reserve to protect clients in exceptional circumstances. The fund is typically maintained at around $1 billion, though its value fluctuates with market movements, according to the platform’s 2024 statement.

Binance indicated the incident may be linked to a compromised laptop belonging to a software engineer, along with additional breach points, but said there was no evidence of private key leaks.