Binance, the world’s largest crypto trading platform by assets, on Sunday began restoring cryptocurrency withdrawals after it had replaced about 95% of the assets stolen in an estimated $6.3 billion heist.
The company, Binance, founded by Changpeng Zhao (CZ) and Yi He back in 2017 in China, was hit on Thursday with a security breach incident that saw an estimated $6.3 billion stolen in the theft.
The heist has now become the highest single cryptocurrency theft on record
In the company’s own words, the first withdrawal phase covers 15 blockchain networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, Tron and others, with selected assets being restored progressively. More networks will be added as security checks are completed.
Reimbursement of the lost assets came into place as the trading giant is now paying for the stolen crypto from its own pocket, buying tokens on the open market and through over-the-counter channels.
Co-CEO Richard Teng said the company’s position on customer losses has not changed:
“We’ve now replenished approximately 95% of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” he wrote on X.
The exchange now consideres the remaining 5% as “lower liquidity” tokens, as they are outside its ten largest listings. They would take longer to acquire because they trade less actively, Binance noted.
Importantly, the restart is the first time customers are now able to move assets off the platform since withdrawals were suspended following the theft.
In a statement on X Sunday morning, the FBI confirmed with confidence that the theft was carried out by North Korea. The bureau identified the hackers as “TraderTraitor,” a North Korean cyber operation, and said it was working with the U.S. Secret Service and IRS Criminal Investigation.
According to the bureau, the stolen cryptocurrency is being converted to Ethereum (ETH) and other assets, and would be laundered through decentralised finance (DeFi) services and instant-swap platforms.
The department is now pleading with cryptocurrency exchanges, node operators and other service providers to help block transactions linked to the digital wallet addresses it has identified.
“We sincerely thank @FBICyberBranch for their strong support during this challenging time,” Binance said in response to the FBI’s announcement.
Additionally, its co-founder, Changpeng Zhao, expressed his appreciation, saying:
“A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them.”
North Korean hacking groups have become the world’s most prolific threats to the crypto industry, which have been targeting exchanges and other platforms for large-scale theft.
A 2022 attack on Ronin Network resulted in about $625 million in crypto being stolen, while last year’s breach of Bybit saw about $1.5 billion stolen. A more recent theft this year recorded about $387 million stolen from Bitget, according to Chainalysis.
That cumulatively now puts North Korean groups’ thefts at an estimated total of about $12.8 billion across 100 incidents since 2017, according to TRM Labs. This includes about $7.4 billion stolen in 2026 alone.
A compromised laptop belonging to a DevOps engineer of the company has been established to have allowed an attacker to reach an internal service container and submit unauthorized withdrawal requests that led to the access and accident.
Pressed by reporters on Saturday at Mar-a-Lago in Florida about the FBI’s attribution of the theft to North Korea, President Donald Trump addressed the issue, saying he was “not concerned” and that officials were “learning about it.”
“We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it,” he said.
Trump had expressed similar uncertainty the previous day. Speaking in the Oval Office, he told reporters, “We don’t know. We’re looking at that.”
For customers, Binance said only phase-one networks and assets can be withdrawn initially, including Bitcoin, Ethereum, BNB Smart Chain, XRP, Solana, Tron, Dogecoin, Base, Optimism, Arbitrum, Polygon and Avalanche C-Chain, prioritized by the past week’s user demand.
The exchang said users should check its withdrawal page or network status page for their chosen asset, warning that heavy demand may cause delays and that failed attempts can be retried after a short wait.
Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, according to the company, which said it will publish a post-incident report once its investigation is complete.
