Binance To Resume Withdrawals After Replenishing 95% Of $6.3B Stolen Assets

Cryptocurrency exchange Binance said Sunday it would resume withdrawals in phases after replenishing 95% of assets affected by a $6.3 billion cyberattack, which the US Federal Bureau of Investigation (FBI) attributed to North Korean state- hackers.

Binance resumes withdrawals

Binance scheduled the first phase of withdrawals for November 1, between 6 am and 9 am UTC (10 am to 1 pm UAE time), subject to security and operational checks, a company statement showed.

The initial rollout covers 15 blockchain networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Tron, Dogecoin, and Arbitrum.

Supported assets include BTC, ETH, BNB, USDT, USDC, SOL, and XRP, with availability varying by network.

Deposit services remained operational during the withdrawal suspension, according to Binance.

The exchange said it prioritized networks based on user demand over the week, with additional withdrawals to resume following security checks. It warned of possible processing delays during the rollout.

Binance replenishes 95% of affected assets

Binance said it had replenished approximately 95% of the affected assets using company resources, up from 90% in its update. The remaining 5% comprises less-liquid tokens, which the exchange said would take longer to acquire through market and over-the-counter transactions. Binance said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed, with reserve information available through its Proof of Reserves platform. The company previously disclosed that it had allocated more than $6.34 billion in company resources to cover the losses , including funds from its Secure Asset Fund for Users (SAFU).

FBI attributes attack to North Korean hackers

The FBI said Saturday that North Korea's state- TraderTraitor hacking operation was responsible for the $6.3 billion theft. According to the agency, investigators observed the attackers converting stolen assets primarily into Ethereum and warned that further laundering could involve decentralized finance platforms and cryptocurrency swapping services. The FBI urged cryptocurrency exchanges , blockchain operators, and other digital asset service providers to block transactions linked to addresses associated with the stolen funds. North Korea has previously denied using state-linked cyber units to conduct financial theft, Reuters reported.

The breach occurred on October 29, when attackers compromised Binance's hot wallets and stole approximately $6.3 billion in digital assets . In an October 30 update, Binance said its preliminary investigation identified a compromised engineer's laptop as a possible entry point, although subsequent findings indicated additional points of intrusion. The exchange said it had found no evidence that wallet private keys had been leaked. Binance also reported that approximately $3 billion in affected assets had been frozen on-chain with assistance from blockchain partners, while efforts to trace and recover the stolen funds continued.

Binance said it would continue restoring withdrawal services and replenishing the remaining affected assets as security checks are completed. The exchange also plans to release a detailed report once its investigation concludes. The incident has drawn attention to cybersecurity risks in the cryptocurrency.