Cryptocurrency exchange Binance has begun restoring customer withdrawals following a massive cyberattack that resulted in the theft of approximately $6.3bn, marking what is believed to be the largest digital asset heist on record.
The platform initiated a phased resumption of services on Sunday after temporarily freezing transactions following Thursday’s security breach. The suspension allowed security teams to investigate the intrusion and conduct comprehensive system checks across the network.
In a statement published on the social media platform X on Sunday, Binance announced that it had successfully replaced roughly 95 percent of the compromised assets. The company stated that it would absorb the financial fallout of the stolen funds rather than passing the burden to its users.
Withdrawals are currently being restored incrementally, beginning with major digital assets such as Bitcoin and Ether, alongside selected stablecoin services. The exchange cautioned customers that elevated transaction volumes could trigger processing delays during the rollout, recommending that users retry failed requests after a brief interval.
Additional services are scheduled to come back online as security audits reach completion. Meanwhile, internal investigators are maintaining active collaboration with law enforcement agencies and industry partners to trace and recover the missing funds.
On Saturday, the Federal Bureau of Investigation publicly attributed the multi-billion-dollar breach to North Korea, linking the operation to cyber-activity monitored under the designation TraderTraitor. According to federal investigators, the perpetrators have begun converting the stolen reserves primarily into Ether, the native cryptocurrency of the Ethereum network. The bureau cautioned that further laundering attempts are anticipated through decentralized finance protocols and instant exchange services.
The FBI noted a operational parallel with a previous high-profile incident in February 2025, when approximately $1.5bn was stolen from the Bybit exchange—an attack the agency also attributed to the same state-backed actors.
While Binance initially pointed to a compromised employee laptop as the probable vector for the unauthorized access, subsequent forensic findings revealed additional entry points utilized during the intrusion. The company confirmed that its internal investigation is ongoing and promised a comprehensive report once the inquiry concludes.
