Cryptocurrency exchange Binance announced it has resumed withdrawals for bitcoin and other digital assets following a record-breaking $6.3 billion theft from its hot wallets.
Withdrawals began reopening in phases over the weekend, starting with the bitcoin network before expanding to include the Ethereum network and the BNB Smart Chain. The platform stated that its next milestone involves completing withdrawal restorations for users while ongoing security checks and internal investigations proceed.
The massive breach, announced Thursday, marks the largest cryptocurrency heist on record. Federal law enforcement agencies moved quickly to assign blame, with the FBI stating late Saturday that investigators determined North Korea was responsible for the cyberattack. According to the FBI, malicious actors linked to North Korea began laundering the stolen funds by converting them into Ethereum, with further digital asset conversions anticipated as the laundering operation continues. Blockchain intelligence firm TRM Labs similarly pointed to North Korean hackers, noting similarities to prior heists such as the Bybit and KelpDAO incidents in April 2026, which involved pre-staged operations and rapid execution bursts.
Despite the scale of the breach, Binance maintained that it has restored backing for approximately 90% of the affected assets. Company officials clarified that this figure represents financial backing rather than a direct recovery of funds from the attacker. To replenish the assets, the exchange drew upon its Secure Asset Fund for Users (SAFU), a segment of its Futures insurance fund, and its corporate treasury.
Binance confirmed that major holdings including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now fully backed at 100%. The exchange pledged to absorb the financial impact entirely rather than passing losses to users, stating it will continue purchasing remaining relevant token assets through market and over-the-counter channels until complete coverage is achieved across all tokens.
The remaining 10% of affected assets consists of less liquid tokens outside the platform’s top ten, which the company noted may require additional time to source in required amounts. Binance declined to discuss further investigative details when contacted by reporters, directing inquiries to its published corporate statements.
Questions remain regarding the exact mechanics of the breach. The exchange initially suggested the vulnerability stemmed from a compromised DevOps engineer laptop that granted unauthorized access to a service container. However, Co-CEO Richard Teng subsequently described the attack as a more sophisticated process rather than a simple misuse of individual employee permissions.
