Binance Resumes Withdrawals After Record $6.3bn Crypto Theft Blamed on North Korea

Binance, the world's largest cryptocurrency exchange, has started bringing customer withdrawals back online after hackers made off with roughly $6.3bn in digital assets, a theft that United States authorities have attributed to North Korea.

The company restored some services on Sunday, days after it suspended operations in response to the attack on Thursday. The pause allowed Binance to investigate the intrusion and run security checks across its systems.

In a statement posted on X on Sunday, the exchange said it had already replaced about 95 percent of the assets affected by the breach. "Binance will absorb the financial impact of the stolen funds, not our users," the company said.

The restoration of withdrawals is proceeding in phases. Major cryptocurrencies, including Bitcoin and Ether, are being reopened first, along with certain stablecoin services.

Binance cautioned that customers could face delays as heavy demand returns to the platform. Users whose transactions fail were advised to wait briefly and try again.

The exchange added that more services would come back online as security checks are finished. Its teams, it said, are continuing to cooperate with law enforcement agencies and industry partners in an effort to trace and recover the stolen funds.

The FBI said on Saturday that North Korea was behind the theft, describing the operation as cyber activity it monitors under the name TraderTraitor. According to the agency, investigators watched the attackers convert the stolen assets mainly into ether, the cryptocurrency of the Ethereum network, and warned that further laundering was likely through decentralised finance platforms and instant crypto exchange services.

The same actors were previously blamed by the FBI for stealing approximately $1.5bn from the cryptocurrency exchange Bybit in February 2025.

Binance first suggested that a compromised employee laptop could have opened the door to the attackers, but it later said investigators had identified additional points of breach. The company said its inquiry is still under way and that it intends to release a detailed report once the investigation concludes.