Binance resumes phased customer withdrawals after record $6.3 billion hack attributed to North Korea

Binance resumed phased customer withdrawals on Sunday after 2pm Singapore time, following the theft of approximately $6.3 billion in cryptocurrency assets — the largest crypto theft on record.

The FBI said on Saturday that North Korea was responsible for the attack, identifying the operation as cyber-activity it tracks under the name TraderTraitor, which is believed to be part of the Lazarus Group. Binance said it has set aside approximately $6.34 billion in company funds to cover the losses, and that it has covered 90% of stolen assets, with the remaining 10% consisting of less liquid tokens that may take longer to source. The exchange said it is tapping its Secure Asset Fund for Users, a portion of its Futures Insurance Fund, and its corporate treasury to replenish the stolen assets. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement.

Withdrawals resume in phases

Binance said the first batch network opened in phase one was the BTC bitcoin network, with withdrawals later restored for the Ethereum Network and BNB Smart Chain. All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%, the exchange said. Binance will continue buying the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100% for all tokens. The exchange warned that high demand could cause delays as services return, advising customers whose transactions fail to try again after a short wait.

How the breach occurred

Binance said its initial investigation suggested a compromised DevOps engineer’s laptop allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions, though additional points of breach were later uncovered. Richard Teng, Binance’s co-chief executive officer, said the hack was carried out by more than one person using sophisticated methods to hide their tracks, including a “self-destruct mechanism.” The investigation is ongoing, and Binance said it would publish a detailed report once the inquiry is complete.

Tracing the stolen assets

The FBI said it observed hackers converting stolen assets into Ethereum and expected further laundering through decentralised finance platforms and instant swap services. Binance said it has frozen around $3 billion of stolen assets after working with law enforcement, intelligence firms, and partners. The US Secret Service said it is working with private sector partners to identify, freeze, trace, and recover funds stolen from Binance. TRM Labs, a blockchain intelligence and AI investigations company, initially pointed to North Korean hackers as the culprits and said several features of the attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. The FBI previously attributed the theft of approximately $1.5 billion from cryptocurrency exchange Bybit to the same actors.

Market reaction and political response

Bitcoin plunged nearly 5% after the news of the hack, while ethereum dropped nearly 6% and BNB tumbled nearly 10%. President Trump said the US is still unsure who the culprits are, stating, “We don’t know if it’s North Korea - but if it is, we’ll talk to North Korea about it.”

Binance was founded in China in 2017 and is the world’s largest cryptocurrency exchange, with an estimated hundreds of millions of users worldwide. Binance declined to discuss additional details, referring questions to its latest statement.