Binance opened bitcoin withdrawals shortly after 06:00 GMT on Sunday, according to its status page, and said a further 14 cryptoassets, including ether, XRP and dogecoin, would follow in stages. The exchange had paused transfers late on Thursday after attackers drained roughly $6.3 billion in tokens from its hot wallets in what analysts describe as the largest digital robbery on record.
The reopening came less than 72 hours after the breach and with Binance stating that 95% of the stolen assets had been replaced or covered, up from 90% in a Saturday update. The remaining 5% consists of less liquid altcoins that the company says may take longer to source in the required volumes.
Who is behind the heist?
The Federal Bureau of Investigation said on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the “malicious cyber activity”. The bureau added that it had observed the group converting stolen assets primarily into ether and warned that further laundering through decentralised finance and instant swap services was expected. North Korea has not commented. Its mission in Geneva and embassy in China did not respond to requests for comment, according to Reuters.
US President Donald Trump struck a more cautious note on Saturday, telling reporters:
“We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it”.
How the loss was plugged
Binance has said it will bear the financial cost itself as the exchange set aside roughly $6.34 billion of company funds internally to cover the losses and spent part of that sum buying replacement tokens on the open market.
The money came from its Secure Asset Fund for Users (SAFU), a bitcoin reserve held for security breaches, as well as a portion of its Futures Insurance Fund and its corporate treasury, according to statements on X.
Co-CEO Yi He said 50% of SAFU funds would be used, and the company committed to replenishing the fund to about $1 billion.
The exchange, which says it has 335 million users, also plans to publish an updated Proof of Reserves on Monday so customers can cryptographically verify that their balances are backed one-to-one by on-chain holdings.
Industry partners have frozen roughly $3 billion of the stolen assets, Binance said. Tether froze more than $1.567 billion in USDT, while Circle froze over $800 million in USDC, according to statements from the two stablecoin issuers. Ripple froze approximately $200 million, World Liberty Financial froze $27 million of its USD1 stablecoin and 48 million WLFI tokens, and Arbitrum’s Security Council froze about $30.5 million, Yi He said on X.
The frozen funds are held in addresses controlled by the issuers, not returned to Binance, and the exchange has cautioned that recovery depends on law enforcement and court processes.
What it means for users?
For Binance customers, the practical consequence is that major-asset withdrawals are working again, but the full restoration of balances in thinner altcoin markets is not yet complete. The exchange has not given a firm timetable for the final 5%. Users who held only those assets may still face delays.
The market reaction was tense initially, with Binance experiencing a surge in withdrawal requests upon reopening, though volumes soon stabilized. Bitcoin had fallen 6% to a six-week low of around $76,500 in the aftermath of the breach, while ether dropped about 9%. Crypto prices were steady to slightly higher on Sunday as the withdrawal rollout proceeded without visible disruption.
The FBI has asked crypto exchanges, blockchain analytics firms and other operators to block transactions linked to addresses associated with the TraderTraitor actors.
Investigators expect the remaining stolen assets to be broken into smaller tranches and laundered through smaller venues over months, a process TRM Labs chief policy officer Ari Redbord described as “bank robbery, in this case, at the speed of the internet”.
