Binance Resumes Withdrawals After Covering 95% of the $6.3 Billion Heist the FBI Ties to North Korea
Bitcoin withdrawals reopened Sunday morning and other tokens follow in phases, Binance says, after the exchange used company money to replace $6 billion of what was stolen in around 20 minutes on Thursday — the largest crypto theft on record.
The world's biggest cryptocurrency exchange is opening the doors again. Binance resumed bitcoin withdrawals on Sunday and said withdrawals of other tokens would follow in phases, after the company covered 95 percent of the $6.3 billion in tokens stolen from its platform late on Thursday — a heist the FBI has tied to North Korea and analysts describe as possibly the biggest financial robbery ever.
The mechanics of the rescue are the story. Binance says it used company money to buy replacement tokens, covering $6 billion of the stolen cryptocurrency and drawing in part on its $1 billion Secure Asset Fund for Users, a bitcoin reserve held for exactly this kind of emergency; internally it has set aside around $6.34 billion to cover the losses, and it has repeatedly said it will bear the financial impact itself. The first reopening phase covers 15 cryptoassets, including bitcoin, ether, XRP and dogecoin. The remaining 5 percent consists of less liquid tokens that may take longer to source. Separately, about $3 billion of the stolen assets had been frozen with industry partners as of Friday.
Attribution is where the official accounts diverge. The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible, and that its members were observed converting stolen assets into ether; the same unit was blamed for the $1.5 billion theft from the Bybit exchange in 2025, and Pyongyang has for years denied running state-linked cyber units for theft. President Donald Trump, however, said on Saturday that the United States was still not certain North Korea was involved. For scale: across all of last year, attackers stole $2.9 billion in cryptocurrency across nearly 150 attacks, researchers at TRM Labs say — less than half of what was taken from Binance in around 20 minutes. Texans holding accounts at the exchange can now withdraw the major tokens; the desk will follow the remaining phases and any official word on the frozen $3 billion.
