Binance, the world's largest cryptocurrency exchange, resumed withdrawals in phases on Sunday, three days after hackers stole about $6.3 billion in tokens from its hot wallets in what is believed to be the largest cryptocurrency theft in history.

The exchange said the first phase of withdrawals began shortly after 0600 GMT on Sunday, starting with the bitcoin network and covering 15 cryptoassets including bitcoin, ether, XRP and dogecoin. It later restored withdrawals for ether, USDT and USDC on the Ethereum network, and USDT, USDC and BNB on BNB Smart Chain, with further assets to follow once security checks are complete.

FBI blames North Korea

On Saturday, the US Federal Bureau of Investigation said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or about October 29. The bureau attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit, and said it was working with the US Secret Service and IRS Criminal Investigation to trace the stolen funds.

According to the FBI, the attackers have been observed converting the stolen assets primarily into Ethereum, and the bureau warned cryptocurrency businesses to block transactions linked to addresses it identified as holding or previously holding proceeds of the theft. The FBI had previously attributed the February 2025 theft of about $1.5 billion from the exchange Bybit to North Korea as well.

Binance says 95% of losses covered

Binance said it had covered about 95 per cent of the stolen amount using company funds, including a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund and its corporate treasury. It said it had set aside more than $6.34 billion to cover the losses, and that customers would not bear the cost. The remaining 5 per cent consists of less liquid tokens that may take longer to source in the required amounts, the exchange said.

The company also said it had taken a proof-of-reserves snapshot on October 31, with a full zero-knowledge proof expected by November 3. Blockchain tracing firms have put the total stolen slightly higher, at between $6.36 billion and $6.43 billion.

What happens next

The phased reopening is the first real test of Binance's recovery plan after it suspended deposits and withdrawals as a precaution while it assessed the breach. The exchange has said the hack involved the compromise of an engineer's laptop and vulnerabilities in its transaction approval system, and that it worked with blockchain firms to track and freeze part of the stolen funds.

For the wider crypto industry, the incident raises uncomfortable questions. Even the world's biggest exchange lost an unprecedented sum in a single attack, at the hands of a state-backed actor with a long record of crypto thefts. Whether Binance's phased reopening restores confidence — and whether investigators can claw back funds already being laundered through decentralised exchanges — will be watched closely in the days ahead.