Overview
Binance, the world's largest cryptocurrency exchange by user base and assets under custody, announced plans to reopen customer withdrawals on Sunday after sourcing replacement tokens for the bulk of assets stolen in a massive security breach.
The company said it has covered 95% of the $6.3 billion in cryptocurrencies taken from its platform in what analysts have described as the biggest digital heist to date. Binance said it used company funds to purchase replacement tokens equivalent to about $6 billion, leaving roughly 5% of the stolen assets still outstanding. Those remaining assets are described by the exchange as less liquid and therefore harder to obtain in necessary quantities.
Phased resumption of withdrawals
Binance detailed a phased restart, saying the first segment of withdrawals would begin between 0600 and 0900 GMT and would include 15 cryptoassets. The initial list of assets specified by the exchange includes bitcoin, ether, XRP, dogecoin and other tokens. The exchange offered no timetable for when the remaining, less liquid assets might be restored.
Attribution and law enforcement activity
The FBI on Saturday publicly tied the attack to a North Korean state-sponsored unit called TraderTraitor. According to the FBI, law enforcement observed members of the unit converting stolen assets into the cryptocurrency ether and said it expected further laundering of the assets using related technology. Pyongyang has routinely rejected allegations that state-linked cyber units carry out espionage or financial crimes; the North Korean mission in Geneva and its embassy in China did not respond to requests for comment from the exchange.
US blockchain analysis firms noted similarities between this breach and previous attacks that have been attributed to North Korea. Researchers at TRM Labs and Chainalysis have said the theft unfolded rapidly - roughly a 20-minute window beginning late on Thursday - and bore the hallmarks of earlier large-scale incidents.
On Saturday, US President Donald Trump said the United States was not yet certain of North Korean involvement. "We don’t know if it’s North Korea - but if it is, we’ll talk to North Korea about it," he told reporters.
Binance response and financial coverage
Binance said it has been collaborating with industry partners to freeze some of the assets linked to the breach, and that about $3 billion had been located as of Friday. The exchange emphasized it would bear the financial impact of the loss, noting that it had internally set aside approximately $6.34 billion in company funds to cover the incident.
The funds used to replace stolen tokens came from multiple internal sources, including the $1 billion Secure Asset Fund for Users (SAFU), portions of its Futures Insurance Fund, and balances in its corporate treasury. Co-CEO Yi He said the company would use 50% of its SAFU funds for this effort and pledged to replenish the reserve to roughly $1 billion.
Binance co-CEO Richard Teng described the breach as a "complex attack" involving a compromised laptop and malicious software that erased traces of the intrusion, which he said complicated forensic efforts and made the incident harder to trace and investigate.
Market reaction and context
Crypto prices declined on Friday amid the fallout from the breach, as Binance worked to reassure customers that their assets were protected. The exchange reported 335 million registered users globally and disclosed about $162.8 billion in assets under custody in its 2025 annual report.
Researchers cited by the exchange noted broader trends in crypto-related theft. TRM Labs reported that attackers stole about $2.9 billion worth of cryptocurrencies across nearly 150 attacks in the prior year, highlighting that the space has faced repeated security incidents.
Ongoing investigation and next steps
Law enforcement agencies and Binance continue investigative work to trace and freeze funds linked to the theft. While the exchange has been able to locate and freeze a substantial portion of the assets and has purchased replacements for most tokens, it acknowledged that sourcing the remaining less-liquid assets may take longer.
For users of the platform, the near-term development is the selective reopening of withdrawals for specified assets within the window announced by Binance. The exchange has said it will continue to shoulder the financial burden arising from the incident and to restore its internal safeguards.
Note: All figures, timelines, direct quotations and attributions in this report reflect statements and data provided by Binance, the FBI, TRM Labs, Chainalysis and public remarks referenced by the White House. No additional facts have been added.