Binance has begun restoring customer withdrawals after hackers stole about $6.3bn in cryptocurrency in a record theft that United States authorities have blamed on North Korea.
The world’s largest cryptocurrency exchange resumed some of its services on Sunday, following a suspension imposed after Thursday’s attack as the company investigated the breach and carried out security checks.
Binance said it had replaced approximately 95 percent of the affected assets. “Binance will absorb the financial impact of the stolen funds, not our users,” the company said in a statement on X on Sunday.
Withdrawals are being restored in stages, with major cryptocurrencies such as Bitcoin and Ether, along with some stablecoin services, being reopened.
The exchange warned that high demand could cause delays as services return, advising customers whose transactions fail to try again after a short wait.
It said further services would reopen as security checks were completed, while teams continued working with law enforcement and industry partners to trace and recover the stolen assets.
The FBI said on Saturday that North Korea was responsible for the theft, identifying the operation as cyber-activity it tracks under the name TraderTraitor.
Investigators had observed the attackers converting stolen assets primarily into ether, the cryptocurrency used on the Ethereum network, the agency said. It warned that further laundering was expected through decentralised finance platforms and instant cryptocurrency exchange services.
The FBI previously attributed the theft of approximately $1.5bn from cryptocurrency exchange Bybit in February 2025 to the same actors.
Binance initially said a compromised employee laptop might have enabled the intrusion, but later reported that investigators had also uncovered additional points of breach.
The company said its investigation remained ongoing and that it would publish a detailed report once the inquiry was complete.
