Binance resumed bitcoin, ether, and select stablecoin withdrawals on Sunday after covering 95% of the $6.3 billion stolen in a heist.
Binance Covers $6 Billion to Restore Partial Withdrawals
The world’s biggest cryptocurrency exchange moved quickly to restore liquidity for its users following a breach that unfolded over roughly 20 minutes late on Thursday. Binance revealed it filled the financial hole by injecting company capital to buy replacement tokens. To shield customers against potential security breaches, the exchange relied on its corporate treasury, portions of its Futures Insurance Fund, and half of its bitcoin reserve, known as the Secure Asset Fund for Users (SAFU). Co-CEO Yi He noted that the company has committed to replenishing the SAFU fund to about $1 billion.
With those funds secured, Binance rolled out the first phase of restored transactions. This initial rollout covers 15 specific digital assets, including bitcoin, ether, XRP, and dogecoin. Bitcoin withdrawals went live shortly after 0600 GMT on Sunday, while networks for ether, BNB, and selected USDT and USDC stablecoins also came back online. The remaining 5% of stolen funds consist of assets that are less liquid and may take longer to source in the required amounts.
Before this partial restoration, the exchange held roughly $162.8 billion in assets under custody across its 335 million registered users worldwide. Safeguarding customer accounts, Co-CEO Richard Teng explained, required handling a “complex attack” involving malware meant to erase footprint logs and a compromised laptop, which together hindered forensic tracking and analysis.
FBI Ties the Attack to North Korean State Actors
The FBI formally announced on Saturday that the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack. In an official release, the FBI noted that law enforcement spotted members of the group exchanging stolen holdings for ether, while forecasting that related technology would facilitate “further laundering” of the funds.
US blockchain analysis firms TRM Labs and Chainalysis noted that the bulk of the theft unfolded in around 20 minutes and bore similarities to previous large attacks blamed on North Korea. North Korean missions in Geneva and embassy in China did not respond to requests for comment. US President Donald Trump, however, said on Saturday that the United States was still not certain if North Korea was involved, stating, “We don’t know if it’s North Korea — but if it is, we’ll talk to North Korea about it.”
Founder Changpeng Zhao Credits US Law Enforcement Support
Binance founder Changpeng Zhao publicly expressed gratitude toward US law enforcement agencies for their support. Writing on X, Zhao highlighted the role that law enforcement played in tracking and freezing the stolen assets, with about $3 billion located as of Friday. A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them,
Zhao wrote.
Binance thanked the FBI for its support in a post on X. Binance did not respond to a request for comment on North Korea’s involvement. Last year, Trump granted Zhao a pardon following a US conviction for failing to run an adequate anti-money laundering program.
