Binance has resumed withdrawals of bitcoin and other cryptocurrencies following the theft of approximately $6.3 billion in digital assets from its hot wallets, as the world’s largest cryptocurrency exchange seeks to restore user confidence and replenish the stolen funds.
The exchange announced on Sunday that withdrawals had reopened in phases, beginning with the Bitcoin network before services were restored for the Ethereum network and BNB Smart Chain.
Binance said on Saturday that it had restored backing for approximately 90% of the assets affected by the theft, which was announced on Thursday. The figure refers to the proportion of assets for which the exchange has re-established backing, not the amount it has recovered from the attackers.
The company said it would continue purchasing the remaining tokens through market transactions and over-the-counter channels until all affected assets were fully backed. It has pledged to absorb the financial impact of the theft rather than pass the losses on to customers.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement. “Binance will absorb the financial impact of these stolen funds, not our users.”
The exchange said the outstanding 10% consisted of tokens outside its top 10 holdings that were less liquid and could therefore take longer to acquire in the quantities required.
To replenish the assets, Binance said it was drawing on several sources, including its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund and its corporate treasury.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said, adding that it would demonstrate progress through transparent reporting and concrete action.
The resumption of withdrawals follows the Federal Bureau of Investigation’s announcement late on Saturday that it had determined North Korea was responsible for the theft. The agency said malicious North Korean actors had laundered the stolen assets by converting them into Ethereum and were expected to continue converting the funds as they prepared them for further laundering.
The attribution adds an international dimension to an incident that has raised questions about the security of cryptocurrency exchanges and the ability of attackers to exploit their internal systems.
Blockchain intelligence and investigations company TRM Labs had also identified North Korean hackers as the likely perpetrators. It said several characteristics of the attack resembled earlier thefts linked to North Korea, including the Bybit hack and the KelpDAO attack in April 2026.
Among the similarities it identified were small withdrawals from Tornado Cash to fund an operator wallet, preparations that began well before the theft, and digital signatures obtained in advance and executed in a single burst.
The precise method used to breach Binance’s systems remains unclear. The exchange initially said the attack might have involved a compromised laptop belonging to a DevOps engineer, which could have enabled an attacker to access a service container and submit unauthorised withdrawal transactions.
However, co-chief executive Richard Teng subsequently said the incident involved a more complex process rather than the misuse of a single engineer’s permissions.
Binance declined to provide further details of its investigation, referring questions to its latest statement. The company said its investigation was continuing alongside the phased restoration of withdrawal services.
The theft, described as the largest cryptocurrency heist on record, has placed renewed attention on the security of digital-asset platforms and the risks associated with the custody and movement of large volumes of cryptocurrency.
