Binance Resumes Withdrawals After $6.3bn Hack as FBI Blames North Korea
Binance has begun restoring cryptocurrency withdrawal services in phases following a security breach that resulted in the theft of approximately $6.3 billion in digital assets, with the United States Federal Bureau of Investigation (FBI) attributing the attack to North Korea.
The cryptocurrency exchange announced on Sunday, November 1, that it was reopening withdrawal services progressively after temporarily suspending them to contain the incident and conduct security assessments.
In its latest recovery update, Binance said it had replenished approximately 95 per cent of the affected assets, up from 90 per cent in its previous update. The company said the remaining five per cent consisted of less liquid tokens that could take longer to source in the required quantities.
Binance said it would bear the financial impact of the stolen assets, assuring customers that the losses would not be transferred to them.
The first phase of the withdrawal restoration covers several cryptocurrency networks, including Bitcoin, Ethereum, BNB Chain, Solana, XRP, Dogecoin, Tron and others.
The exchange explained that withdrawals would become available progressively as individual networks and assets completed the necessary security and stability checks. It also warned that users could experience temporary delays during the initial restoration.
The attack occurred on or about October 29, according to an October 31 cyber alert published by the FBI.
The agency identified the operation as TraderTraitor, a cyber activity it linked to North Korea, and said it had observed the attackers converting the stolen assets primarily into Ethereum.
The FBI, working with the United States Secret Service and the Internal Revenue Service Criminal Investigation division, warned that the stolen cryptocurrency could undergo further laundering through decentralised finance platforms and instant cryptocurrency exchange services.
It urged cryptocurrency exchanges, blockchain operators and other virtual asset service providers to block transactions involving wallet addresses associated with the operation.
The FBI also published a list of cryptocurrency addresses connected to the suspected attackers to assist efforts to disrupt the movement of the stolen assets.
In an earlier security update, Binance disclosed that its hot wallets, which are connected to the internet and facilitate cryptocurrency transactions, had been compromised.
The exchange said it had taken steps to contain the breach, revoke affected authorisations, strengthen security controls and work with law enforcement agencies and industry partners to trace and recover the stolen assets.
Binance also said it was using company resources and its Secure Asset Fund for Users (SAFU) to cover the financial impact of the incident.
The resumption of withdrawals marks a significant stage in the exchange’s response to the breach, although the investigation and efforts to replenish the remaining affected assets are ongoing.
Binance said it would publish a detailed post-incident report after the investigation is completed.
