Binance resumes withdrawals after temporarily freezing transfers in the wake of a record $6.3 billion theft from its hot wallets, the company said Sunday.
In a post on X, the exchange said the first phase restored withdrawals on the bitcoin network. It later confirmed that outflows were also reenabled for the Ethereum Network and BNB Smart Chain.
Binance said Saturday it has covered up to 90% of the assets affected in the heist disclosed Thursday. The platform added that it is continuing to acquire the remaining impacted token assets through market and over-the-counter channels until coverage reaches 100% for all tokens.
According to the company, major assets are fully backed. “All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement, adding that it would bear the financial impact, not users. The outstanding 10% consists of tokens outside its top 10 that it described as less liquid, which could take longer to source.
To replenish balances, Binance said it is drawing on its Secure Asset Fund for Users, a portion of its Futures insurance fund, and corporate treasury. The exchange reiterated that it will fully cover the financial impact of the incident and pledged transparent updates as it continues its investigation. Its next milestone was to resume withdrawal services for users by Sunday, subject to security checks.
Binance resumes withdrawals as FBI blames North Korea
Separately, the FBI said late Saturday it determined North Korea was responsible for the theft. The agency said malicious actors laundered stolen assets by converting them into Ethereum and are expected to continue converting funds as they prepare for further laundering stages.
TRM Labs, a blockchain intelligence and AI investigations firm, had also attributed the operation to North Korean hackers, citing similarities to prior incidents including the Bybit and KelpDAO hacks in 2026. The firm pointed to patterns such as small Tornado Cash withdrawals funding an operator wallet, early staging ahead of the theft, and signatures obtained in advance then executed in a single burst.
It remains unclear how the largest crypto theft on record was executed. Binance initially said the breach may have involved a compromised DevOps engineer’s laptop that allowed access to a service container and unauthorized withdrawals.
Co-CEO Richard Teng later said the attack used a more complex method rather than relying on a single engineer’s permissions.
Binance declined to provide further investigative details beyond its public statements.
