Binance has announced that it resumed withdrawals on Sunday, following a major hack in which more than $6 billion in virtual assets was stolen from the cryptocurrency exchange. The FBI says North Korea was responsible.
Binance is the world’s largest crypto exchange by daily trading volumes. News of the attack, believed to be the biggest crypto heist ever, sent the prices of most major cryptocurrencies tumbling on Friday.
The company has reassured users that it will cover the losses, saying it has used company funds to buy tokens to replenish 90 per cent of what was stolen.
Binance suspended user withdrawals after the attack but said they would be restored in phases, the first of which began on Sunday.
“First batch network now opened in phase one of withdrawals,” the exchange posted on X.
The company had earlier said it was preparing to resume withdrawals gradually, starting between 0600 and 0900 GMT on Sunday.
“We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” it said.
In a statement on Saturday, the US law enforcement agency accused North Korea of being behind the hack. This confirmed earlier suspicions from private investigators and analysts that a Pyongyang-affiliated group called TraderTraitor was responsible.
TraderTraitor is the same group blamed for a $1.5 billion theft from the Bybit platform in February last year.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the statement said.
The FBI added that it had observed “TraderTraitor actors” converting stolen assets into Ethereum, and expected the assets to be laundered further through decentralized finance and instant swap services.
It also urged private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”
US President Donald Trump, however, cast doubt on North Korea’s involvement in the hack.
“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump told reporters at his residence in Florida late on Saturday.
The president often looks back with pride on the summits he held with North Korean leader Kim Jong Un during his first term.
Binance said on Saturday that it had set aside more than $6.34 billion in company funds to cover losses from the hack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company said on X.
The exchange explained that it had used company money to buy tokens to replenish 90 per cent of the stolen funds, while the remaining 10 per cent of tokens are “less liquid, which means they may take longer to source in the required amounts.”
The attack came as many observers voice worries that the ever-expanding capabilities of artificial intelligence models could compromise cryptography and IT security protocols.
After news of the hack broke, Bitcoin plunged by nearly five per cent, Ethereum dropped by nearly six per cent, and BNB, the token native to Binance, tumbled by nearly 10 per cent.
The sheer scale of the hack has put a spotlight on North Korea’s capacity to find illicit means of raising revenue, given that the country faces extensive international sanctions over its nuclear and missile programmes.
TraderTraitor is believed to be part of the Lazarus Group, which gained notoriety in 2014 when it was accused of hacking into Sony Pictures as revenge for “The Interview,” a film that mocked North Korean leader Kim Jong Un.
