Binance Resumes Withdrawals After Record $6.3 Billion Crypto Heist Linked to North Korea

Binance, the world's largest cryptocurrency exchange, has begun restoring customer withdrawals following a massive theft of approximately $6.3 billion in cryptocurrency. US authorities have attributed the record-breaking heist to North Korea.

The exchange resumed some services on Sunday after a temporary suspension that was put in place to allow for an investigation into the breach and to conduct security checks. Binance announced that it had successfully replaced about 95 percent of the assets that were affected by the attack. "Binance will absorb the financial impact of the stolen funds, not our users," the company stated on X on Sunday.

Withdrawals are being reintroduced in phases. Major cryptocurrencies such as Bitcoin and Ether, along with some stablecoin services, have been reopened. The exchange cautioned that high demand might lead to delays as services come back online and advised customers experiencing transaction failures to retry after a brief waiting period. Further services are expected to be reinstated as security assessments are completed, while teams continue to collaborate with law enforcement and industry partners to track and recover the stolen assets.

The FBI stated on Saturday that North Korea was responsible for the theft, identifying the operation under the designation TraderTraitor. According to the agency, investigators observed the perpetrators converting the stolen assets primarily into ether, the cryptocurrency native to the Ethereum network. The FBI also issued a warning that further laundering of these funds is anticipated through decentralized finance platforms and instant cryptocurrency exchange services.

This is not the first time the FBI has linked these actors to significant crypto thefts; they previously attributed the approximately $1.5 billion theft from cryptocurrency exchange Bybit in February 2025 to the same group. Initially, Binance suggested that a compromised employee laptop might have been the entry point for the intrusion. However, the company later reported that investigators had identified additional points of breach. Binance confirmed that its investigation is ongoing and that a detailed report will be published upon its completion.