By 
Binance, the world’s largest cryptocurrency exchange, has officially begun resuming customer withdrawals in phases after covering nearly 95% of the $6.3 billion in digital assets stolen in the largest crypto heist in history.
The phased reopening comes directly after a high-stakes emergency response to contain the fallout of a massive cyber-attack attributed by international authorities to North Korean state-sponsored hackers.
Following a complete suspension of transactions after the breach was detected, Binance initiated its phased restoration of services. The first wave of withdrawals allowed users to access more than a dozen major tokens, including Bitcoin, Ethereum, Solana, XRP, and Dogecoin.
“Today, we’re beginning the phased resumption of withdrawals, taking a careful approach to ensure services return safely and securely,” Binance co-CEO Richard Teng posted on X as the systems came back online.
“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users.”
In the hours immediately following the resumption, users rushed to move capital off the platform. Binance reported that it processed $4.649 billion in withdrawals against $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion.
The initial spike in withdrawals quickly began to stabilize, representing just over 2% of the company’s total $171 billion in assets under management.
To cover the staggering financial gap, Binance dipped into internal reserves, including its Secure Asset Fund for Users (SAFU), a digital reserve fund along with its corporate treasury and futures insurance funds.
While the top 10 digital currencies are fully backed, Binance noted that the remaining 5% of unbacked tokens consist of assets that are “less liquid in the market and take a longer time to source at the required scale.”
In addition to Binance’s internal liquidity deployment, a coordinated effort across industry partners successfully froze nearly $3 billion of the stolen assets, primarily stablecoins, preventing hackers from moving them.
“We recognize how difficult this period has been for our users and the broader Binance community,” the exchange stated, extending thanks to industry partners for their rapid intervention in freezing and tracing the compromised funds.
Investigators have tied the breach to TraderTraitor, a North Korean state-sponsored cyber group also associated with the Lazarus Group.
The Federal Bureau of Investigation (FBI) confirmed the attribution over the weekend, detailing that members of the unit were actively converting stolen assets into Ethereum. The FBI warned that it expects further laundering of the stolen assets using related privacy tools and decentralized technology, prompting the bureau to publish wallet addresses linked to the attackers to assist the global crypto industry in blocking transactions.
Preliminary security audits indicate the exploit likely originated from a compromised laptop belonging to a DevOps engineer. The breach enabled attackers to manipulate transaction authorization infrastructure directly, draining funds across multiple blockchain networks in mere minutes.
Despite ongoing attempts by the hackers to layer and launder the remaining un-frozen funds across thousands of wallet addresses, Binance reassured users that market conditions remain stable and systems continue to pass security checks.
Comments