Binance resumed cryptocurrency withdrawals on Sunday after hackers stole about $6.3 billion in token assets from its hot wallets. The exchange says it has restored backing for up to 90% of the stolen assets and will absorb the financial impact, rather than pass losses to users.
Withdrawals return in stages
Bitcoin withdrawals were the first to reopen, Binance said in a post on X. The exchange later restored withdrawals on the Ethereum Network and BNB Smart Chain. It has not announced that every withdrawal service is available again, so users should check Binance’s notices for the status of a particular network or asset.
The return of withdrawals follows a temporary halt after the theft, which Binance announced on Thursday. Reopening began after the exchange said on Saturday that it had replenished backing for about 90% of the assets involved. Security checks and the continuing investigation remain part of the response.
What Binance says is covered
Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed. It plans to obtain the remaining tokens through market purchases and over-the-counter transactions until all relevant assets are covered in full.
The exchange says the outstanding portion consists of tokens outside its top 10 that are less liquid and may take longer to source in the required amounts. The 90% figure describes how much of the stolen assets Binance says it has backed; it does not mean the exchange has recovered that share from the attacker.
Funds used to replace the assets
Binance says it is drawing on its Secure Asset Fund for Users, part of its Futures insurance fund and its corporate treasury. Those sources are being used to buy replacement tokens and restore the assets held to back user balances.
The exchange says it will cover the financial impact of the theft and that users will not bear the loss. How long it will take to source the less-liquid tokens, and when coverage will reach 100% across the affected assets, remains unsettled.
Investigation points to North Korea
The FBI said late Saturday that it had determined North Korea was responsible for the theft. The agency said malicious North Korean actors laundered stolen assets by converting them into Ethereum and expects further conversions as the funds move through additional laundering stages.
Binance has not publicly established how the attackers gained access. Its initial explanation raised the possibility of a compromised DevOps engineer’s laptop being used to reach a service container and submit unauthorised withdrawal transactions. Co-CEO Richard Teng later said the attack involved a more complex process than misuse of one engineer’s permissions.
TRM Labs had also pointed to North Korean hackers, citing similarities with earlier attacks, including the Bybit hack and the KelpDAO hack in April 2026. Binance’s investigation is continuing; the exchange has not given a further public account of how the theft was carried out.
What happens next
Binance says it will keep buying the remaining tokens until all are fully backed. Withdrawals have reopened on the Bitcoin, Ethereum and BNB Smart Chain networks, while the timing of full coverage and the investigation’s findings remain pending.
Sources
- cnbc.com — “Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday”
- Bloomberg — “Binance Says 90% of $6.3 Billion Hacked Crypto Restored, Withdrawals to Return – Bloomberg”
- BBC — “Crypto firm Binance covers 90% of losses after $6.3bn hack”
- finance.yahoo.com — “Binance says it has replaced 90% of $6.3 billion stolen in record crypto hack”
- Reuters — “Binance says it has covered $6 billion of $6.3 billion stolen in hack”