Binance resumes Bitcoin, Ether withdrawals after $6.3 billion crypto hack linked to North Korea

Binance, the world's largest cryptocurrency exchange, resumed withdrawals of Bitcoin, Ether and some stablecoins on Sunday. The decision came after hackers stole cryptocurrency worth around $6.3 billion from the platform.

Binance resumes Bitcoin and Ether withdrawals after a $6.3 billion cryptocurrency hack. (REUTERS/Dado Ruvic/Illustration) (REUTERS)Binance said it had covered around 95% of the stolen amount by using its own company funds to buy replacement tokens.

The exchange also said withdrawals of other affected cryptocurrencies would resume in phases, as reported by Reuters. In the first phase, Binance restored withdrawals for 15 cryptocurrencies. These include Bitcoin, Ether, XRP and Dogecoin.

Bitcoin withdrawals resumed shortly after 0600 GMT on Sunday. Withdrawals of Ether, BNB and some USDT and USDC stablecoins were also restored. Binance said it would gradually allow users to withdraw the remaining affected cryptocurrencies.

Binance said it had covered around $6 billion of the $6.3 billion stolen in the attack. The exchange used its own money to buy replacement tokens to cover the losses. The remaining 5% consists of cryptocurrencies that are harder to find and buy in large quantities.

Binance said these assets are less liquid, meaning they cannot be easily bought or sold without affecting their prices. The exchange said it could take longer to arrange the remaining tokens, according to Reuters. The US Federal Bureau of Investigation (FBI) said on Saturday that a North Korean state-sponsored hacking group called TraderTraitor was responsible for the attack.

The group has been linked to cyberattacks carried out to steal money and generate revenue for North Korea. The FBI said it had observed members of the group converting the stolen cryptocurrency into Ether. It also warned that the hackers could use related technologies to move and hide the stolen assets further.

North Korea has repeatedly denied using state-linked cyber groups for espionage, financial theft and raising money. North Korea's mission in Geneva and its embassy in China did not respond to requests for comment, according to Reuters.

Most of the theft took place within around 20 minutes, starting late on Thursday. The speed and method of the attack were similar to previous major cryptocurrency thefts blamed on North Korea. US blockchain research firms TRM Labs and Chainalysis said the attack showed similarities to earlier cyberattacks linked to the country.

Blockchain analysis firms study cryptocurrency transactions to track how digital money moves between accounts. Analysts had also blamed North Korea for the Binance attack. US President Donald Trump said on Saturday that the United States was still not certain whether North Korea was behind the attack.

"We don't know if it's North Korea — but if it is, we'll talk to North Korea about it," Trump told reporters. His comments were posted by an official White House account on X. This came after the FBI publicly identified the North Korean hacking group TraderTraitor as responsible for the attack.

Binance has repeatedly said that it will take responsibility for the financial impact of the hack. The exchange said it had internally set aside around $6.34 billion of company funds to cover the losses. It has also worked with other cryptocurrency companies to freeze some of the stolen assets.

Binance said around $3 billion worth of affected assets had been located by Friday. The exchange said it would use its own financial resources rather than pass the losses on to customers, according to Reuters. Binance said the money used to buy replacement cryptocurrencies came from three sources.

These included its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund and its corporate treasury. SAFU is a reserve created by Binance to protect customers in case of security problems or other emergencies. Binance had previously set aside $1 billion for this fund.

Co-CEO Yi He said on Saturday that the company would use 50% of its SAFU funds to help cover the losses, according to Reuters. The company also promised to rebuild the fund and bring it back to around $1 billion. Binance co-CEO Richard Teng described the security breach as a "complex attack".

He said the attack involved a compromised laptop, which means hackers had gained access to a device, according to Reuters.