Binance reopens withdrawals as FBI blames North Korean group for $6.3bn hack
Customers pulled about $3.6 billion from the exchange on Sunday as it began a phased restart after a heist thought to be the biggest in crypto history.
The Global Sun Desk ·
Binance, the world's biggest cryptocurrency exchange, began reopening withdrawals in phases on Sunday, 1 November, days after hackers stole about $6.3 billion in digital assets from it. Customers withdrew a net $3.6 billion within hours, according to figures the company published.
In the window from 06:00 to 15:30 GMT on Sunday, the exchange said, withdrawals came to $4.649 billion against deposits of $1.01 billion. That left a net outflow of about $3.64 billion, roughly 2.1 per cent of the $171 billion in assets it manages. Binance said withdrawals had spiked at first, then eased and were settling as it expected.
FBI names the group
On Saturday the US Federal Bureau of Investigation attributed the theft, which it dated to about 29 October, to North Korea. It pointed to a North Korea-linked unit called TraderTraitor, believed to belong to the Lazarus Group, and said the unit was swapping the loot mostly into ethereum and was likely to launder it further. The FBI published a list of wallet addresses and urged industry partners to block transactions involving them.
Private analysts had reached the same view earlier. Al Jazeera reported that the blockchain firms TRM Labs and Chainalysis both blamed North Korean hackers, and TechCrunch reported that Elliptic did too. TRM said most of the theft was over in about 20 minutes. The same group was blamed for the 2025 hack of the exchange Bybit, which was the previous record. Pyongyang regularly denies carrying out such hacks, Al Jazeera noted.
How it happened
Binance said in a post on X that an initial investigation pointed to a compromised engineer's laptop, which let an attacker reach a service container and submit unauthorised withdrawal transactions. The company said it had seen no evidence that any wallet private key had leaked. Co-chief executive Richard Teng called it a complex attack, and the Guardian reported that it also involved malware built to wipe traces of its own activity. On Friday, Al Jazeera said, Binance added that further investigation had uncovered "additional points of breach".
Binance suspended deposits and withdrawals while it investigated. Its US platform, Binance.US, said it was not affected. The company said about $3 billion had been frozen by industry partners; Al Jazeera, citing Reuters, put the share frozen by the stablecoin issuers Tether and Circle at more than $2.3 billion.
Who pays
Binance has said users will not bear the loss. It said it had replaced about 95 per cent of the stolen assets by Sunday, up from 90 per cent a day earlier, and that the remainder is less liquid and takes longer to buy. The Guardian reported that the company set aside about $6.34 billion of its own funds, drawing on a reserve fund for users, a futures insurance fund and its corporate treasury.
The first phase of the restart covered 15 networks and assets, the Guardian said, among them ethereum and the USDT and USDC stablecoins on the Ethereum network. The BBC counted more than two dozen major cryptocurrencies as having resumed, so the tally differs by outlet. Bitcoin deposits and withdrawals were still listed as partly suspended on Sunday morning, TechCrunch said, and users were warned to expect delays.
Efforts to trace and recover the stolen money are continuing. Alec Zebrick of the analytics firm Chainalysis told the BBC: "We continue to see funds being laundered quite actively." Binance has promised a fuller incident report once its investigation ends.