Binance has resumed withdrawals in phases after replacing 95% of assets affected by a $6.3bn hack blamed on North Korea by the FBI.
Binance began resuming withdrawals in phases on Sunday after replacing about 95 per cent of the assets affected by a $6.3 billion hack, the largest in crypto history.
In its fourth recovery update, posted on X, the exchange said deposits remain open and are not affected by the incident. It said the first phase would begin between 06:00 and 09:00 UTC and cover 15 networks, with more networks and assets to follow once security and operational readiness checks are complete.
Binance withdrawals resume in phases
“We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” Binance said.
“During the initial rollout, users may experience temporary delays or longer processing times due to traffic volume.”
It advised customers whose withdrawal requests failed to try again after a short while.
Binance’s network status page on Sunday morning still showed a mix of normal, partially suspended and fully suspended networks. Bitcoin and Ether withdrawals were only partly open at that point, and some deposits were also listed as partly suspended. The exchange has not given a timetable for the second phase.
Binance had suspended deposits and withdrawals at about 22:15 UTC on 29 October.
“We did not take this decision lightly. We understand how important reliable access to withdrawals is for our users,” the company said.
“However, our priority was to protect users, safeguard the platform, and complete the necessary security checks before restoring services.”
What 95% coverage means for Binance withdrawals
“Binance has now covered approximately 95% of the impacted amount, up from 90% in our prior update,” the exchange said.
It said the outstanding 5% is made up of tokens outside the top 10, which are less liquid and took longer to source at the required scale. One estimate puts the shortfall at about $315 million.
“We continue purchasing the remaining affected assets through market and OTC channels,” Binance said.
The company said Bitcoin, Ether, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and Zcash balances are fully backed at 100 per cent.
“Covered” means Binance has restored backing for customer balances with its own money. It does not mean the stolen funds have been recovered. Binance said it used its Secure Assets Fund for Users, its corporate treasury and its futures insurance fund, and that it worked with partners to freeze about $3 billion of affected assets on-chain.
“As we have said throughout this incident: user funds remain safe. Binance will absorb the financial impact of the stolen funds, not our users,” the company said.
Who the FBI blames
On Saturday the FBI said North Korea was responsible, attributing the theft of more than $6 billion on or about 29 October to activity it calls “TraderTraitor”. It said it had observed the actors converting stolen assets into Ether and expects further laundering through decentralised finance and instant swap services. The same label was applied to the $1.5 billion Bybit theft last year.
Binance co-CEO Richard Teng called it a “complex attack”. Reports say he described a compromised laptop and malware designed to erase evidence. Binance said its teams have conducted enhanced security reviews, worked with law enforcement and industry partners to trace and recover stolen funds, and will publish a post-incident report once its investigation is complete.
