WHAT YOU NEED TO KNOW
  • Binance resumed bitcoin withdrawals after a record theft of about $6.3 billion from its hot wallets.
  • Withdrawals were also restored for the Ethereum Network and BNB Smart Chain.
  • Binance says it has covered up to 90% of affected assets and will absorb the financial impact.
  • The FBI determined North Korea was responsible and said the stolen assets were converted into Ethereum.

DISCLAIMER: GoldInvestors.news is not a registered investment, legal or tax advisor or broker/dealer. All investment/financial opinions expressed by GoldInvestors.news are from the personal research and experience of the owner of the site and are intended as educational material. Although best efforts are made to ensure that all information is accurate and up to date, occasionally unintended errors and misprints may occur.

Binance said Sunday that it resumed withdrawals of bitcoin and other cryptocurrencies after about $6.3 billion in token assets were stolen from its hot wallets. The theft was described as the largest crypto theft on record.

The first phase restored bitcoin withdrawals. “First batch network now opened in phase one of withdrawals is $BTC bitcoin network,” Binance said in a post on X.

The exchange later said withdrawals had also resumed for the Ethereum Network and BNB Smart Chain. Binance had identified the return of withdrawal services as its next milestone, subject to security checks.

Binance said Saturday that it had covered up to 90% of the assets involved in the heist announced Thursday. Restoring backing for those assets does not mean the exchange recovered 90% of the stolen funds from the attacker.

MORE NEWS: Gold Plunges Below $3,900 as Wall Street Rout Sparks Brutal Liquidation

The exchange said it will continue purchasing the remaining relevant token assets through market and over the counter channels. Binance plans to continue those purchases until the covered amount reaches 100% across all tokens.

“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement. “Binance will absorb the financial impact of these stolen funds, not our users.”

According to Binance, the outstanding 10% consists of tokens outside its top 10. The exchange described those assets as “less liquid, which means they may take longer to source in the required amounts.”

Binance said it is using several pools of capital to replenish the missing assets. Those resources include its Secure Asset Fund for Users, a portion of its Futures insurance fund, and its corporate treasury.

With the Federal Reserve expected to keep interest rates unchanged this month, do you think interest rates should remain where they are instead of being cut?

By completing the poll, you agree to receive emails from Gold Investors News, occasional offers from our partners and that you've read and agree to our privacy policy and legal statement.

“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions,” Binance said.

The company is continuing its investigation into the attack while restoring services. Binance declined to discuss additional details or provide further investigative updates to CNBC, instead referring questions to its latest statement.

It remains unclear how the breach took place. Binance initially said the incident may have involved “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

Co-CEO Richard Teng later said the attack involved a more complex process, rather than the misuse of a single engineer’s permissions. The exchange has not provided further details explaining the mechanics of the theft.

Close

MORE NEWS: Jersey Mike’s CEO Calls Battered Shares Undervalued After Punishing IPO Slump

Separately, the FBI said late Saturday that it had determined North Korea was responsible for the theft. The agency said malicious North Korean actors laundered Binance’s stolen assets by converting them into Ethereum.

The FBI expects the thieves to convert the digital assets as they prepare them for “further laundering stages.” The agency’s finding followed an earlier assessment from TRM Labs, a blockchain intelligence and AI investigations company.

TRM Labs had initially identified North Korean hackers as the culprits. Its assessment cited patterns that the company said resembled techniques observed in earlier attacks.

“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said.

For users, Binance’s response centers on reopening withdrawal networks and replacing the stolen assets with its own resources. The exchange has pledged to absorb the financial impact while continuing its investigation and reporting progress.

DISCLAIMER: GoldInvestors.news is not a registered investment, legal or tax advisor or broker/dealer. All investment/financial opinions expressed by GoldInvestors.news are from the personal research and experience of the owner of the site and are intended as educational material. Although best efforts are made to ensure that all information is accurate and up to date, occasionally unintended errors and misprints may occur.