Binance resumes withdrawals in phases after $6.3 billion hack

Withdrawals reopen gradually

Binance has begun allowing customers to withdraw funds again after freezing all deposits and withdrawals in the wake of a theft of $6.3 billion in cryptocurrency from its wallets, according to TechCrunch. The company announced the change early on Sunday.

The restart is deliberately gradual: what works depends on the blockchain network and the specific asset involved. As of Sunday morning, Binance's own status page listed a patchwork of conditions — Bitcoin deposits and withdrawals were both still partially suspended, while Ethereum deposits were fully operational and Ethereum withdrawals were only partially available. The exchange also cautioned that heavy traffic could cause temporary delays and longer processing times.

Nearly all stolen assets already replaced

In its latest update, Binance said it has covered 95% of the assets stolen in the breach. The remainder consists of holdings that are thinly traded, the company explained, which makes them difficult to purchase in volume quickly, so sourcing them is taking longer.

Binance reiterated that it will absorb the losses from the theft rather than pass them on to customers. It also defended the total freeze, acknowledging that reliable access to withdrawals matters greatly to users but arguing the suspension was a necessary protective step while its teams worked to limit the damage, assess the impact, restore affected services and complete security checks.

The company described the return of withdrawals as a major milestone while stressing that its work is not finished. It pledged to keep strengthening its safeguards and said a more detailed incident report will be published once its investigation is complete.

FBI points to North Korean group

Attribution for the breach is also becoming clearer. Binance had previously blamed North Korean hackers, and on Saturday the FBI identified a North Korean group tracked as TraderTraitor as responsible. According to the FBI, the group has been converting the stolen assets primarily into Ethereum, and further laundering is likely.

Why it matters

The incident is a stress test of how a major crypto exchange handles catastrophic loss. Binance's approach — halting all movement of funds, rebuilding its reserves and promising to cover the cost itself — spared users a direct hit, but the phased restoration shows that recovery is uneven: some networks remain fully suspended, others only partially available, and customers may still encounter delays.

The outstanding 5% of stolen assets highlights a subtler problem as well: replacing illiquid tokens at scale is not simply a matter of money, because buying them fast enough to avoid moving the market is genuinely hard. And with the FBI expecting continued laundering through Ethereum, the fallout will likely extend beyond Binance to whichever exchanges and services the stolen funds pass through next. The promised incident report will be the document to watch, both for how the breach happened and for whether Binance's safeguards change as a result.