Key Takeaways
- • Binance resumed bitcoin, ether, BNB and some USDT and USDC withdrawals on Sunday, with the first phase covering 15 crypto assets including bitcoin, ether, XRP and dogecoin, after covering 95% of the $6.3 billion in tokens stolen from its platform, according to Reuters.
- • Binance said it covered about $6 billion of stolen assets by buying replacement tokens with company funds, drawing on its $1 billion Secure Asset Fund for Users (SAFU), parts of its Futures Insurance Fund and its corporate treasury.
- • The FBI said on Saturday that North Korea's state-sponsored unit TraderTraitor was responsible, citing members converting stolen assets into ether, though President Trump said the US was not certain of North Korean involvement.
- • Binance has set aside around $6.34 billion of company funds to cover losses and said it would replenish SAFU to about $1 billion after co-CEO Yi He said 50% of the fund would be used.
- • The remaining 5% of stolen tokens are less liquid assets that may take longer to source; about $3 billion in assets had been frozen as of Friday.
Summary
Binance, the world's largest cryptocurrency exchange, resumed bitcoin, ether and some stablecoin withdrawals on Sunday and said other assets would follow in phases. The exchange said it had covered 95% of the $6.3 billion in tokens stolen from its platform. Bitcoin withdrawals resumed shortly after 0600 GMT, while ether, BNB and some USDT and USDC withdrawals were also restored. The first phase covers 15 crypto assets, including bitcoin, ether, XRP and dogecoin.
The heist, which analysts believe may be the largest financial robbery on record, adds to a string of recent crypto thefts. According to researchers at TRM Labs, attackers stole $2.9 billion in cryptocurrency across nearly 150 attacks last year. The bulk of the latest theft unfolded in about 20 minutes beginning late Thursday and bore similarities to earlier large attacks attributed to North Korea, according to TRM Labs and Chainalysis.
The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible, and that members had been observed converting stolen assets into ether. The agency expected further laundering of the assets. Pyongyang has denied using state-linked cyber units for espionage and theft. President Donald Trump said on Saturday that the US was not certain North Korea was involved. Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence.
Binance said it covered roughly $6 billion of stolen assets by buying replacement tokens with company money. The funds came from its $1 billion SAFU reserve, some of its Futures Insurance Fund and its corporate treasury. Co-CEO Yi He said 50% of SAFU would be used, and the company committed to replenishing the fund to about $1 billion. The exchange has set aside around $6.34 billion of company funds for losses. About $3 billion in affected assets had been frozen as of Friday with industry partners. The remaining 5% consists of less liquid assets that may take longer to source.
Binance, which has 335 million registered users and reported about $162.8 billion in assets under custody in its 2025 annual report, thanked US law enforcement for its support. Founder Changpeng Zhao, who was convicted in the US of failing to maintain an effective anti-money laundering program before being pardoned by Trump last year, credited US agencies with tracking and freezing the stolen assets. Crypto prices fell on Friday as the hack was disclosed.
The heist, which analysts believe may be the largest financial robbery on record, adds to a string of recent crypto thefts. According to researchers at TRM Labs, attackers stole $2.9 billion in cryptocurrency across nearly 150 attacks last year. The bulk of the latest theft unfolded in about 20 minutes beginning late Thursday and bore similarities to earlier large attacks attributed to North Korea, according to TRM Labs and Chainalysis.
The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible, and that members had been observed converting stolen assets into ether. The agency expected further laundering of the assets. Pyongyang has denied using state-linked cyber units for espionage and theft. President Donald Trump said on Saturday that the US was not certain North Korea was involved. Binance co-CEO Richard Teng described the breach as a complex attack involving a compromised laptop and malicious software designed to delete evidence.
Binance said it covered roughly $6 billion of stolen assets by buying replacement tokens with company money. The funds came from its $1 billion SAFU reserve, some of its Futures Insurance Fund and its corporate treasury. Co-CEO Yi He said 50% of SAFU would be used, and the company committed to replenishing the fund to about $1 billion. The exchange has set aside around $6.34 billion of company funds for losses. About $3 billion in affected assets had been frozen as of Friday with industry partners. The remaining 5% consists of less liquid assets that may take longer to source.
Binance, which has 335 million registered users and reported about $162.8 billion in assets under custody in its 2025 annual report, thanked US law enforcement for its support. Founder Changpeng Zhao, who was convicted in the US of failing to maintain an effective anti-money laundering program before being pardoned by Trump last year, credited US agencies with tracking and freezing the stolen assets. Crypto prices fell on Friday as the hack was disclosed.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.