Binance Reopens Withdrawals After US$6.3 Billion Hack as Trump Questions FBI’s North Korea Attribution
The cryptocurrency exchange says it has replaced 95% of the stolen tokens and will publish updated proof-of-reserves data after completing its investigation.
Binance reopened withdrawals on Sunday, three days after hackers drained an estimated US$6.3 billion from the exchange. Meanwhile, US President Donald Trump publicly questioned the FBI's finding that North Korea carried out the theft.
Bitcoin withdrawals came back shortly after 6am GMT, or 2pm in Hong Kong. Bitcoin is one of 15 assets in phase one, which also covers ether, XRP and dogecoin. BNB and some USDT and USDC withdrawals were also restored. Binance said it was ranking tokens by the past week's user demand and completing stability and security checks on each network before reopening it.
The exchange said it had now covered 95% of the stolen tokens, about US$6 billion, by buying replacements with company money. On Saturday the figure was 90%. The remaining 5% are less liquid assets that will take longer to source in the required amounts, Binance said.
The FBI said on Saturday that North Korea was responsible for stealing more than US$6 billion in virtual assets from Binance on or about 29 October. It named the state-backed unit it calls TraderTraitor. The bureau said it had observed the group converting stolen assets into ether and expected further laundering through decentralised finance and instant swap services. It also urged private-sector firms to block transactions with addresses linked to the group.
Trump was less certain. "We don't know if it's North Korea," he told reporters late on Saturday, adding that Washington would talk to Pyongyang if it turned out to be responsible.
North Korea's mission in Geneva and its embassy in China did not respond to Reuters' requests for comment. Pyongyang has for years denied using state-linked cyber units for financial theft.
The FBI's attribution matched what private investigators said within hours of the attack, which we reported on Thursday. Blockchain analytics firm TRM Labs said an attacker moved about US$6.36 billion out of Binance wallets on ten blockchains, most of it in roughly 20 minutes, and attributed the attack to TraderTraitor with high confidence. Chainalysis chief executive Jonathan Levin said the hack was likely the group's work.
The FBI blamed the same unit for the US$1.5 billion theft from Bybit in February 2025. That theft was roughly a quarter the size of this one.
Binance said it has set aside about US$6.34 billion in company funds to cover the losses. The money comes from its roughly US$1 billion Secure Asset Fund for Users (SAFU), part of its Futures Insurance Fund and its corporate treasury. Co-chief executive Yi He said half the SAFU fund would be used and that the company would top it back up to about US$1 billion. Separately, industry partners including stablecoin issuers Tether and Circle had helped freeze about US$3 billion of the affected assets as of Friday, Binance said.
Founder Changpeng Zhao thanked US law enforcement on X for helping track and freeze the stolen funds. Zhao pleaded guilty in 2023 to failing to maintain an effective anti-money laundering programme, and Trump pardoned him last year.
Binance has said it will publish updated proof-of-reserves data on Monday. It has also promised a full technical post-mortem once its investigation is complete.