Binance, the world’s largest cryptocurrency exchange, resumed withdrawals on Sunday after covering 95% of the $6.3 billion in tokens stolen from its platform in what analysts describe as the world’s largest digital heist — and possibly the biggest financial robbery ever. The exchange said users, not the company, would not bear the loss: it will absorb the financial impact of the stolen funds itself.
FAKTA
- Binance resumed withdrawals in phases from Sunday, 1 November 2026, starting with 15 digital currencies including Bitcoin, Ether and Solana.
- About $6 billion of the $6.3 billion stolen has been covered by Binance using company money to buy replacement tokens.
- The remaining 5% consists of less liquid assets that may take longer to source.
- The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible for the attack.
- Binance said it processed around $4.6 billion in withdrawals and $1 billion in deposits by 10:30 a.m. ET on Sunday.
Binance withdrawals resume in phases
Binance had suspended withdrawals on Friday after its system was hacked. “Today, we’re beginning the phased resumption of withdrawals, taking a careful approach to ensure services return safely and securely,” co-CEO Richard Teng posted on X early on Sunday. The first phase, which began between 0600 and 0900 GMT, covered 15 cryptoassets including Bitcoin, Ether, BNB, Solana, XRP and Dogecoin.
The exchange said it would continue to restore additional assets and networks in phases as security checks are completed. By 10:30 a.m. ET on Sunday it said it had processed around $4.6 billion in withdrawals and $1 billion in deposits, a sign that customers were moving quickly to test the restored service.
How the $6.3 billion was covered
Binance said it covered $6 billion of the stolen cryptocurrencies by using company money to buy replacement tokens, and set aside around $6.34 billion of company funds internally to cover the losses. The money came from its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve held to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and its corporate treasury.
Co-CEO Yi He said on Saturday that 50% of SAFU funds would be used, while the company committed to replenishing the fund to about $1 billion. Binance has also been working with industry partners to freeze some affected assets, with about $3 billion located as of Friday.
North Korea blamed by the FBI
The FBI said on Saturday that TraderTraitor — cyber actors sponsored by North Korea since at least 2020 — was responsible for the theft, and said the actors were converting the stolen currencies, mainly into Ethereum. The bulk of the theft unfolded in around 20 minutes beginning late on Thursday.
US President Donald Trump said on Saturday that the United States was still not certain if North Korea was involved, a note of caution that sits alongside the FBI’s attribution. The heist adds to a string of crypto thefts linked to North Korean actors in recent years.
Conclusion
The phased resumption of withdrawals is the first step back to normal operations for the world’s biggest crypto exchange, but it is not the end of the story: 5% of the stolen tokens remain to be sourced, frozen assets must be recovered, and the investigation into how the breach happened continues. For customers, the key commitment from Binance is unchanged — the company, not its users, will bear the financial cost.
