Binance is preparing to reopen withdrawals in phases as early as today, less than 72 hours after what the exchange described as the largest recorded crypto theft in dollar terms. The company said deposits remained available before and after the incident and were not affected.
The FBI, meanwhile, formally attributed the attack to North Korean hackers and warned that the stolen assets are already moving through laundering channels. US President Donald Trump said he would talk to the Koreans about the matter.
Withdrawals to Resume in Phases
In a statement, Binance said phase one of withdrawals would begin progressively between 06:00 and 09:00 UTC today, after the exchange completes its latest security and operational checks.
The first phase covers 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Dogecoin, Polygon, Arbitrum, Base, Optimism and Sui. Supported assets include BTC, ETH, BNB, XRP, SOL, DOGE and numerous altcoins, with additional networks and tokens to be added once the exchange deems them ready.
Binance cautioned that users could encounter temporary delays as traffic returns.
Reserves Being Replenished
The exchange said it has accelerated efforts to replace the assets affected by the breach. In its latest update, 95% of the impacted amount had been replenished, up from 90% in its Saturday update.
- BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are fully backed.
- The remaining 5% consists of less-liquid tokens that are taking longer to source through market and OTC purchases.
Binance again promised to absorb the financial damage from the hack rather than pass it on to its user base. It also plans to publish a full post-incident report after the investigation concludes.
FBI Points to North Korea
The FBI confirmed multiple reports after the hack that the Democratic People's Republic of Korea was behind it, stealing more than $6 billion in cryptocurrencies from the world's largest crypto exchange. The agency identified the operation as part of the country's cyber campaign known as "TraderTraitor."
The agency added that the attackers have been converting much of the stolen digital assets into Ethereum and are expected to continue laundering the funds through decentralized finance platforms and instant-swap services.
The FBI, the Secret Service and IRS Criminal Investigations have urged exchanges, DeFi operators, blockchain analytics companies and other industry participants to block transactions connected to identified attacker-controlled addresses. Binance's CZ thanked the agencies for their involvement and assistance.
Trump, who said he would look into the hack, promised to talk to North Korea if it is confirmed that the country was responsible.
