Binance has begun reopening withdrawals after a massive security breach that drained approximately $6.3 billion in cryptocurrency. The exchange suspended all deposits and withdrawals when the hack was discovered, but as of early Sunday, withdrawals are being reinstated in stages, according to updated network status reports.
Binance reports that it has already recovered 95% of the stolen assets. The funds that remain missing are said to be “less liquid,” making them harder to repossess at scale. The company has pledged to absorb the loss itself and reiterated that no user will bear the financial consequences of the breach.
Phased Withdrawal Resumption
Wallet and network services aren’t all back to normal yet. While deposits of assets like Ethereum have resumed fully, withdrawals of Ethereum are still only partially enabled. Bitcoin, on the other hand, continues to be partially suspended in both deposit and withdrawal services. The resumption of withdrawals will occur over time and will depend on the type of cryptocurrency and its network.
Users should be prepared for delays or longer processing times during this phased return to normal operations, especially during high traffic.
Attack Attribution and Next Steps
Binance previously identified the breach as the work of North Korean hackers. The FBI has now confirmed that attribution, naming a group called TraderTraitor as responsible. The stolen crypto is reportedly being funneled into Ethereum, with additional laundering activity likely underway.
Work is still ongoing to solidify Binance’s defenses and bring back the remaining affected assets. The company also plans to release a comprehensive incident report once internal investigations are complete.
This breach strikes at a precarious moment for the industry. As more marketplaces face heightened scrutiny and regulation, Binance’s handling—both in crisis response and in the speed of recovery—could set new expectations. Watching how they manage the remaining recovery and what preventive reforms they commit to will be key to understanding whether this episode marks just another security incident—or a turning point for crypto infrastructure security.
