Binance, the world's largest cryptocurrency exchange, has begun gradually restoring withdrawal services following a massive cyberattack that resulted in the theft of approximately $6.3 billion in digital assets, marking one of the largest hacks in crypto market history.
Services resumed after some operations were suspended last Thursday to allow cybersecurity teams to investigate the breach and conduct necessary security checks, amid US accusations that North Korea was behind the attack.
Binance Bears Hack Losses and Restores Affected Assets
Binance announced it has managed to replace about 95% of the affected assets, confirming that users will not bear the financial losses resulting from the incident and that the platform will cover the full financial impact of the stolen funds.
The company began reopening withdrawals in stages, including major cryptocurrencies like Bitcoin and Ethereum, along with some stablecoin services.
The platform warned of potential delays due to high demand as services return, noting that the restoration of remaining operations will occur gradually after security checks are completed.
It also confirmed ongoing cooperation with law enforcement agencies and specialized cryptocurrency firms to track and recover the stolen assets.
FBI Accuses North Korea
The US Federal Bureau of Investigation (FBI) announced that North Korean hackers are behind the breach, noting that the attack is linked to a cluster of cyber activities tracked by the Bureau as "TraderTraitor."
The FBI explained that the attackers have primarily begun converting the stolen assets into Ethereum, warning of potential ongoing digital money laundering through decentralized finance platforms and instant cryptocurrency exchange services.
These accusations follow a previous incident targeting the Bybit exchange in February 2025, where the theft of approximately $1.5 billion in cryptocurrencies was attributed to the same actors.
Ongoing Investigations to Reveal How Binance Was Hacked
Binance initially indicated that an employee's laptop may have been compromised, but subsequent investigations revealed additional breach points, prompting the company to expand its inquiry.
The platform confirmed that the investigation is ongoing and that it will publish a detailed report on the incident's circumstances once completed.
