Binance started restoring cryptocurrency withdrawals in phases on Sunday, more than two days after it suspended them in the wake of a cyberattack that diverted more than 6 billion dollars, making it the largest theft in the exchange's history.
The suspension was announced on Friday morning, Asia time, as Binance moved to contain the breach. The first assets to reopen for withdrawals were bitcoin, followed by ether and the stablecoins USDT, issued by Tether, and USDC, issued by Circle. Binance said it is prioritising the cryptocurrencies that saw the highest demand over the past week, and that each combination of network and asset is reopened only after passing stability and security tests.
The FBI attributed the attack to North Korea on Saturday, naming the TraderTraitor group as responsible. The US agency had previously linked the same group to the 2025 attack on Bybit, which until the latest incident stood as the largest crypto theft on record.
How the breach happened
Binance has pointed to the compromise of an engineer's laptop, alongside other points of intrusion, as part of how the attackers gained access. The exchange said it has found no evidence that private keys were leaked in the process.
The company said it has restored most of the stolen assets and will fully cover the remaining losses itself, without passing any costs on to users. Richard Teng, Binance's co-executive chairman and chief executive, said this coverage is possible because the exchange has invested revenues in cryptocurrencies. Yi He, who shares leadership of the exchange, said this year's revenues alone are enough to cover the amount lost in the attack.
Scale of Binance's reserves
The exchange's ability to absorb the loss is tied to the scale of its balance sheet. According to DefiLlama data cited by Bloomberg, Binance holds about 135 billion dollars in assets, dwarfing OKX, the second-largest platform, which holds 29 billion dollars.
Binance also maintains SAFU, an emergency fund created in 2018 specifically to protect clients in extreme situations such as this one. In 2024, the exchange had indicated the fund was usually kept at around 1 billion dollars, though its current size following the attack has not been disclosed.
For users across Europe who held funds on the platform during the suspension, the phased reopening marks the first concrete sign of normalisation after a weekend in which one of the industry's largest exchanges was effectively frozen. Binance has not specified how long the full rollout to all assets and networks will take.
