Binance Resumes Phased Withdrawals After $6.3 Billion Theft

Cryptocurrency exchange Binance said on Sunday that it would restart cryptocurrency withdrawals using a phased approach, resuming operations after hackers stole $6.3 billion from the platform’s wallets. The company had blocked all deposits and withdrawals immediately upon discovering the theft, freezing user access to their holdings while teams investigated how the breach occurred and contained the damage.

Binance disclosed that it has already sourced replacements for 95 percent of the stolen cryptocurrency and continues working to acquire the remaining assets. The company indicated that completing the recovery has taken longer for the final 5 percent because these particular holdings consist of cryptocurrencies with lower trading volume and require additional time to locate in sufficient quantities.

Understanding the Theft

A $6.3 billion loss

The theft exposed the scale of assets flowing through major cryptocurrency platforms. Hackers gained unauthorized access to Binance’s cryptocurrency wallets and withdrew $6.3 billion worth of digital currency, representing one of the largest known breaches of a centralized exchange.

The exchange’s response

Binance’s decision to halt all transactions gave the company time to investigate the incident, identify which systems had been compromised, and determine what security fixes were needed before resuming normal operations. The freeze was an extreme step, but the company determined it necessary to prevent further unauthorized asset movement and protect remaining funds.

The Cost to Users and Binance’s Guarantee

Read also: Binance halts withdrawals after suspected $2 billion-plus crypto theft · Alleged Chinese Spy Targeted Nvidia CEO in U.S. Investigation · Bluesky Blocks DHS Employee Data as Government Pursues Takedowns · Cyberattacks on Danfoss Refrigerators Destroy Food Across Europe

Full reimbursement commitment

Binance stated that it would absorb the entire financial loss from the theft. No user would experience a loss of funds, and the company would not offset the cost through higher fees, reduced features, or other charges to its user base. According to Binance’s statement, the company itself would bear the financial impact of the stolen funds and these losses would not be transferred to users.

Recovery progress so far

The exchange has already replaced 95 percent of the $6.3 billion in stolen crypto by acquiring equivalent amounts on the open market. The remaining 5 percent has proven more difficult to source quickly because it consists of less frequently traded digital assets that lack the liquidity needed for rapid bulk purchase at the scale the exchange requires.

Restarting Withdrawals in Phases

Staged approach by cryptocurrency

Binance chose to lift its freeze incrementally rather than all at once, with different cryptocurrencies and blockchain networks returning to operation at different times. This strategy allows the platform to handle the anticipated spike in withdrawal requests without overwhelming its infrastructure.

According to Binance’s status page, the restart showed uneven progress as of Sunday morning. Bitcoin remained partially suspended for both deposits and withdrawals, indicating the exchange was processing only some requests while holding others. Ethereum deposits had returned to normal status, but Ethereum withdrawals continued to move more slowly.

Delays expected during restart

Users attempting to withdraw funds should anticipate that processing times will exceed normal levels as the volume of requests increases. The exchange did not announce a specific date or time by which all withdrawal and deposit functions would return to complete normal operations.

Attribution to a North Korean Group

FBI identifies the attackers

The FBI identified TraderTraitor, a North Korean hacking group, as responsible for the breach. Binance had previously indicated it suspected North Korean involvement, and the FBI’s finding confirmed that assessment. The attribution marked the identification of a major cryptocurrency theft traced to a nation-state-linked cybercriminal organization.

Laundering through Ethereum

The FBI found that TraderTraitor has been converting the stolen cryptocurrency into Ethereum, with plans to continue moving the assets through additional laundering channels. The group’s choice to convert to Ethereum, one of the most widely traded cryptocurrencies, may reflect an effort to convert the stolen funds into a more liquid form that could be easier to move and potentially harder to track than the original assortment of stolen coins.

Transparency and Investigation

Binance acknowledged that the withdrawal freeze caused genuine inconvenience to users, who rely on quick access to their crypto holdings. The company maintained that freezing transactions was unavoidable while its teams worked to contain the breach, understand its scope, restore affected systems, and conduct full security audits.

Binance said it will release a comprehensive incident report once its investigation concludes. This report should reveal details about the attackers’ method of gaining access, which specific security controls failed, and what measures the exchange has put in place to prevent similar breaches.

Recovery Continues

Though withdrawals resuming represents a critical milestone, Binance indicated substantial work remains. The exchange plans to reinforce its security systems, finish acquiring the remaining stolen assets, and provide regular updates as conditions change and the situation develops.

The recovery of that final 5 percent of stolen cryptocurrency may extend over several more days or weeks, as the exchange continues to locate and purchase these less-liquid holdings in the volumes required to restore its full reserves.

Source: TechCrunch