Binance restarts withdrawals after $6.3bn heist

The FBI says hackers from North Korea are responsible for the theft.

Representation of cryptocurrencies [File: Dado Ruvic/Reuters]

Binance has begun restoring customer withdrawals after hackers stole about $6.3bn in cryptocurrency in a record theft that United States authorities have blamed on North Korea.

The world’s largest cryptocurrency exchange resumed some of its services on Sunday, following a suspension imposed after Thursday’s attack as the company investigated the breach and carried out security checks.

list 1 of 4 Photos: Youth-led rallies sweep Germany

list 2 of 4 Bulgarians vote in presidential run-off amid Black Sea tensions

list 3 of 4 Mediators continue US-Iran negotiations amid war rhetoric: What we know

list 4 of 4 Thousands rally in New Delhi to demand India’s election chief resign

Binance said it had replaced approximately 95 percent of the affected assets. “Binance will absorb the financial impact of the stolen funds, not our users,” the company said in a statement on X on Sunday.

Withdrawals are being restored in stages, with major cryptocurrencies such as Bitcoin and Ether, along with some stablecoin services, being reopened.

The exchange warned that high demand could cause delays as services return, advising customers whose transactions fail to try again after a short wait.

It said further services would reopen as security checks were completed, while teams continued working with law enforcement and industry partners to trace and recover the stolen assets.

FBI blames North Korea

The FBI said on Saturday that North Korea was responsible for the theft, identifying the operation as cyber-activity it tracks under the name TraderTraitor.

Investigators had observed the attackers converting stolen assets primarily into ether, the cryptocurrency used on the Ethereum network, the agency said. It warned that further laundering was expected through decentralised finance platforms and instant cryptocurrency exchange services.

The FBI previously attributed the theft of approximately $1.5bn from cryptocurrency exchange Bybit in February 2025 to the same actors.

Binance initially said a compromised employee laptop might have enabled the intrusion, but later reported that investigators had also uncovered additional points of breach.

The company said its investigation remained ongoing and that it would publish a detailed report once the inquiry was complete.

美国联邦调查局称，来自朝鲜的黑客应对此次盗窃事件负责。

加密货币的示意图 [图片：Dado Ruvic/路透社]

在黑客窃取了价值约 63 亿美元的加密货币后，币安已开始恢复客户的提款功能。这是一起创纪录的盗窃案，美国当局指责朝鲜是幕后黑手。

全球最大的加密货币交易所于周日恢复了部分服务。此前，由于周四遭受攻击，该公司暂停了部分服务，并对此次安全漏洞进行了调查和检查。

图1/4：青年主导的集会席卷德国

保加利亚民众在黑海局势紧张之际参加总统决选（共4人，此为第2人）

（共4条）调解员在战争言论甚嚣尘上之际继续进行美伊谈判：我们目前掌握的信息

（共4条） 数千人在新德里集会，要求印度选举委员会主席辞职

币安表示，已替换了约95%的受影响资产。该公司周日在X平台上发表声明称：“币安将承担被盗资金造成的经济损失，而不是我们的用户。”

提款功能正在分阶段恢复，比特币、以太坊等主要加密货币以及一些稳定币服务已经重新开放。

交易所警告称，由于需求旺盛，服务恢复过程中可能会出现延误，并建议交易失败的客户稍等片刻后再试。

声明称，随着安全检查的完成，其他服务将陆续恢复，同时团队将继续与执法部门和行业合作伙伴合作，追踪和追回被盗资产。

联邦调查局指责朝鲜

美国联邦调查局周六表示，朝鲜应对此次盗窃事件负责，并将此次行动认定为该机构追踪的名为“TraderTraitor”的网络活动。

该机构表示，调查人员观察到攻击者主要将窃取的资产兑换成以太币（以太坊网络上使用的加密货币）。该机构警告称，预计还会有更多洗钱活动通过去中心化金融平台和即时加密货币兑换服务进行。

FBI 此前已将 2025 年 2 月加密货币交易所 Bybit 约 15 亿美元的盗窃案归咎于同一伙人。

币安最初表示，一台被入侵的员工笔记本电脑可能导致了此次入侵，但后来报告称，调查人员还发现了其他入侵点。

该公司表示，调查仍在进行中，调查结束后将发布详细报告。