Cryptocurrency exchange Binance has announced plans to resume withdrawals after covering most of the losses resulting from a major cyberattack that resulted in the theft of approximately $6.3 billion in digital assets.
The company said the initial phase of withdrawals would begin between 0600 and 0900 GMT, covering 15 cryptocurrencies, including Bitcoin, Ether, XRP and Dogecoin.
Binance said it had replaced approximately $6 billion worth of stolen cryptocurrency using its own funds. The remaining five per cent comprises less liquid digital assets, which may require additional time to acquire in the necessary quantities.
The incident adds to a growing number of major cryptocurrency thefts worldwide. According to researchers at TRM Labs, cybercriminals stole approximately $2.9 billion in cryptocurrency through nearly 150 attacks last year.
The Federal Bureau of Investigation (FBI) identified North Korea’s state-sponsored cyber group, known as TraderTraitor, as responsible for the latest attack.
North Korea has repeatedly denied allegations of using state-linked cyber operations for espionage, financial theft and generating revenue. Its diplomatic missions in Geneva and China did not immediately respond to requests for comment.
According to the FBI, investigators observed members of the group converting stolen digital assets into Ether. The agency also warned that further attempts to launder the funds through associated technologies were expected.
Blockchain analysis firms TRM Labs and Chainalysis said the majority of the theft occurred within approximately 20 minutes late on Thursday, bearing similarities to previous cyberattacks attributed to North Korean hackers.
Security analysts have described the incident as potentially one of the largest financial thefts in history.
However, US President Donald Trump said on Saturday that Washington had not yet established North Korea’s involvement.
“We don’t know if it’s North Korea but if it is, we’ll talk to North Korea about it,” Trump told reporters.
Binance said it had been coordinating with industry partners to freeze the stolen assets, with approximately $3 billion reportedly identified by Friday.
The exchange reiterated its commitment to absorbing the financial impact of the cyberattack, setting aside approximately $6.34 billion in company funds to cover the losses.
The replacement funds were sourced from several internal reserves, including Binance’s $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve established to protect customers against security incidents, its Futures Insurance Fund and corporate treasury.
Binance co-CEO Yi He said on Saturday that half of the SAFU reserve would be utilised to address the losses, while the company had committed to restoring the fund to approximately $1 billion.
The exchange’s other co-CEO, Richard Teng, described the incident as a complex cyberattack involving a compromised laptop and malicious software designed to erase evidence of its activities, complicating efforts to investigate and trace the breach.
Cryptocurrency prices declined on Friday as Binance worked to reassure customers about the security of their holdings following the incident.
Binance, which provides services for buying, selling and trading digital assets, has approximately 335 million registered users worldwide. According to its 2025 annual report, the exchange held around $162.8 billion in assets under custody.
