Binance resumes bitcoin, ether withdrawals after recovering 95% of $6.3 billion in crypto theft; check details

Binance, the world's largest cryptocurrency exchange, resumed withdrawals of Bitcoin, Ethereum and some other cryptocurrencies on Sunday after covering 95% of the $6.3 billion in tokens stolen from its platform.

The incident has been described as the world's largest digital heist, with the Federal Bureau of Investigation (FBI) linking the attack to North Korea.

This is not the first time a cryptocurrency exchange has suffered a major cyberattack. Companies such as WazirX and Bybit have also been targeted, in which they lost $235 million and $1.5 billion, respectively.

Quick answers to key questions

Binance resumed withdrawals on Sunday after pausing them following the attack. Bitcoin withdrawals restarted shortly after 0600 GMT.

Binance restored withdrawals for 15 cryptocurrencies in the first phase, including Bitcoin, Ether, XRP and Dogecoin. Withdrawals for other affected assets were to return in phases.

Binance said it paused withdrawals as a precaution to contain the loss, assess the impact and complete security checks. The exchange said users would not bear the financial impact.

Binance said it used its own funds to buy replacement tokens, drawing on its SAFU reserve, Futures insurance fund and corporate treasury. The remaining stolen assets were less liquid and could take longer to source.

The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit. Reports cited in the articles said the attackers prepared in advance and used automation to move and launder funds quickly.

North Korean hackers were held responsible for both attacks.

Binance to use its own funds for replacement

The exchange said it would be using its own funds to purchase replacement tokens and compensate for most of the stolen amount. Withdrawals of other affected cryptocurrencies will be restored in phases.

In the first phase, Binance restored withdrawals for 15 cryptocurrencies, including major ones such as Bitcoin, Ether, XRP and Dogecoin. Bitcoin withdrawals resumed shortly after 0600 GMT on Sunday.

The remaining 5% of stolen tokens consists of assets that are less liquid and may take longer to source in the required amounts, the Changpeng Zhao-owned crypto exchange said in an official release this morning.

How did the North Korean hackers perfect the heist?

The suspected hackers behind the massive $6.3 billion Binance theft seemingly combined familiar hacking tactics with extraordinary speed and automation, raising concerns regarding the use of artificial intelligence (AI) and how it could supercharge their already sophisticated methods.

The FBI said on Saturday the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.

However, Pyongyang has for years ⁠denied using state-linked cyber units for espionage, financial theft and revenue, according to a report by Reuters.

Citing researchers at TRM Labs, an Axiom report said that the hackers started preparing for this attack around 36 hours before it began. They also laundered the stolen funds and wiped out evidence of their operations at an unprecedented speed, indicating they used automation throughout the heist.

Binance previously said that it had allocated around $6.34 billion from its own funds to cover the losses. The money spent re-buying tokens came from using part of its $1 billion secure asset fund for users (SAFU), some of its Futures insurance fund and the company's own corporate treasure, it said on X.

SAFU is a bitcoin reserve that the crypto exchange holds to protect customers in the event of security breaches or digital heists.

The withdrawals were paused after the attack as a precaution to contain the loss, assess impact and complete security checks Binance reiterated that it will bear the financial impact and that losses will not be passed to users. A post-incident report will follow once the investigation concludes, it said in a release.