Binance Resumes Withdrawals Following Record-Breaking $6 Billion Crypto Cyber Theft

Binance began restoring customer withdrawals on Sunday, taking the first tentative steps toward normal operations following a catastrophic cyberattack that saw hackers drain over $6 billion from the platform. The incident stands as the largest digital asset theft ever recorded in the history of the cryptocurrency industry. As the broader market and regulatory observers await definitive answers regarding the breach—widely blamed by intelligence and blockchain analysis firms on North Korean state-sponsored threat actors—the world’s largest digital-asset platform has focused heavily on bolstering its internal security defenses and fulfilling its promise to make affected users whole.

The platform, which dwarfs its industry competitors with roughly $132 billion in assets under management compared to the roughly $29 billion held by the second-largest exchange OKX, reopened Bitcoin withdrawals shortly after 2 p.m. Singapore time. This came more than two days after the exchange was forced to abruptly halt all withdrawal services following the initial detection of the breach. By Sunday evening in Asia, DefiLlama data indicated that the platform had experienced approximately $3.5 billion in net outflows. Binance Co-Chief Executive Officer Yi He clarified on the social media platform X that a portion of these immediate transfers were simply internal movements between Binance’s own operational wallets.

Implementing a highly controlled, step-by-step recovery process, Binance announced via X that its first phase of restored withdrawals would cover 15 distinct tokens, including Ether alongside the two largest stablecoins in the global ecosystem: Tether’s USDT and Circle Internet Group Inc.’s USDC. According to company communications, withdrawals across 15 separate blockchain networks—including Ethereum, BNB Smart Chain, XRP, and Base—were successfully brought back online by approximately 8:30 p.m. Singapore time.

Elaborating on the cautious operational strategy, Binance stated that it is taking a phased approach that prioritizes tokens based on user demand data from the preceding week. This methodology ensures that each individual network and asset pair can be restored carefully, allowing for rigorous stability and security checks to be fully completed before access is completely reopened to the public.

Reactions across the institutional trading and advisory landscape have varied significantly. Quantitative trading firm SQS Trading, which maintains approximately a quarter of its total trading capital on Binance, is proactively cutting that exposure by roughly a third, according to founder Eli Williams. However, Williams confirmed that his firm will not completely flatten its positions or abandon the exchange as a crucial venue for market hedging. Noting that it remains difficult to forecast the long-term net impact at this early stage, Williams emphasized that SQS Trading will closely monitor capital outflows and overall volume impacts relative to other major execution venues.

Conversely, other market participants have chosen to maintain a steady course without altering their operations. Justin d’Anethan, head of research at private markets advisory firm Arctic Digital, noted that he remains entirely unfazed by the record-breaking security breach. When something seems suspicious, d’Anethan observed, it is wise to act swiftly; however, when a catastrophic event unfolds, he believes it is often wiser to refrain from knee-jerk reactions. Confirming his confidence in the platform, d’Anethan stated that he has not moved funds away from Binance and would not consider doing so.

A spokesperson for Binance acknowledged that withdrawal volumes experienced a sharp surge at the very beginning of the reopening process. Nevertheless, the company reported that these figures are now stabilizing toward what it considers normal daily activity, representing only a small percentage of its overall assets under management.

This phased restart serves as a severe stress test for Binance’s public commitment to fully reimburse its customers following a theft that is four times the size of the previous record-breaking crypto hack, which targeted Bybit in 2025. Adding official weight to industry suspicions, the United States Federal Bureau of Investigation announced on Saturday that the devastating Binance attack was executed by TraderTraitor. This elite North Korean hacking unit was also held directly responsible by federal authorities for the roughly $1.5 billion Bybit theft.

Despite the historic scale of the exploit, the broader financial market fallout has appeared remarkably contained. Most major cryptocurrencies recorded price movements of less than 1% on Sunday. Bitcoin, which commands roughly 60% of the entire sector’s aggregate market value, was trading comfortably around $78,000, representing a decline of about 5% below its Thursday high achieved just prior to the onset of the attack.

Industry veterans have pointed to the subdued market reaction as a testament to the maturation of the digital asset ecosystem. Haseeb Qureshi, managing partner at venture capital fund Dragonfly, noted that the extraordinary speed of the industry’s collective response highlights how far the market has evolved in handling systemic crises.

Binance revealed that it has successfully replaced approximately 95% of the stolen cryptocurrency utilizing a combination of its corporate treasury, emergency reserves, and established insurance funds. The assets drained by the hackers comprised a diverse mix of the industry’s largest cryptocurrencies distributed across 10 distinct blockchains, prominently featuring Bitcoin and Ethereum. Reaffirming its corporate stance, the exchange stated that its core commitment remains entirely unchanged, pledging that Binance will bear the full financial impact of the stolen funds and ensuring that these substantial losses will not be passed on to users.

The exchange’s ability to comfortably cover such massive losses stems directly from its ongoing strategy of reinvesting corporate revenue back into cryptocurrencies, as explained by Binance Co-Chief Executive Officer Richard Teng in a video published on social media on Friday. Furthermore, Yi He noted that Binance’s projected revenue for the current year would completely cover the total amount lost in the incident.

Despite these assurances, the ultimate net cost to Binance remains undetermined. The exchange reported that approximately $3 billion in affected assets had been successfully frozen as of Friday, though leadership cautioned that freezing assets does not equate to immediate recovery.

The sophisticated nature of the Binance heist has brought renewed urgency to discussions surrounding cybersecurity across the broader financial industry. A wave of high-profile cyberattacks targeting crypto firms and traditional financial institutions throughout the year has heightened widespread concerns that artificial intelligence is empowering malicious actors to execute more effective breaches. Security experts increasingly believe that North Korean state-sponsored hackers have actively integrated advanced artificial intelligence tools into their operational arsenal, utilizing them specifically to streamline reconnaissance, target identification, and social engineering campaigns.

Alongside the FBI, prominent blockchain intelligence and analytics firms including TRM Labs, Chainalysis, and Elliptic have all publicly attributed the Binance attack to North Korean cyber operatives.

These persistent incidents have ruthlessly exposed lingering security vulnerabilities just as the cryptocurrency industry deepens its integration into mainstream global finance. Earlier in the year, hundreds of millions of dollars were drained from Bitget in September, while malicious actors simultaneously managed to steal more than $100 million in Bitcoin from user wallets secured by Coinkite Inc. devices. Additionally, hardware tampering involving Ledger devices resulted in millions of dollars in unexpected losses for consumers. Other recent high-profile cyberattacks have successfully targeted prediction market Polymarket, South Korean financial firms Mirae Asset Global Investments and Daishin Securities, and Japanese currency trading platform GMO Internet Group Inc.

Confronting the severe reputational damage that such an unprecedented breach could inflict, Yi and Teng took to social media on Friday to address the global community directly. In her video message delivered in Mandarin, Yi promised that Binance would maintain active collaboration with international law enforcement agencies to track down the perpetrators, while reaffirming the company’s absolute pledge to reimburse all impacted users.

Refusing to let the security failure derail the sector’s trajectory, Yi emphasized that Binance will not permit hackers to steal the hard-earned momentum of the industry. Admitting that internal shortcomings contributed to the incident, she stated that the company should have invested heavily in security much earlier and established far stricter internal standards. Looking toward the future, Yi vowed that Binance will hold nothing back, whether committing substantial capital to robust security infrastructure or actively fighting sophisticated threat actors.

Binance originally established an emergency financial reserve known as the Secure Asset Fund for Users, or SAFU, back in 2018 to act as a vital backstop for customers facing extreme market and operational situations. While the SAFU fund is generally maintained at a baseline of around $1 billion, its total valuation has historically fluctuated in tandem with broader digital asset market movements.

In detailing the technical vectors of the breach, Binance previously indicated that the incident likely involved a compromised software engineer’s laptop alongside additional vectors of entry. However, the exchange confirmed that its ongoing forensic investigations have uncovered no evidence pointing to compromised or leaked private keys.