Binance said Sunday it has resumed withdrawals of bitcoin and other cryptocurrencies after a $6.3 billion theft from its hot wallets announced Thursday. The exchange restored withdrawals first for the Bitcoin network, then later for Ethereum Network and BNB Smart Chain.
Binance said Saturday it has covered 90% of the stolen assets. The exchange stated that all BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now "fully backed 100%," and said it will absorb the financial impact rather than its users. The remaining 10% consists of less liquid tokens outside its top 10 that may take longer to source.
The exchange is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish assets. Binance said it will continue buying the remaining token assets through market and over-the-counter channels until it reaches 100% coverage for all tokens.
The FBI said late Saturday that North Korea was responsible for the theft. Co-CEO Richard Teng said the attack involved a more complex process than initially described. Binance initially suggested it may have involved a compromised DevOps engineer's laptop, but Teng later clarified the attack was more intricate than the misuse of a single engineer's permissions.
Blockchain intelligence firm TRM Labs said the attack matched features of earlier North Korea-linked heists, including small Tornado Cash withdrawals funding an operator wallet and signatures obtained in advance then executed in one burst.
Binance said its next milestone is resuming full withdrawal services for users by Sunday, subject to security checks.