Binance has resumed user withdrawals following a major cyberattack that resulted in the theft of more than $6 billion in virtual assets, with the United States Federal Bureau of Investigation (FBI) blaming North Korea for the incident.
The attack, believed to be the largest cryptocurrency heist on record, triggered a sharp decline in the prices of major digital currencies on Friday, raising fresh concerns about the security of cryptocurrency exchanges.
Binance, the world’s largest cryptocurrency exchange by daily trading volume, has assured customers that it will fully absorb the financial losses, disclosing that it has used company funds to purchase tokens to replenish about 90 per cent of the stolen assets.
The exchange had suspended user withdrawals following the attack but announced that services would be restored gradually, with the first phase beginning on Sunday.
“First batch network now opened in phase one of withdrawals,” Binance announced in a post on X.
The FBI, in a statement on Saturday, attributed the attack to North Korea, confirming earlier suspicions by cybersecurity investigators and analysts that the Pyongyang-linked hacking group, TraderTraitor, was responsible.
The group has also been linked to the theft of $1.5 billion from cryptocurrency platform Bybit in February last year.
“The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026,” the agency said.
The FBI disclosed that it had observed TraderTraitor operatives converting the stolen assets into Ethereum, adding that the funds were expected to undergo further laundering through decentralised finance platforms and instant cryptocurrency swap services.
It urged private-sector organisations to block transactions linked to wallet addresses allegedly being used by the hackers to move and conceal the stolen assets.
However, US President Donald Trump expressed uncertainty over North Korea’s alleged involvement in the attack.
“I’m not concerned. We’re learning about it. We don’t know if it’s North Korea,” Trump told reporters at his residence in Florida late Saturday.
The president has frequently spoken positively about the summits he held with North Korean leader Kim Jong Un during his first term in office.
Binance moves to cover financial losses
Binance said on Saturday that it had committed more than $6.34 billion in company funds to cover the financial impact of the cyberattack.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the exchange said in a statement on X.
The company also disclosed that it had purchased tokens using its own funds to replenish approximately 90 per cent of the stolen assets.
It explained that the remaining 10 per cent involved less liquid tokens, which could take longer to source in the required quantities.
Before reopening withdrawals, Binance had announced plans to adopt a phased restoration process, prioritising assets according to user demand over the preceding week.
“We are taking a phased approach by prioritizing tokens based on the past week’s data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” it said.
Crypto market hit by sell-off
The attack has renewed concerns about the vulnerability of cryptocurrency platforms, particularly amid growing debate over whether advances in artificial intelligence could eventually undermine existing cryptographic systems and information technology security protocols.
Following news of the breach, Bitcoin fell by nearly five per cent, while Ethereum dropped almost six per cent. Binance’s native BNB token also declined by approximately 10 per cent.
The scale of the theft has further drawn attention to North Korea’s alleged use of cybercrime to generate revenue amid extensive international sanctions imposed over its nuclear and missile programmes.
TraderTraitor is believed to be associated with the Lazarus Group, a notorious hacking organisation accused of carrying out several major cyberattacks.
The group gained international attention in 2014 when it was accused of hacking Sony Pictures Entertainment in retaliation for the release of The Interview, a comedy film that mocked North Korean leader Kim Jong Un.
AFP
