Binance Restores Withdrawals After $6.3 Billion Hack

Binance reopened withdrawals on Sunday, phased in by network and asset type, after a $6.3 billion theft from its wallets forced a total freeze on deposits and withdrawals.

The exchange says it has already covered 95% of the stolen assets. Teams are still buying what the company calls the "remaining affected assets," which are "less liquid in the market and take longer time to source at the required scale." That single sentence explains the phased approach: the hard part is not Bitcoin or Ethereum, but the thin markets where the last 5% trades.

"Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds," the company said. "These losses will not be passed on to users."

Why did Binance freeze withdrawals at all?

The company said it did not make the decision lightly. It acknowledged "how important reliable access to withdrawals is for our users" before explaining the rationale.

The freeze was a precaution while its teams worked to "contain the incident loss, assess its impact, restore affected services, and complete security checks." In plain terms, Binance shut the doors to stop the bleeding, count what was gone, and verify its systems before letting money move again.

The decision carried real cost. A withdrawal freeze on an exchange of Binance's size tests user confidence at the exact moment that confidence is most fragile. Restoring access in phases, rather than all at once, lets the company watch each network for signs of stress — or another attack.

What works now, and what does not?

As of Sunday morning, Binance's network status page showed a patchwork. Bitcoin deposits and withdrawals remained partially suspended. Ethereum deposits ran normally, while Ethereum withdrawals were partially suspended. Other networks fell into a mix of normal, partially suspended, and fully suspended statuses.

Users should expect friction even where withdrawals work. The company warned of "temporary delays or longer processing times due to traffic volume" — the predictable surge of pent-up withdrawal requests hitting reopened channels at once.

"Resuming withdrawals is a major milestone, but our work continues," Binance said. "We will continue strengthening our safeguards, completing the recovery process, and providing updates as progress continues."

Who stole the $6.3 billion?

Binance previously blamed North Korean hackers. On Saturday, the FBI put a name on it. The agency said a North Korean group known as TraderTraitor carried out the breach.

According to the FBI, the group is converting the stolen assets primarily into Ethereum, and further laundering is likely. That detail matters for the recovery effort. Assets laundered into Ethereum move fast and blend into the largest smart-contract network in the market, which makes tracing and freezing them harder with every day that passes.

What comes next?

Binance said it will publish a more in-depth incident report once its investigation is complete. That report will face scrutiny on the central unanswered question of the episode: how attackers extracted $6.3 billion from one of the world's largest exchanges in the first place.

For now, the 95% recovery figure and the company's pledge to absorb the losses give users a concrete floor under the damage. The remaining question is the timeline for the final 5% — and whether TraderTraitor's Ethereum conversion outruns Binance's buying.