businessBREAKING
Binance Restores Withdrawals After $6.3bn Hack the FBI Links to North Korea
Binance begins restoring withdrawals after $6.3bn hack the FBI links to North Korea.
Key points
- Binance said it had replaced about 95 percent of the affected assets.
- Withdrawals are being restored in stages, starting with Bitcoin, Ether and some stablecoin services.
- The FBI previously tied the roughly $1.5bn theft from Bybit in February 2025 to the same actors.
Why it matters. Customers may face delays as withdrawals return, and further services will reopen only as security checks are completed.
Binance resumed some services on Sunday after a suspension that followed Thursday's attack, in which hackers stole about $6.3bn in cryptocurrency. The company said it had replaced about 95 percent of the affected assets and would absorb the losses, not users, according to a statement on X. The FBI said on Saturday that North Korea was responsible, tracking the operation as TraderTraitor and warning of further laundering via decentralised finance platforms.
Latest updates
Binance Restores Withdrawals After $6.3bn Hack the FBI Links to North Korea
Binance has begun restoring customer withdrawals after hackers stole about $6.3bn in cryptocurrency. United States authorities, including the FBI, have blamed hackers from North Korea for the theft. The exchange resumed some of its services on Sunday after suspending them following Thursday's attack. Binance said it investigated the breach and carried out security checks before reopening. The theft is described as a record for the crypto sector.
US Probes Possible North Korean Link to $6.3 Billion Binance Hack, Trump Says
US President Donald Trump said Washington was looking into whether North Korean hackers were behind a $6.3 billion heist targeting Binance. Speaking to reporters in the Oval Office on Friday, Trump said, "We don't know. We're looking at that." The theft has rattled the cryptocurrency world, according to the report. Binance said about $3 billion of the stolen assets had been frozen. The attack is described as a record cryptocurrency theft.