Binance resumes withdrawals starting with Bitcoin

Binance has begun resuming withdrawals in phases, starting with the Bitcoin network, less than three days after a $6.3 billion hack forced it to suspend them. It says it has now covered about 95% of the losses with its own money, up from 90% a day earlier.

The crypto company said phase one would start between 06:00 and 09:00 UTC on Sunday, which is 7 a.m. to 10 a.m. in Nigeria. “Binance will absorb the financial impact of the stolen funds, not our users,” the exchange said in its latest update on X.

Phase one covers a limited set of networks and assets, chosen according to the past week’s user demand. The statement also says the company will add more once it completes security and readiness checks. Deposits have stayed open throughout, it says.

Users should check the withdrawal page or the network status page to confirm whether their chosen asset and network are available. It warns of possible delays or longer processing times during the initial rollout and says a failed withdrawal can be retried after a short while. It calls its approach “controlled.”

Binance also said on X that it has added newly generated wallet addresses to its Proof of Reserves list, and that all withdrawals will now be processed from them.

How much has Binance covered?

Binance says it has covered $6 billion of the impacted amount. The share has risen with each update, from about 80% on Friday to 90% on Saturday and now about 95%.

The 10 largest tokens affected are fully backed, according to its statement. These are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The outstanding 5% is in less liquid tokens outside that group, which take longer to buy at the required scale.

The money comes from a partial deployment of its Secure Asset Fund for Users (SAFU), part of its Futures insurance fund, and its corporate treasury. Binance later said the SAFU transfer is complete. It says it will replenish SAFU to about $1 billion, and the full proof of reserves is estimated by Tuesday.

Also read: North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever

FBI blames North Korea

Separately, the FBI says North Korea was responsible for stealing more than $6 billion from the crypto exchange on or about October 29. It calls the activity “TraderTraitor.” Binance thanked the FBI’s cyber branch for its support.

The FBI, with the US Secret Service and IRS Criminal Investigation, says it has seen the hackers converting stolen assets mainly into Ether. It expects them to launder the funds further through decentralised finance (DeFi) and instant swap services.

The agencies are urging private firms to block transactions with addresses the hackers are using, and the FBI has published a list. TRM Labs and Chainalysis had earlier linked the attack to North Korea, according to our earlier report.

What remains unknown

Binance says about $3 billion of the stolen assets has been frozen on-chain. Replacing assets is not the same as recovering them, and the exchange says it is working with law enforcement and partners on recovery.

Changpeng Zhao, Binance co-founder

The crypto exchange’s first assessment pointed to a compromised engineer’s laptop. It later said investigators had found “additional points of breach,” and co-CEO Richard Teng has described a “complex attack” involving malicious software designed to delete evidence, according to Reuters.

Binance had earlier said it expected to share further technical findings within about 48 hours. It now says it will publish a post-incident report once the investigation is complete.