Binance resumes bitcoin, ether withdrawals after covering bulk of stolen US$6.3 billion
Sign up now: Get ST's newsletters delivered to your inbox
Binance said it had covered US$6 billion of stolen cryptocurrencies by using company money to buy replacement tokens.
PHOTO: REUTERS
- Binance resumed bitcoin withdrawals on 1 November after covering 95% of the US$6.3 billion stolen in the world’s biggest digital heist.
- The FBI said North Korea’s TraderTraitor unit carried out the attack, and officials warned of more laundering through cryptocurrency tools.
- Binance said it used company funds, including SAFU, to replace tokens and will cover the losses while restoring the reserve to about US$1 billion.
AI generated
NEW YORK – Binance, the world’s biggest cryptocurrency exchange, resumed bitcoin, ether and some stablecoin withdrawals on Nov 1 and said others would follow in phases after covering 95% of the US$6.3 billion (S$8 billion) in tokens stolen from its platform in the world’s largest digital heist.
The heist, which the FBI has tied to North Korea and which analysts say may be the biggest financial robbery ever, adds to a string of crypto thefts. In 2025, attackers stole US$2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
Binance, which was founded in China, said the first phase of withdrawals would cover 15 crypto assets including bitcoin, ether, XRP and dogecoin.
Bitcoin withdrawals resumed shortly after 0600 GMT, while ether, BNB and some USDT and USDC stablecoin withdrawals were also restored.
Binance said it had covered US$6 billion of stolen cryptocurrencies by using company money to buy replacement tokens. The remaining 5% of stolen tokens consist of assets that are less liquid and may take longer to source in the required amounts, according to the exchange.
FBI ties attack to North Korean unit
The FBI said on Oct 31 the North Korean state-sponsored unit known as TraderTraitor was responsible for the attack.
Pyongyang has for years denied using state-linked cyber units for espionage, financial theft and revenue. Its mission in Geneva and embassy in China did not respond to requests for comment.
Law enforcement observed members of the unit converting stolen assets into the cryptocurrency ether, the FBI said in a statement, adding that it expected “further laundering” of the assets through the use of related technology.
Analysts had also blamed North Korea for the heist.
The bulk of the theft unfolded in around 20 minutes beginning late on Oct 29 and bore similarities to previous large attacks blamed on North Korea, according to US blockchain analysis firms TRM Labs and Chainalysis.
US President Donald Trump, however, said on Oct 31 that the US was still not certain if North Korea was involved.
“We don’t know if it’s North Korea – but if it is, we’ll talk to North Korea about it,” Trump told reporters in comments posted by a White House handle on X.
Binance vows to bear financial costs
Binance has been working with industry partners to freeze some of the affected assets, with about US$3 billion located as of Oct 30, it said.
The exchange has repeatedly said it would bear the financial impact of the funds stolen in the hack. It has set aside around US$6.34 billion of company funds internally to cover the losses.
The money spent buying replacement tokens came from Binance’s US$1 billion Secure Asset Fund for Users (SAFU), a bitcoin reserve it holds to protect customers in the event of security breaches, as well as some of its Futures Insurance Fund and its corporate treasury, it said on X.
Co-chief executive Yi He said on Oct 31 that 50% of its SAFU funds would be used, while the company committed to replenishing the fund to about US$1 billion.
Richard Teng, the other co-CEO, has said that the breach was a “complex attack” involving a compromised laptop and malicious software designed to delete evidence of its activity, making it harder to trace and investigate.
Crypto prices fell on Oct 30, while Binance sought to reassure customers that their funds were safe after the hack.
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about US$162.8 billion in assets under custody as of its 2025 annual report.
Binance founder thanks US law enforcement
In a post on X that quoted the FBI statement on North Korea’s involvement, Binance thanked the agency for its support. It did not respond to a request for comment on North Korea’s involvement.
Binance founder Changpeng Zhao, who was convicted in the US of failing to maintain an effective anti-money laundering programme before being pardoned by Trump in 2025, said US law enforcement agencies provided vital help, including by tracking and freezing the stolen assets.
“A tweet can’t fully express our gratitude. Many crypto bros may not realise, a lot of the ‘why bitcoin didn’t drop more?‘ credit goes to them,” Zhao wrote, referring to the US law enforcement agencies. REUTERS