Binance resumed bitcoin withdrawals on Sunday after a theft of about $6.3 billion in token assets from its hot wallets, the exchange said in an X post. Withdrawals have also been restored for the Ethereum Network and BNB Smart Chain.
Binance said Saturday that it has covered up to 90% of the stolen assets. It said it will keep buying the remaining token assets through market and over-the-counter channels until coverage reaches 100%. The exchange said the outstanding 10% consists of tokens outside its top 10 that are less liquid and may take longer to source.
Binance said it is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement.
The FBI said late Saturday that North Korea was responsible for the theft. The agency said malicious North Korean actors laundered the stolen assets by converting them into Ethereum, and it expects further laundering stages.
Binance initially said the hack may have involved a compromised DevOps engineer's laptop. Co-CEO Richard Teng later said the attack involved a more complex process than the misuse of a single engineer's permissions. Binance has not explained how the attack took place, and it declined to provide further details to CNBC.
TRM Labs, a blockchain intelligence company, had earlier pointed to North Korean hackers. It said several features of the attack matched earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026.