Binance began letting customers move money off its platform again on Sunday, reopening withdrawals in stages after a record theft of roughly $6.3 billion. The world's largest crypto exchange by daily trading volume says it has already replenished 90% of the stolen tokens with its own money.
The reopening started after 2 p.m. Singapore time. Holders of ether, along with USDT and USDC tokens on the Ethereum blockchain, were among the first allowed to withdraw, as were some assets on the BNB Smart Chain. By 5 a.m. Eastern, Binance said withdrawals were also working for Bitcoin, BNB, XRP, Doge, Base and Optimism, with more assets to follow as security checks finish.
Binance said it has earmarked about $6.34 billion of company funds to cover the losses. The last 10% of tokens are less liquid and could take longer to buy back, the exchange said, but co-chief executive Richard Teng pledged to cover that share as well and said users would not absorb the financial hit.
Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident
Binance
To rebuy the tokens, Binance tapped part of its $1 billion secure asset fund for users, a bitcoin reserve meant to protect customers after security breaches. It also drew on its futures insurance fund and its own corporate treasury.
FBI points to North Korea
On Saturday, the FBI formally blamed North Korea, saying a group tied to Pyongyang known as TraderTraitor stole more than $6 billion in virtual assets from Binance on or about Oct. 29. The finding confirmed what private investigators and analysts had already suspected.
The bureau said it had watched TraderTraitor operatives convert stolen assets into ether and expects them to launder the funds further through decentralized finance and instant swap services. It urged private companies to block transactions involving addresses the group is using.
TraderTraitor is believed to belong to the Lazarus Group, which was accused in 2014 of breaking into Sony Pictures in retaliation for The Interview, a film mocking North Korean leader Kim Jong-un. The same group was linked to a $1.5 billion heist at the exchange Bybit in February of last year.
How the breach unfolded
Teng said Friday that the intrusion was a complex attack that relied on a compromised laptop and malicious software built to erase traces of its activity, which made it harder to track and investigate.
News of the breach, which struck on Thursday, pushed crypto prices sharply lower Friday. Bitcoin fell nearly 5%, ether nearly 6%, and BNB, the exchange's native token, nearly 10%.
