Binance, the world's biggest cryptocurrency exchange, resumed bitcoin withdrawals on Sunday and said others would follow in phases after covering 95% of the $6.3 billion in tokens stolen from its platform in the world's largest digital heist, Reuters reported. Binance posted on its status page shortly after 0600 GMT that the planned withdrawals had begun, and said the first phase would cover 15 cryptoassets including bitcoin, ether, XRP and dogecoin.

Source: Reuters

Yaani: $6.3 billion is 630 crore dollars — and Binance said it had covered $6 billion of the stolen cryptocurrencies by using company money to buy replacement tokens. The remaining 5% of the stolen tokens are assets that are less liquid and may take longer to source in the required amounts, the exchange said.

95%Share of the stolen $6.3 billion Binance says it has covered
$6 billionValue of replacement tokens bought with company money
15Cryptoassets in the first phase of resumed withdrawals
~$3 billionStolen assets located as of Friday, Binance said, as partners worked to freeze some of them

The resumption follows the earlier developments in this case: the bulk of the theft unfolded in around 20 minutes beginning late on Thursday, according to US blockchain analysis firms TRM Labs and Chainalysis, and bore similarities to previous large attacks blamed on North Korea. On Saturday the FBI said the North Korean state-sponsored unit known as TraderTraitor was responsible, and law enforcement observed members of the unit converting stolen assets into ether, adding that it expected further laundering. On Saturday Binance had said it had replaced 90% of the stolen tokens, with withdrawals on track for Sunday.

What is solid

  • Binance resumed bitcoin withdrawals on Sunday, shortly after 0600 GMT, and said other withdrawals would follow in phases
  • The exchange says it covered 95% of the stolen $6.3 billion, buying $6 billion of replacement tokens with company money, and set aside around $6.34 billion of company funds internally to cover the losses
  • The FBI said on Saturday that North Korea's TraderTraitor unit was responsible for the attack

What is only claimed

  • North Korea's role — US President Donald Trump said on Saturday that the US was still not certain if North Korea was involved: 'We don't know if it's North Korea — but if it is, we'll talk to North Korea about it.' Pyongyang has for years denied using state-linked cyber units for theft, and its mission in Geneva and embassy in China did not respond to requests for comment, Reuters said
  • The remaining 5% of stolen tokens — Binance says they are less liquid and may take longer to source; when they will be covered is not yet known

Binance has repeatedly said it would bear the financial impact of the hack. Co-CEO Yi He said on Saturday that 50% of its Secure Asset Fund for Users (SAFU) funds would be used, while the company committed to replenishing the fund to about $1 billion; the money for replacement tokens came from SAFU, its Futures Insurance Fund and its corporate treasury, it said on X. The other co-CEO, Richard Teng, has said the breach was a complex attack involving a compromised laptop and malicious software designed to delete evidence of its activity. Binance says it has 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report. What happens next is the phased reopening for the remaining assets — and whether customers who were locked out since Thursday start moving funds off the exchange.