Binance resumes customer withdrawals after record $6.3bn hack

Binance froze withdrawals immediately after the hack because the exchange needed to investigate the breach and protect remaining customer funds. A pause also limited the movement of potentially stolen or affected assets. The decision showed that normal trading could not safely continue until Binance understood what had happened.

The phased reopening began after 2pm Singapore time on Sunday. In the first phase, customers could withdraw ethereum, USDT and USDC on Ethereum, plus some assets on BNB Smart Chain. Dogecoin and Avalanche withdrawals resumed later on their own platforms.

A phased restart reduced the risk of reopening every asset at once. It gave Binance a way to check different tokens, blockchains and systems separately. The company said it had replenished 90% of the stolen amount and would cover the remaining 10%, so users would not bear the financial impact.

A cryptocurrency exchange is a platform where people can buy, sell, trade and withdraw digital assets. It combines a marketplace with account services. Instead of arranging every transaction directly on a blockchain, customers use the exchange’s systems to view balances and request trades or withdrawals.

People keep assets there because exchanges make trading quick and convenient. They can hold several tokens in one account, exchange them for other assets, and request withdrawals without managing every technical step themselves. This convenience also means the exchange controls or helps manage access to the funds while they remain on the platform.

The Binance incident shows the trade-off. Customers initially could not withdraw while Binance investigated the breach. Access later returned in stages, beginning with selected tokens and blockchains. Keeping assets on an exchange can simplify use, but a security failure can temporarily interrupt access and threaten the platform’s funds.

The theft was reported as $6.3bn, and the FBI described it as more than $6bn in virtual assets. The scale made it one of the largest reported cryptocurrency crimes and was described as the biggest heist in history. It also caused Binance to pause withdrawals while it investigated.

Binance said it had replenished 90% of the stolen amount. The remaining 10% consisted of less-liquid tokens, which could take longer to buy. Richard Teng said Binance was committed to covering that final portion, so customers would not bear the financial impact.

The company said it had set aside about $6.34bn to cover the losses. It used part of its $1bn secure asset fund, some futures insurance funds and its corporate treasury to rebuy tokens. That response aimed to restore customer holdings rather than pass the loss to users.

Tokens are not all handled by one identical system. Different assets may operate on different blockchains, with separate transaction rules, infrastructure and security checks. After a major breach, an exchange may need to confirm that each network and asset can safely process withdrawals before restoring access.

Binance first allowed withdrawals for ethereum, USDT and USDC on the Ethereum blockchain, along with some assets on BNB Smart Chain. Later that Sunday, Dogecoin and Avalanche resumed on their own platforms. The sequence shows that access was restored network by network and asset by asset.

The article does not give a specific technical reason for each order. It does show that reopening was phased rather than universal. That approach let Binance continue investigating while limiting exposure during restoration. Less-liquid stolen tokens also took longer to rebuy, adding another practical reason for delays.

TraderTraitor is a North Korea-affiliated group that the FBI identified as responsible for stealing more than $6bn in virtual assets from Binance. The group is believed to be part of Lazarus Group, which became notorious after being accused of hacking Sony Pictures in 2014.

The FBI linked TraderTraitor to the Binance theft after private investigators and analysts had already suspected North Korea. It observed TraderTraitor actors converting stolen assets into ethereum. The agency expected further laundering through decentralised finance and instant swap services.

The FBI urged private-sector companies to block transactions connected with addresses used to launder the assets. That warning reflects the difficulty of tracing crypto after theft: stolen tokens can be converted and moved across services. The article says the investigation continued while Binance worked to restore funds and withdrawals.

A huge exchange hack can affect more than the stolen assets. Customers may temporarily lose access to withdrawals, worry about whether their balances are safe, and depend on the exchange to replace missing tokens. Other investors may sell because the breach raises fears about security, liquidity and the reliability of crypto platforms.

The market reaction in this case was immediate. Bitcoin plunged nearly 5% after the news. Ethereum dropped nearly 6%, while BNB, Binance’s native currency, tumbled nearly 10%. Binance first froze withdrawals, then restored them gradually as it investigated and replenished assets.

The longer-term impact can include greater scrutiny of exchanges, stronger pressure to protect reserves and more concern about laundering. Binance said it would cover the remaining 10% and had set aside about $6.34bn. That may protect customers financially, but the attack still highlighted the risks of concentrated crypto infrastructure.

A blockchain is a shared digital record that stores transactions in a sequence that participants can check. A token is a digital asset represented by entries on a blockchain. Cryptography uses mathematical methods to help secure accounts, prove control and authorize transfers. Together, these systems let networks record who owns or moves assets.

For example, when someone sends a token, the transaction is authorized with cryptographic credentials and added to the relevant blockchain. Other network participants check it under that blockchain’s rules. Ethereum, BNB Smart Chain, Dogecoin and Avalanche are separate platforms mentioned in the article, so their assets can require different handling.

This system does not make every company using crypto invulnerable. Binance said its breach involved a compromised laptop and malicious software designed to delete evidence. The incident also prompted worries that artificial intelligence could compromise cryptography and IT security protocols, showing that surrounding systems remain important.