Binance has initiated phase one of its withdrawal recovery process less than 72 hours after suffering a massive breach of over $6 billion, as federal law enforcement officially attributes the cyberattack to North Korea.
Withdrawal Operations Resume Across 15 Blockchain Networks
Binance announced that the first phase of withdrawal restoration is scheduled between 06:00 and 09:00 UTC today, following completed security and operational checks. Deposits have remained available throughout the event. The initial reopening spans 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Dogecoin, Polygon, Arbitrum, Base, Optimism, and Sui. Major digital assets including BTC, ETH, BNB, XRP, SOL, and DOGE are enabled, with additional tokens to follow as safety checks conclude.
The exchange confirmed that 95% of impacted assets have been successfully replenished, up from 90% reported on Saturday. Balances for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now 100% backed. The remaining 5% consists of less-liquid tokens currently being procured via open market and over-the-counter (OTC) purchases. As previously stated when Binance pledged full reimbursement, the company plans to absorb all financial losses entirely.
FBI Attributes Breach to North Korea's TraderTraitor Group
The FBI officially attributed the exploit to state-backed hackers from the Democratic People’s Republic of Korea (DPRK), linking the breach to its cyber campaign known as TraderTraitor. Federal investigators noted that the perpetrators are actively converting stolen funds into Ethereum and laundering them across decentralized finance (DeFi) protocols and instant-swap services.
In response, the FBI, Secret Service, and IRS Criminal Investigations have requested that global exchanges, DeFi operators, and blockchain analytics platforms blacklist affiliated wallet addresses. Binance co-founder Changpeng Zhao (CZ) publicly thanked federal agencies for their assistance. Meanwhile, US President Donald Trump—who previously made headlines after calling crypto dangerous—stated he intends to speak directly with North Korean leadership if responsible.
Key Takeaways
- Withdrawal Reopening: Phase one launches between 06:00 and 09:00 UTC today across 15 networks.
- Asset Reserve Status: 95% of stolen funds are replenished, with top assets 100% backed.
- Attribution & Laundering: The FBI identified North Korea's TraderTraitor unit behind the $6B+ hack.
Why It Matters
The speed of Binance’s liquidity replenishment demonstrates unprecedented balance sheet resilience, preventing a systemic market run following the largest security exploit in crypto history. However, the confirmed involvement of North Korean state actors underscores critical security vulnerabilities across both centralized infrastructure and decentralized laundering channels. The event will likely accelerate coordinated international enforcement and mandatory address-blocking protocols across both centralized and decentralized venues.
