Binance Starts Withdrawal Recovery as FBI Blames North Korea for $6B+ Hack

Binance is preparing to reopen withdrawals in phases as early as today, less than 72 hours after the largest recorded crypto theft in dollar terms. Meanwhile, the FBI formally attributed the attack to North Korean hackers and warned that the stolen assets are already being moved through laundering channels. US President Donald Trump also weighed in, saying he will talk to the Koreans. The company’s statement earlier this morning said phase one of withdrawals will begin progressively between 06:00 and 09:00 UTC today, after the exchange completes its latest security and operational checks. Binance reaffirmed that deposits had remained available before and after the incident. The first phase covers 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP, Dogecoin, Polygon, Arbitrum, Base, Optimism, and Sui. Supported assets include BTC, ETH, BNB, XRP, SOL, DOGE, and numerous altcoins, with additional networks and tokens to be added once the exchange deems them ready. The company warned that users could encounter temporary delays as traffic returns. It has also accelerated efforts to replace the assets affected by the breach. According to its latest update as of press time, 95% of the impacted amount has been replenished, up from 90% in its Saturday update. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC balances are fully backed, while the remaining 5% consists of less-liquid tokens that are taking longer to source through market and OTC purchases. Once again, Binance promised to absorb the financial damage from the hack, not its user base. It also plans to publish a full post-incident report after the investigation concludes. The FBI confirmed multiple reports after the hack that the Democratic People’s Republic of Korea was behind it, stealing more than $6 billion in cryptocurrencies from the world’s largest crypto exchange. It identified the operation as part of the country’s cyber campaign known as “TraderTraitor.” The agency added that the attackers have been converting much of the stolen digital assets into Ethereum and are expected to continue laundering the funds through decentralized finance platforms and instant-swap services. The FBI, Secret Service, and IRS Criminal Investigations have consequently urged exchanges, DeFi operators, blockchain analytics companies, and other industry participants to block transactions connected to identified attacker-controlled addresses. CZ quickly thanked these agencies for their involvement and assistance. Meanwh