The exchange, the world's largest by daily trading volume, announced on Sunday that it had commenced a phased restoration of withdrawals after temporarily suspending the service to address the security breach.
In a post on X, Binance confirmed that the first phase of the process had started, stating: “First batch network now opened in phase one of withdrawals.”
The attack, believed to be the largest cryptocurrency theft on record, triggered a sharp decline in the prices of major digital assets on Friday, as investors reacted to concerns over the security of funds held on cryptocurrency platforms.
Binance had earlier assured customers that it would absorb the financial impact of the incident, disclosing that it had committed more than $6.34 billion in company funds towards replacing the stolen assets.
The exchange said it had already purchased replacement tokens equivalent to about 90 per cent of the stolen funds, while efforts were ongoing to source the outstanding balance.
According to the company, the remaining 10 per cent of the tokens were “less liquid, which means they may take longer to source in the required amounts.”
The FBI, in a statement released on Saturday, formally attributed the October 29, 2026, attack to North Korea, confirming earlier assessments by private investigators and cybersecurity analysts that the operation was carried out by a Pyongyang-linked hacking group known as TraderTraitor.
The group has also been linked to the theft of approximately $1.5 billion from cryptocurrency platform Bybit in February last year.
In its statement, the FBI said: “The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People’s Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.”
The agency further disclosed that it had observed TraderTraitor operatives converting the stolen assets into Ethereum, warning that the funds could subsequently be moved through decentralised finance platforms and instant swap services to conceal their origins.
It urged cryptocurrency businesses and other private sector organisations to help prevent further movement of the stolen assets.
The FBI said it was calling on private sector entities “to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”
However, US President Donald Trump expressed uncertainty over North Korea's alleged involvement in the attack, despite the FBI's findings.
Speaking to reporters at his residence in Florida late Saturday, Trump said: “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea.”
The president's comments come against the backdrop of his previous diplomatic engagements with North Korean leader Kim Jong Un during his first administration.
Meanwhile, Binance explained that the restoration of withdrawal services would be carried out gradually, with priority given to tokens based on user demand over the preceding week.
The company had indicated that the process would begin between 0600 and 0900 GMT on Sunday, adding that each network and asset pair would undergo security and stability checks before users regained access.
“We are taking a phased approach by prioritizing tokens based on the past week’s data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened,” Binance said.
Crypto Market Suffers Fresh Setback
The scale of the attack has renewed concerns about the vulnerability of cryptocurrency platforms to sophisticated cyber threats, particularly as digital asset transactions become increasingly complex.
The incident also comes amid growing concerns among cybersecurity experts that advances in artificial intelligence could potentially weaken existing cryptographic systems and information technology security protocols.
Market reactions to the breach were swift, with Bitcoin losing nearly five per cent of its value, while Ethereum declined by almost six per cent. Binance's native token, BNB, recorded an even steeper fall of nearly 10 per cent.
Beyond its immediate financial consequences, the attack has drawn attention to North Korea's growing ability to generate revenue through illicit cyber operations, particularly as the country faces extensive international sanctions over its nuclear and missile programmes.
TraderTraitor is believed to be associated with the notorious Lazarus Group, a cybercrime network that has been accused of several high-profile attacks over the years.
The group attracted international attention in 2014 after being accused of hacking Sony Pictures Entertainment in retaliation for the release of The Interview, a comedy film that mocked North Korean leader Kim Jong Un.
The latest incident adds to mounting concerns over the role of state-linked cybercriminal groups in targeting global financial institutions and cryptocurrency platforms.