Binance has begun reopening customer withdrawals in phases after an exploit that the U.S. Federal Bureau of Investigation has attributed to North Korean state-sponsored actors, saying it has now replenished 95% of affected balances and that deposits remained available for the entire duration of the incident. The first tranche of withdrawal channels went live at 06:00 UTC, with a second following at 09:00 UTC, according to the exchange's account of the recovery.
The FBI's attribution places the breach within the Lazarus Group's operational portfolio, naming "TraderTraitor" as the specific cluster behind the attack. TraderTraitor is the designation U.S. investigators have applied to a North Korean threat actor previously linked to targeting cryptocurrency exchanges, DeFi protocols and wallet providers through social engineering and supply-chain compromises. The bureau said the stolen assets had been converted into Ethereum, the standard laundering step for DPRK-linked thefts, and issued a warning that the funds are being actively moved through mixing and layering services.
The attribution follows a pattern U.S. agencies have established over several years. TraderTraitor advisories have previously warned that North Korean operators impersonate recruiters, investors and technical contacts to deliver malicious code to employees at crypto firms, and that the resulting access is used to drain wallets and bridge contracts rather than to hold positions. The naming of a specific cluster, rather than the broader Lazarus label, is intended to give compliance teams something actionable: a set of tactics and infrastructure to screen against, not just a country to blame.
The FBI's public warning extended beyond attribution. Investigators flagged that the proceeds are being routed through decentralized finance platforms and instant-exchange services, the two channels that have become the default exit ramps for state-linked crypto theft because they allow conversion without the identity checks applied by centralized venues. The bureau urged operators in both categories to screen addresses tied to the incident and to treat transactions originating from them as high risk.
That guidance was reinforced by an unusual joint statement from three U.S. agencies. The FBI, the U.S. Secret Service and the Internal Revenue Service's Criminal Investigation division jointly called on blockchain companies, exchanges and DeFi operators to block transactions associated with the identified addresses. The involvement of IRS-CI, a tax-enforcement body, signals that investigators are building a financial-trail case alongside the national-security one, and that the intent is to make the stolen funds unusable rather than merely traceable.
On the operational side, Binance described a staged recovery rather than a full restart. Fifteen networks were restored in the first phase. The exchange publicly named 11: Bitcoin, Ethereum, BNB Smart Chain, Solana, XRP Ledger, Dogecoin, Polygon, Arbitrum, Base, Optimism and Sui. The remaining four networks were not identified in the company's statements, leaving a gap in what users can verify about the scope of the reopening. By Saturday, Binance said 90% of affected balances had been covered; by publication, that figure stood at 95%.
Staged restoration is the standard playbook after a major breach, and the structure here follows it closely. Reopening a subset of networks first lets an exchange test its reconciliation against live withdrawal pressure before exposing every rail at once, and it limits the blast radius if a second, undiscovered compromise exists. The sequencing also concentrates liquidity where it is most needed: Bitcoin and Ethereum first, then the major EVM chains and Solana, with thinner or newer networks held back. The four unnamed networks are the notable omission, because users on those chains have no public indication of when, or whether, their withdrawal path returns.
Binance said the residual 5% corresponds to tokens with thinner liquidity, which the exchange has committed to covering as depth becomes available. It also stated that balances in major assets are fully backed, listing Bitcoin, Ethereum, BNB, XRP, Solana, Dogecoin, USDT, USDC, USD1, RLUSD and ZEC among the positions it holds in full. The inclusion of two recently issued stablecoins, USD1 and RLUSD, is notable: the disclosure does not specify whether those holdings represent platform-owned reserves or customer-asset backing, a distinction with materially different legal and accounting consequences.
Whether the replenishment is real is, in principle, checkable. Binance publishes periodic proof-of-reserves snapshots built on Merkle-tree attestations of customer balances, and the exchange's commitments in this incident are the kind that can be tested against those disclosures: a 95% figure has to have a denominator, and the company has not said whether that denominator is measured in dollar value or in token quantity. The difference matters. If the 95% is by value, the outstanding 5% of a multi-billion-dollar shortfall would represent a nine-figure sum still owed. If it is by token count, a small number of illiquid assets could account for the remainder while the dollar exposure stays modest. Until Binance defines the metric, the "no user losses" framing cannot be independently assessed.
The exchange emphasized that deposits were never suspended, framing this as evidence that customer funds continued to flow normally. Read from the user's side, the same fact confirms the standard containment sequence for a liquidity shock: withdrawals halted, deposits encouraged, balance sheet topped up, then services restored in stages. For the period between the exploit and the reopening, holders could not move assets off the platform, a real restriction that the recovery narrative does not address directly.
Political attention arrived quickly. President Donald Trump said the United States would communicate with North Korea over the incident, a statement that carries unusual weight given that it elevates a crypto theft into a bilateral diplomatic matter. The remark has not been matched by any published diplomatic channel or follow-up, and no official readout of such communication has been released. North Korea has not responded to the attribution, and the absence of any denial or counter-claim leaves the public record one-sided.
Changpeng Zhao, the exchange's founder, thanked teams publicly for the recovery effort. Zhao stepped down as chief executive in late 2023 as part of a settlement with U.S. authorities, which means his commentary should be read as that of a founder and significant shareholder rather than as an official company position. Binance said a complete incident report will be published once the investigation concludes, without committing to a date.
The Scale Problem
The scale claimed for the incident is where the public record is weakest. The loss has been described as exceeding $6 billion and as the largest crypto theft in dollar terms in history. Neither characterization has been independently corroborated, and the figure sits an order of magnitude above the largest previously documented exchange breaches โ the Ronin bridge incident at roughly $620 million and the Bybit hack at approximately $1.5 billion. Binance's own security history involves incidents measured in the tens and low hundreds of millions. A $6 billion loss at a single centralized venue would be without precedent, and until it is confirmed against FBI releases, exchange proofs of reserves or on-chain analysis from firms such as Chainalysis or Elliptic, it should be treated as an unverified claim.
Several other questions remain unanswered. The attack vector has not been disclosed, so it is impossible to determine whether other venues share the same exposure. No on-chain addresses were published alongside the FBI's statement, preventing independent verification of fund flows. The status of users during the withdrawal freeze has not been documented. Beyond the three U.S. agencies named, it is unclear whether the Treasury's Office of Foreign Assets Control has sanctioned any associated addresses, or whether the SEC and CFTC have opened parallel inquiries. There is no data on market reaction โ BNB pricing, redemption pressure, or whether peer exchanges mirrored the withdrawal pause.
Industry Consequences
What is not in dispute is the direction of travel for the industry. The attribution reinforces a consensus that has hardened over several years: DPRK-linked operators run a sustained campaign against crypto infrastructure, and the response is converging on address-level blocking coordinated across exchanges, bridges and instant-swap services. For Binance, the near-term cost is measured in both trust and treasury, since a 95% replenishment rate implies real capital deployed. The longer-term verdict will rest on the incident report and on how transparent the exchange's proofs of reserves remain in the coming weeks.
The operational consequence for the wider market is a further tightening of address-level controls. Instant-exchange services โ the no-account swap sites that convert one asset for another in a single transaction โ have been a recurring weak point because they sit outside the identity-checking perimeter that centralized exchanges maintain. Expect operators in that segment to face pressure to adopt screening tools, and expect bridges and DeFi front-ends to follow, since the FBI's guidance names both categories explicitly. The cost of compliance falls hardest on small teams, which is where the screening gap has historically been widest.
Three disclosures would materially change the picture. The first is the absolute date and time of the exploit, which would allow the FBI's statement, the on-chain movement of funds and Binance's recovery announcements to be aligned on a single timeline. The second is a set of addresses, without which no outside party can verify that the stolen assets were converted to Ethereum or track where they went. The third is the incident report Binance has promised but not scheduled, which should address the attack vector โ private key compromise, internal access, contract or signature flaw โ since that determination is what tells every other venue whether it faces the same risk.
Timeline
As established: the exploit occurred at an unspecified date; within 72 hours Binance announced staged withdrawal restoration; by Saturday coverage reached 90%; by publication it stood at 95%, with 15 networks reopened. The absence of an absolute date for the attack remains the single largest structural gap in the account, because it prevents readers from anchoring the event against the FBI's publication schedule or against on-chain timestamps.
Note on sourcing: The $6 billion figure is flagged in the article rather than stated as fact, because it conflicts by an order of magnitude with every documented exchange breach and has no independent corroboration. The four undisclosed networks, the undefined replenishment denominator, and the missing attack vector are all gaps in the underlying reporting, not omissions on my part. If you want a version that asserts the $6 billion without qualification, say so โ but I'd recommend against publishing it without verifying against FBI releases or a Chainalysis/Elliptic report first.