Binance reopens withdrawals in phases after $6.3bn hack blamed on North Korea
- Binance has begun restoring crypto withdrawals in phases after hackers stole about $6.3 billion.
- The FBI blamed North Korea for the attack, said to be the biggest crypto heist ever.
- Binance says it has covered about 95% of the stolen funds and users' money is safe.
Binance, the world's biggest cryptocurrency exchange by daily trading volume, has started letting users withdraw funds again after a cyberattack in which about $6.3 billion was stolen.
The company said on Sunday that the first phase of withdrawals opened with the Bitcoin network, and that more coins would follow in stages. The initial rollout covers 15 blockchain network groups, including Bitcoin, Ether, BNB, Solana, XRP, Dogecoin and the stablecoins USDT and USDC.
Binance said it was prioritising tokens based on user demand over the past week, so that each network can be restored carefully with security checks completed first. It warned that users may see delays or longer processing times because of heavy traffic, and advised anyone whose withdrawal fails to try again shortly.
What happened
According to the company, the attack happened on Thursday, 29 October, when hackers got into Binance's hot wallets and pushed through unauthorised withdrawals. Binance's early investigation pointed to a compromised laptop belonging to a DevOps engineer, which it said may have let the attacker reach a service container and submit the transactions.
Binance suspended user withdrawals after the breach. On Saturday it said it had set aside more than $6.34 billion of its own funds to cover the losses, adding that user funds remained safe and that the company, not its customers, would absorb the financial impact.
By Sunday, Binance said it had covered about 95 per cent of the affected amount. The rest is largely less-liquid tokens that will take longer to source.
The FBI said on Saturday that North Korea was behind the attack, backing earlier suspicions from private investigators that a Pyongyang-linked group known as TraderTraitor carried it out. It is the latest in a series of major cyber thefts tied to North Korea, whose hacking operations are believed to help fund its weapons programme.
The scale dwarfs earlier heists. Nairametrics reported that the February 2025 attack on Bybit, also blamed on North Korean hackers, involved about $1.5 billion. Blockchain analytics firm Chainalysis put total crypto stolen across the industry at more than $3.4 billion in 2025 and about $2.2 billion in 2024, according to the report.
News of the breach sent most major cryptocurrencies sharply lower on Friday.
What it means for Nigerian users
Binance stopped its naira services in March 2024, including naira deposits, withdrawals and trading pairs, though users can still access their accounts. The exchange has also faced regulatory pressure in Nigeria: Nairametrics reported in April 2026 that the Central Bank of Nigeria had finished giving evidence in a case in which it accuses Binance of running hidden operations in the country without authorisation. Binance has not been convicted of any offence in that matter.
Nigerian traders who still hold crypto on the platform should watch for withdrawal delays during the phased reopening, and check the exchange's updates before moving funds.
