Binance, the world's largest cryptocurrency broker, resumed withdrawals of bitcoin, ether and some stablecoins this Sunday (1st) and stated that other cryptocurrencies will be released gradually. The measure comes after the company recovered 95% of the US$6.3 billion (R$34.2 billion) in tokens stolen from its platform.
The robbery, attributed by the FBI to North Korea, could be the biggest financial heist in history, according to analysts. The episode adds to a recent series of attacks against the cryptocurrency sector. Last year, criminals stole the equivalent of US$2.9 billion (R$15.7 billion) in almost 150 attacks, according to researchers at TRM Labs.
Founded in China, Binance stated that the first phase of the recovery would cover 15 crypto assets, including bitcoin, ether, XRP and dogecoin. Bitcoin withdrawals were reinstated shortly after 3am (Brasília time). Withdrawals of ether, BNB and the stablecoins USDT and USDC have also resumed.
Binance claimed to have replaced US$6 billion (R$32.5 billion) of the stolen assets, using its own resources to purchase replacement tokens. The remaining 5% correspond to assets with less liquidity, which may take longer to be acquired in the necessary quantities, according to the broker.
The FBI said Saturday that the North Korean government-linked hacking group known as TraderTraitor was responsible for the attack.
North Korea has for years denied using state-linked cyber groups for espionage, financial theft and obtaining revenue. The North Korean mission in Geneva and the country's embassy in China did not respond to requests for comment.
The FBI stated that US authorities observed members of the group converting the stolen assets mainly into ether. The agency also said it expects new steps to launder these resources through decentralized finance (DeFi) platforms and instant cryptocurrency exchange services.
Analysts also attributed the theft to North Korea.
The bulk of the theft occurred in about 20 minutes starting Thursday night and bore similarities to previous major attacks attributed to North Korea, according to U.S. blockchain analysis firms TRM Labs and Chainalysis.
United States President Donald Trump said on Saturday that the American government was still unsure about North Korea's involvement.
"We don't know if it's North Korea, but if it is, we'll talk to North Korea about it," Trump told reporters on Saturday. The statement was published by a White House account on X.
Binance stated that it has been working with industry partners to freeze some of the stolen assets. According to the company, around US$3 billion had already been located as of Friday.
The broker stated that it will bear the losses caused by the attack and has reserved around US$6.34 billion of its own resources to cover the losses.
The funds used to purchase replacement tokens came from different Binance reserves. Among them are the Secure Asset Fund for Users (SAFU), a fund of around US$1 billion maintained by the company to protect customers in cases of security incidents, in addition to part of the insurance fund linked to futures operations and the company's cash, according to the company.
Co-CEO Yi He said on Saturday that half of SAFU's resources would be used to cover losses. Binance has committed to replenishing the fund later to around $1 billion.
Richard Teng, Binance's other co-CEO, said the hack was a "complex attack" that involved a compromised laptop and malicious software designed to erase traces of its activity, making investigation difficult.
Cryptocurrency prices fell on Friday as Binance tried to reassure customers and asserted that users' resources were safe following the attack.
Binance, a platform that allows you to buy, sell and trade digital assets, had 335 million registered users worldwide and around US$162.8 billion in assets under custody, according to its 2025 annual report.
In a post on X that cited the FBI's statement on North Korea's involvement, Binance thanked the agency for its support. The company did not respond to a Reuters request for comment on whether the attack was attributed to the country.
Changpeng Zhao, founder of Binance, said that American authorities provided essential assistance in the case, including tracking and freezing the stolen assets. Zhao had been convicted in the United States for failures in Binance's anti-money laundering program and was later pardoned by Trump.
"One post cannot fully express our gratitude. Many cryptocurrency enthusiasts may not realize it, but much of the credit for Bitcoin not falling further lies with them," Zhao wrote, referring to US authorities.
