Binance said on Sunday it would resume withdrawals after covering 95% of the $6.3 billion stolen in a hack that the FBI has tied to North Korea, according to France 24. The theft is among the largest cryptocurrency thefts on record.
Binance said it had covered about $6bn of the stolen cryptocurrency by using company money to buy replacement tokens, according to Dawn. The remaining 5% consists of less liquid assets that may take longer to source.
The first phase of withdrawals was set to start between 0600 and 0900 GMT on Sunday and cover 15 crypto assets, including bitcoin, ether, XRP and dogecoin, Dawn reported. Binance said further phases would follow and that tokens would be prioritised by recent user demand.
The FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about October 29, and that actors known as TraderTraitor were behind it, according to France 24. The agency said the actors were converting stolen assets into Ethereum and expected further laundering through decentralised finance and instant swap services.
The FBI’s attribution is disputed in part. US President Donald Trump said late Saturday, "I’m not concerned. We’re learning about it. We don’t know if it’s North Korea." Dawn and the Straits Times also report the FBI’s Saturday claim that North Korea was responsible.
Binance said about $3bn of the affected assets had been frozen as of Friday, working with industry partners, according to Dawn. No updated frozen figure was given.
TraderTraitor is a North Korean hacking operation linked to the broader Lazarus Group, which the FBI has previously blamed for several major thefts. These include about $1.5 billion taken from Bybit in February 2025. TRM Labs said attackers stole $2.9 billion in crypto across nearly 150 attacks last year. A 2024 UN report said proceeds from North Korean cyberattacks reportedly helped fund its weapons of mass destruction programme.
The FBI has urged private firms to block transactions linked to addresses used by TraderTraitor to launder the funds. North Korea’s mission in Geneva and its embassy in China did not respond to requests for comment, Dawn reported.
Several points remain unclear. The sources give no independent confirmation of the FBI attribution beyond analysts and firms such as TRM Labs and Chainalysis, which reportedly noted similarities to earlier North Korea-linked attacks, and no source explains the FBI’s basis beyond the conversion activity it described. The timing and sourcing for the remaining 5% of tokens have not been specified.
Sources
This article was written with AI assistance from the published reporting listed above. It is part of the World Brief daily news podcast.