Binance resumes withdrawals after $6.3 billion attack attributed to North Korea
Exchange says it has recovered 95% of the diverted funds and released withdrawals on Sunday (1st), while investigations point to a group linked to Pyongyang.
BY THE X-TRADER NEWS NEWSROOM · REPORTING FROM GAZETA DO POVO · 2 MIN
Two days after a hacker attack that Binance itself describes as the largest in the sector's history, the platform began releasing withdrawals on Sunday (1st). According to Gazeta do Povo, the company claims to have recovered 95% of the US$6.3 billion diverted, and the reopening began with bitcoin, with new networks and assets being included as the tests progress.
The robbery occurred on Friday (30), according to Gazeta do Povo, although Times Brasil reported that the attack was announced on Thursday. The discrepancy in dates appears between the vehicles and was not clarified in the available information. Due to the size of the value, the episode surpasses the attack on Bybit, worth US$ 1.5 billion, which took place in February 2025.
Binance says that 100% of customer balances are guaranteed in ten cryptocurrencies, including bitcoin, ether, USDT, BNB, SOL, USDC and XRP, according to Gazeta do Povo. The remaining 5% are tokens outside the top ten and less liquid. Deposits remained open and were not affected. Times Brasil reported that, on Saturday, the company had recovered up to 90% of its assets and that it intends to continue purchasing the remaining tokens until it reaches 100%. According to Gazeta do Povo, around US$3 billion was frozen with blockchain partners on Friday.
Two digital security companies attribute the attack to the TraderTraitor group, linked to North Korea, according to Gazeta do Povo. On Saturday night, the FBI determined that the country was responsible for the robbery, according to Times Brasil.
Binance was founded in Shanghai by Changpeng Zhao, who left China after 2017 restrictions on crypto trading. Hoje a empresa opera sem sede única. Zhao was sentenced in the United States in 2025 to four months in prison, in a money laundering agreement, and was pardoned by Trump this year, according to Gazeta do Povo.
The company claims it will absorb the financial impact of stolen funds, not users.
What changes for the investor
For those who invest and operate, the case reignites the discussion about the risk of custody in centralized brokerages. A single event led the platform to move billions to contain its losses, which shows that the size of the company does not eliminate exposure to attacks. The speed of recovery and the decision to bear the cost tend to be read as an efficient response, but full normalization still depends on replenishing the remaining tokens and completing the reopening. It is worth monitoring these steps, the final attribution of the attack and the reaction of other security platforms. This text does not provide a purchase or sale recommendation and does not project prices.
Automatically translated from Portuguese.
