What happened
Binance announced early on Sunday that it would start allowing withdrawals again, in phases, after freezing all deposits and withdrawals when hackers stole $6.3 billion worth of crypto from its wallets. The company said it has now covered 95% of the stolen assets and is still working to buy the remaining affected assets, which it described as less liquid in the market and slower to source at the required scale.
Binance said the freeze was a precaution while its teams worked to contain the loss, assess its impact, restore affected services, and complete security checks. The company said it did not make the decision lightly, because it understands how important reliable access to withdrawals is for users. It also repeated its pledge on the cost of the theft: "Binance will bear the financial impact of the stolen funds" and "these losses will not be passed on to users."
The return is not all at once. Binance said it will resume withdrawals in phases, depending on network and asset type. As of Sunday morning, its network status page showed a mix of normal, partially suspended, and fully suspended statuses. Bitcoin withdrawals and deposits were still listed as partially suspended, while Ethereum deposits were normal and withdrawals were partially suspended. Users should expect temporary delays or longer processing times due to traffic volume, the company said.
The first hours back were busy. Binance later said that between 6am and 3:30pm Coordinated Universal Time, it processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion. That equals 2.1% of its total assets under management. The update follows our earlier coverage of the theft, when the hack was first linked to North Korea: [North Korea Linked to $6.3 Billion Binance Crypto Heist](/article/north-korea-linked-6-3-billion-binance-heist).
Why it matters
The size of the theft made this a test of confidence, not just a technical fix. A $6.3 billion theft would be enough to shake any platform, and a disorderly rush for the exits was the obvious risk once withdrawals reopened. A net outflow of 2.1% of assets under management in the first hours points the other way: most of the money stayed put, at least in that first window.
The case also goes beyond one company. On Saturday, the FBI said a North Korean group known as TraderTraitor was responsible for the breach, and that the group was converting the assets primarily into Ethereum, with further laundering likely. That puts a US law enforcement investigation at the center of the recovery, and it raises the stakes for any exchange holding the stolen funds.
Crypto wallet security is already under fresh scrutiny. OpenAI recently said its AI agents hacked websites and drained a crypto wallet, a separate incident that underlines how often wallets, not just exchanges, are now targets: [OpenAI Says Its AI Agents Hacked Websites and Drained a Crypto Wallet](/article/openai-ai-agents-hacked-websites-crypto-wallet). For ordinary holders, the Binance reopening is a reminder that access to funds can be frozen at short notice, even on a major platform, while an incident is contained.
What happens next
Binance said resuming withdrawals is a major milestone, but its work continues. It plans to keep strengthening its safeguards, complete the recovery process, and provide updates as progress continues. It also said it will publish a more in-depth incident report when its investigation is complete.
Two things are still open. The company is still buying back the remaining affected assets, and withdrawal availability still varies by network and asset. The update gave no date for full restoration, so users with funds on partially suspended networks will need to keep checking the status page rather than assuming access is fully back.
