Binance Resumes Withdrawals After $6.3 Billion Hack Attributed to North Korea

Binance, the largest cryptocurrency exchange by volume, resumed customer withdrawals after a hack that removed approximately $6.3 billion from its wallets. Co-CEO Richard Teng stated that the exchange will absorb the financial impact and that users will not bear the loss. The incident is the largest single theft from a crypto platform on record.

US authorities, including the FBI, have attributed the attack to North Korean actors. Blockchain analytics firms had previously identified patterns consistent with earlier North Korean-linked thefts. The funds were moved through a series of addresses shortly after the breach. Binance said it detected the unauthorised access and took steps to limit further losses.

Withdrawals were paused for several days while the exchange assessed the damage and secured remaining assets. The resumption of normal operations was announced on 2 November. Teng posted that the company would cover the stolen amount from its own reserves. The exchange has not disclosed the exact technical vulnerability that allowed the theft.

North Korean cyber groups have been linked to multiple large cryptocurrency thefts in recent years. Proceeds have been used to fund weapons programmes, according to previous US and UN assessments. The scale of the Binance incident exceeds prior known cases. Industry observers noted that the speed of the attribution and the exchange’s decision to make users whole are unusual for an event of this size.

Customer balances were not reduced. Binance said it is cooperating with law enforcement in multiple jurisdictions. The exchange has also increased monitoring of withdrawal patterns and reinforced internal controls. No timeline has been given for full recovery of the stolen assets.

The crypto market saw elevated volatility in the days after the breach was disclosed. Bitcoin and major altcoins fluctuated as traders assessed the potential impact on liquidity. Binance’s decision to absorb the loss has been viewed as an attempt to maintain confidence. Other large exchanges have reviewed their own security postures in response.

The FBI statement linked the operation to known North Korean groups that have previously targeted exchanges and decentralised finance protocols. The agency has not released further operational details. Binance has not confirmed or denied specific technical findings beyond the total amount and the decision to cover it.

Previous North Korean-linked hacks have involved sophisticated social-engineering and smart-contract exploits. In this case the precise entry point remains under investigation. The exchange said it has isolated the affected systems and is conducting a full forensic review. Customers who had pending withdrawals during the pause were able to complete them once service resumed.

The incident highlights the continued concentration of risk on large centralised platforms. While Binance has the balance-sheet capacity to absorb a multi-billion-dollar loss, smaller platforms would not. Regulators in several countries have already signalled closer scrutiny of exchange security practices following the event.