Binance has begun reopening withdrawals following the cyberattack that drained approximately $6.3 billion in digital assets from its hot wallets. However, the restart does not mean an immediate return to full operations: the exchange is proceeding network by network and token by token, keeping restrictions on some services while it completes security checks.
The most significant development for users is the financial guarantee announced by the company. In its latest update, Binance states that it has already covered 95% of the stolen assets and is currently purchasing the remainder. These are predominantly less liquid tokens, which are harder to source on the market in the required volumes without significantly impacting prices. Previously, the platform had reported 90% coverage; the updated figure indicates that the reserve replenishment process is progressing, though it is not yet complete.
A fundamental distinction must be made: covering client assets does not mean the funds held by the attackers have been recovered. Binance maintains that the financial impact of the theft will be absorbed by the company rather than passed on to users, replenishing holdings using its own resources and dedicated funds. The perpetrators of the attack therefore remain in possession of assets that, according to the FBI, were largely converted into Ethereum in preparation for further money laundering stages.
Withdrawals reopened, but services remain uneven
The halt on deposits and withdrawals was introduced as a containment measure following the discovery of the incident. It was a drastic decision for a platform that handles very high daily volumes, but one that was necessary to assess the extent of the losses, stop any unauthorized movements, and restore the affected components. Binance has now initiated a phased reactivation, warning that processing times may be extended due to the high volume of requests.
Bitcoin was among the first networks to be reopened, followed by the Ethereum network and BNB Smart Chain. However, service status remains variable: both deposits and withdrawals are available again for some networks, while on others one or both functions remain only partially active. Even where service has been restored, users may experience delays linked to operational checks and the traffic surge generated by the reopening.
In the first hours of the restart, Binance reported processing $4.6 billion in withdrawals and $1 billion in deposits, resulting in a net outflow of $3.6 billion. According to the company, the balance accounts for 2.1% of total assets under management. It is a figure worth watching for two reasons: it shows that a portion of users chose to immediately move funds off the platform, but it also indicates that the exchange was able to handle that initial volume of requests without reporting a new widespread halt.
How Binance is restoring coverage
The platform pointed to three sources to replace the stolen assets: the Secure Asset Fund for Users, known as SAFU, a portion of the futures insurance fund, and corporate treasury. SAFU is the mechanism created by Binance to address extraordinary events that could affect funds held on behalf of customers. Its activation in an incident of this magnitude represents a concrete test of the protective capacity promised by the exchange.
Binance also reported that the most significant assets involved in the incident — including BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC — are already fully covered. The remainder involves tokens outside the market's top tier, for which purchases must be spread across available markets and over-the-counter channels. The company aims to achieve 100% coverage for all affected assets.
This approach avoids having to wait for the on-chain recovery of funds before making user balances available again. At the same time, it exposes Binance to a potentially significant direct cost, which will depend on the price trajectory of the assets to be purchased and the actual liquidity of the less-traded tokens. The company's commitment is clear, but its execution will need to be verified through the progress of the plan and, above all, the complete normalization of services.
The attribution to North Korea and the areas that remain open
The FBI has attributed the theft to North Korean actors, pointing in particular to the group known as TraderTraitor. The attribution fits into a pattern already familiar to authorities and blockchain analytics firms: groups linked to Pyongyang have repeatedly been associated with campaigns targeting companies in the crypto sector, with the goal of obtaining digital assets and moving them through conversions, intermediary wallets, and services that make them harder to trace.
However, the precise technical vector of the intrusion remains to be clarified. Early statements suggested the hypothesis that the attack may have originated from the compromised laptop of a DevOps engineer, used to reach a service container and initiate unauthorized withdrawal transactions. Co-CEO Richard Teng later described the operation as more complex than the simple abuse of a single employee's privileges. Binance has not disclosed further details and has postponed the publication of an in-depth report until the conclusion of the investigation.
This caution is understandable from an investigative standpoint, but it leaves open significant questions for an operator that custodies assets for a global audience. A theft of this magnitude is not merely about the vulnerability of a technical component: it calls into question wallet architecture, privilege separation, transaction authorization procedures, and the ability to detect anomalies before they reach a systemic scale.
For now, the immediate priority is completing the restoration. Binance will need to bring its declared coverage to 100%, eliminate remaining suspensions, and explain in a verifiable manner how the attacker managed to hit its hot wallets. The resumption of withdrawals reduces the risk of a prolonged freeze for users, but it does not close the incident: the most delicate test will be proving that the reactivated infrastructure does not retain the conditions that made the theft possible.
