Cryptocurrency exchange Binance has begun restoring customers’ ability to withdraw funds from its platform as it works to recover from a record-breaking $6.3 billion (£4.7 billion) cyberattack. The exchange suffered the massive theft on Thursday, an incident widely described as the largest cryptocurrency heist in history. Cybersecurity experts have pointed to North Korea as the likely force behind the attack.
Binance initially suspended withdrawals while investigating the security breach. However, on Sunday, the company announced that it had commenced a gradual restoration of withdrawal services, beginning after 2 p.m. Singapore time. Under the first phase of the reopening, customers holding Ethereum, USDT and USDC tokens on the Ethereum blockchain will be able to withdraw their assets. Some users with funds held on the BNB Smart Chain will also regain access to their money.
The exchange disclosed that it had recovered approximately 90 per cent of the stolen funds. However, the remaining 10 per cent comprises less liquid tokens, which could take additional time to repurchase. In a statement shared on X on Saturday, the company explained that the process of acquiring the outstanding tokens could take longer because of their limited market liquidity.
Binance co-chief executive Richard Teng separately assured customers that the company was committed to covering the remaining 10 per cent, adding that users would not suffer any financial losses as a result of the incident. Meanwhile, the FBI on Saturday confirmed earlier findings by independent investigators and cybersecurity analysts that a North Korean-linked hacking group known as TraderTraitor was responsible for the attack.
TraderTraitor is believed to be associated with the notorious Lazarus Group, which attracted international attention in 2014 after being accused of hacking Sony Pictures Entertainment in retaliation for the release of The Interview, a comedy film that portrayed North Korean leader Kim Jong-un. In a statement, the FBI said North Korea was responsible for stealing more than $6 billion in virtual assets from Binance on or around October 29.
The agency further disclosed that it had tracked TraderTraitor-linked actors converting the stolen cryptocurrency into Ethereum. It warned that the attackers were likely to continue laundering the assets through decentralised finance platforms and instant cryptocurrency exchange services. The FBI has consequently called on private-sector organisations to block transactions linked to wallet addresses being used by the hackers to move and conceal the stolen funds.
Explaining the nature of the breach, Teng said on Friday that the incident involved a sophisticated attack in which a laptop was compromised using malicious software designed to erase traces of its activities, making the investigation and identification of the perpetrators more difficult. Binance has disclosed that it allocated approximately $6.34 billion in company resources to compensate for the losses arising from the attack. “Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident,” the company stated.
According to Binance, the funds used to repurchase the stolen tokens came from several sources, including a portion of its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve established to protect customers against security incidents. The company also drew on its Futures Insurance Fund and corporate treasury to finance the recovery effort.
The attack has also intensified concerns among industry observers about the potential risks posed by the rapid advancement of artificial intelligence, particularly its growing capacity to undermine cryptographic systems and existing information technology security measures.
Following news of the breach, Bitcoin fell by nearly 5 per cent, while Ethereum recorded a decline of almost 6 per cent. Binance’s native token, BNB, also dropped by approximately 10 per cent. The unprecedented scale of the theft has renewed scrutiny of North Korea’s ability to generate revenue through illicit cyber activities, particularly as the country continues to face extensive international sanctions over its nuclear and missile development programmes.
Related article
