Binance resumes withdrawals following $6.3 billion breach

Cryptocurrency exchange Binance began a phased resumption of customer withdrawals early on Sunday following a $6.3 billion wallet breach. According to TechCrunch's report, the company halted deposits and withdrawals after hackers drained digital assets from its custody wallets. Binance confirmed covering 95 percent of the stolen funds from corporate reserves, stating losses will not impact users. The exchange is now working to purchase the remaining affected assets, which are less liquid and take longer to source at scale.

This report details the phased reopening timeline, current network status across major tokens, and law enforcement findings behind the $6.3 billion cyberattack. It is written for active traders, institutional investors, and compliance professionals tracking exchange solvency and digital asset safety. With transaction queues creating temporary processing delays and the Federal Bureau of Investigation tracing stolen funds into Ethereum, understanding the operational status of individual asset rails is critical for users managing counterparty risk during the exchange's ongoing recovery process.

What broke in Binance resumes withdrawals following $6.3

The breach compromised Binance wallets, allowing attackers to steal $6.3 billion in cryptocurrency and triggering an emergency shutdown across all platform operations. Binance halted all deposits and withdrawals as a precaution while internal teams worked to contain the loss, evaluate incident impact, restore affected services, and complete security checks. Exchange leadership emphasized that the freeze was not initiated lightly, noting that reliable withdrawal access is vital for users, but reiterated that pausing transactions was necessary to protect platform reserves.

Although Binance covered ninety-five percent of the stolen assets using company reserves, recovery stalled for the remaining five percent of compromised balances. The company confirmed that these remaining tokens are less liquid in open markets and require significantly more time to source at scale. Because purchasing these illiquid assets rapidly could trigger market distortions, the exchange could not execute a simultaneous global reopening, leaving specific deposit and withdrawal pipelines restricted while treasury teams source the required inventory.

Who is exposed by Binance resumes withdrawals following $6.3

Platform users attempting to withdraw funds face direct exposure to processing backlogs, queue delays, and selective network throttles. Even though Binance stated that user losses will not occur and that the company will bear the entire financial impact, customers cannot access all capital freely. The exchange warned that users should anticipate temporary delays or longer processing times due to heavy traffic. Traders needing immediate liquidity for external obligations or margin positions remain vulnerable to delays while the phased rollout expands.

Broader crypto markets face exposure to laundering activity stemming from the stolen $6.3 billion haul. On Saturday, the Federal Bureau of Investigation attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group. The FBI revealed that TraderTraitor has been converting stolen assets primarily into Ethereum, with further laundering operations actively anticipated. Decentralized finance protocols, liquidity pools, and secondary exchanges handling large Ethereum transactions face heightened exposure to illicit funds as the cybercriminal group obscures transaction trails across international settlement rails.

What to do now about Binance resumes withdrawals following $6.3

Account holders must consult the Binance network status page before submitting any cryptocurrency transactions. As of Sunday morning, the status page showed a fragmented landscape of normal, partially suspended, and fully suspended channels. For example, Bitcoin deposits and withdrawals are both listed as partially suspended, meaning transactions encounter processing restrictions. In contrast, Ethereum deposits have returned to normal status, but Ethereum withdrawals remain partially suspended. Checking the dashboard prevents users from broadcasting transfers into queues that cannot clear during the restoration process.

Traders should plan for extended settlement intervals and avoid sending repeat requests when outbound transfers take longer than normal. Binance advised that high traffic volume is creating temporary delays, so resubmitting pending transactions will only add unnecessary congestion to exchange infrastructure. In addition, institutions interacting with external wallets should cross-reference incoming Ethereum flows against addresses associated with the North Korean TraderTraitor network. Applying rigorous compliance screening ensures organizations do not inadvertently accept tainted assets originating from the breach while investigations continue.

How the Binance resumes withdrawals following $6.3 issue works

The recovery mechanism operates through a phased rollout determined by network type and underlying asset liquidity. Binance implemented this structure after covering ninety-five percent of stolen holdings with corporate reserves, while working to purchase the remaining five percent of less liquid assets across open markets. The company committed to absorbing the full economic impact of the attack, ensuring user account balances remain intact. To protect exchange stability, security engineers are bringing transaction gateways online incrementally rather than restoring unthrottled access immediately.

Under this phased framework, system status transitions from fully suspended to partially suspended before reaching normal operational capacity. Internal teams conduct continuous safeguards and security checks during each phase to verify transaction integrity under heavy traffic loads. Binance described the resumption of withdrawals as a major milestone but noted that work continues to complete the recovery process. By decoupling asset types and managing throughput, the exchange aims to contain systemic risks while monitoring external blockchain activity as assets move through verified clearing channels.

What is still unknown about Binance resumes withdrawals following $6.3

Technical specifics regarding the exact vulnerability exploited in the $6.3 billion breach remain undisclosed. Binance has committed to publishing an in-depth incident report once its internal investigation concludes, but until then, it remains unclear how hackers penetrated wallet defenses, whether private keys were compromised, or what internal access controls failed. Additionally, the exchange has not disclosed the complete list of tokens that make up the final five percent of unrecovered assets, leaving users without visibility into which specific illiquid cryptocurrencies are still being sourced.

The complete timeline for ending withdrawal restrictions across all affected networks also remains unannounced. Binance has not provided estimated dates for restoring full operations to Bitcoin deposit and withdrawal rails or lifting partial suspensions on Ethereum withdrawals. Furthermore, while the FBI identified North Korea's TraderTraitor group as the perpetrator and confirmed assets are being converted into Ethereum, it remains unknown whether law enforcement agencies will be able to freeze or recover the laundered funds before they disperse across decentralized platforms.