Binance reopened bitcoin and ether withdrawals on Sunday, three days after hackers moved $6.3 billion of customer tokens out of its hot wallets in the largest theft the industry has recorded.
The exchange said it had set aside about $6.34 billion of its own funds and restored backing for roughly 90% of what was taken. Reuters put the covered share at 95% by Sunday. Both figures describe coverage, not recovery.
None of the money has come back from the attacker. Binance has replaced customer balances with corporate funds, futures reserves and its Secure Asset Fund for Users, the insurance pool it started in 2018 and has topped up at intervals since.
Withdrawals resumed in phases. Bitcoin and ether first, then some stablecoins, with the rest of the listed assets to follow. Users who had been unable to move funds since Thursday queued for the reopened service.
Two stablecoin issuers helped at the edges. Circle and Tether froze portions of the proceeds at the exchange’s request, which limits how quickly the haul can be laundered but does not return it to customers.
The Federal Bureau of Investigation said on Saturday that North Korea was responsible. Blockchain intelligence firm TRM Labs put the loss at $6.36 billion, slightly above Binance’s own estimate, and both TRM and Chainalysis tied the operation to a state unit blamed for earlier exchange thefts.
That attribution sets the shape of what comes next. Funds taken by a state group are hard to seize, slow to trace and rarely recovered in full, which is why exchanges that promise to make users whole do it from their own balance sheets.
Binance can absorb the bill, at least on paper. It is the largest exchange by volume, and the $6.34 billion it earmarked is a provision rather than a payment to the attacker.
The number is hard to place without a comparison. The Bybit breach in February 2025, until now the largest single theft, came to about $1.5 billion. Mt. Gox, the reference point for an older generation of users, lost roughly 850,000 bitcoin in 2014, when the coins were worth a fraction of their later value.
The fund that absorbed part of the loss is smaller than the loss. SAFU was seeded with a share of trading fees and has been reported at about $1 billion, so most of this bill came from the operating business rather than the insurance.
The company has spent three years arguing that it is a different institution from the one that paid $4.3 billion to settle US criminal and civil cases in 2023. Changpeng Zhao, its founder, pleaded guilty in that case and stepped down. A monitorship followed. Richard Teng, now co-chief executive, has built much of his public message around compliance and reserves.
Zhao, still the company’s largest shareholder, posted on X on Thursday as the breach was being assessed: “User funds are safe!”
Users judged that claim with their withdrawal buttons. A run that begins with a security scare and ends with a queue is a test of logistics as much as solvency: matching redemptions against reserves held across chains, custodians and cold storage.
Binance has not said which assets remain short, and the BBC reported that the last tenth may take longer to source in the required amounts.
The obvious question is what the other 10% is worth. Binance has said it will cover the remainder, and the shortfall is a few hundred million dollars against a company of its size. But coverage that arrives over weeks is a different product from coverage that arrives at once.
US authorities have spent three years treating exchange failures as a market-structure problem rather than a series of accidents, which is why the 2023 settlement came with monitors inside the company and reporting obligations that outlasted the founders who signed it.
There is a second question, less comfortable. The theft was large enough that regulators in several jurisdictions will now ask whether reserve disclosures, which exchanges publish voluntarily and audit unevenly, were ever the safeguard they were presented as.
The market’s verdict so far has been confined to the exchange’s own order books. Withdrawals work. Deposits, which are the test of confidence, will show up in volume over the coming weeks.
For the industry, the precedent is the part that lasts. A record theft was filled from a corporate treasury inside three days, and every exchange now knows the standard it will be measured against when its turn comes.
The risk sits with the tenth that remains. If it is sourced in days, Binance will have shown that a $6.3 billion hole can be patched without a bailout. If it stretches into months, depositors will have learned to test the exit before the next headline, and the safest exchange will be the one whose doors were never closed.
