Binance reopens withdrawals after the $6.3 billion hack as the FBI blames North Korea
Binance began reopening cryptocurrency withdrawals on Sunday, starting with bitcoin, three days after a hack of about $6.3 billion in digital assets, CoinDesk and CNBC reported. The FBI said late Saturday that it had determined North Korea was responsible. Binance says it has covered most of the stolen assets with company funds and that users will not bear the losses.
The reopening: Binance said the first phase of withdrawals began early Sunday, with the bitcoin network opened first, CoinDesk reported. Withdrawals on the Ethereum network and BNB Smart Chain followed, CNBC reported. Reuters, in a report carried by The Straits Times, said the first phase covers 15 crypto assets, including bitcoin, ether, XRP and dogecoin. Binance warned users to expect congestion, longer processing times and temporary delays, Cointelegraph reported.
Covering the losses: Binance said Saturday that it had covered up to 90% of the stolen assets, CNBC reported. On Sunday it said it had covered 95%, about $6 billion, by buying replacement tokens, according to The Straits Times. The rest are less liquid tokens that may take longer to buy. Binance says it is drawing on its Secure Asset Fund for Users, part of its futures insurance fund and its corporate treasury. Covering the assets is not the same as recovering them from the attacker.
The attribution: The FBI said North Korean actors were converting the stolen assets into ether and that it expects further laundering, CNBC and The Straits Times reported. The Straits Times said the FBI named the unit TraderTraitor. North Korea has for years denied using state-linked cyber units for theft.
What we don’t know yet: How the attack happened is still unclear. Binance first pointed to a compromised DevOps engineer’s laptop, but co-CEO Richard Teng later said the attack involved a more complex process, CNBC reported. Binance said about $3 billion of the stolen assets had been located with help from partners. Not every network has reopened, and more phases will follow after security checks.