Binance reopens withdrawals after $6.3 billion hack as customers pull funds
The phased restart gives customers access again, but replacement assets and recovered stolen funds are different measures.
Binance resumed withdrawals for a range of cryptocurrencies on Sunday after a $6.3 billion hack, reopening an important route for customers to move their money off the exchange. The restart is being carried out in phases, with further services dependent on security and stability checks.
The exchange said it had replaced about 95% of the affected assets using company funds and would absorb the losses rather than pass them on to customers. That is a statement about replacing customer balances, not a claim that investigators recovered 95% of the stolen tokens.
A restart, followed by an outflow test
Bitcoin, ether and several other widely used assets were among the withdrawals restored. Binance said it was prioritizing assets and networks based on customer demand. The remaining affected tokens were less liquid and would take longer to purchase in the quantities needed, according to the exchange.
Customers began moving funds as access returned. Reuters reported that Binance put net outflows at $3.64 billion as of 15:30 GMT Sunday, equivalent to 10:30 a.m. EST. The same report cited a higher $4.36 billion estimate from analytics provider DefiLlama. Binance disputed that estimate, saying movements into its own new hot wallet affected the calculation. These are differently measured snapshots, not interchangeable totals.
Binance said withdrawals had spiked initially but were stabilizing, while deposits remained substantial. That is the exchange's assessment of activity, not independent proof that the security review is complete or customer confidence has fully returned.
What the replacement pledge does and does not show
The exchange said it would use its own resources to cover the financial impact of the theft. Buying replacement tokens can help restore the assets backing customer balances even while the stolen funds remain elsewhere. Freezing or recovering stolen assets is a separate process.
The FBI attributed the attack to the North Korean state-sponsored group known as TraderTraitor. The withdrawal restart does not end the investigation or establish that every blockchain and token is ready for normal service.
Why it matters for Monday
The immediate question has shifted from whether withdrawals can reopen to how the exchange handles customer demand and the remaining restoration work. Further updates on supported networks, security checks and the assets backing customer balances will give a clearer picture than a single outflow number.
For the earlier stage of the incident, see Friday's report on the expanding security review. Sunday's reopening is a new development, not a revision of the withdrawal status reported then.
