Binance withdrawals resume after $6 billion-plus cyber theft

Binance withdrawals resumed Sunday after a reported $6 billion-plus hack, reopening access to Bitcoin more than two days after a freeze.

The world’s largest digital-asset platform began restoring access after 2 p.m. Singapore time, according to company posts. The reopening gave customers a path to move assets while the exchange and the wider crypto market awaited clearer details on the breach.

Bitcoin access returns first

Binance first reopened Bitcoin withdrawals, more than two days after halting them following the cyber theft. The pause had made customer access, rather than token prices or trading volume, the immediate test of the exchange’s recovery.

The company later said the first restoration phase covered 15 tokens. That group included Ether, Tether’s USDT and Circle Internet Group Inc.’s USDC, according to Binance posts on X.

Outflows reach $3.5 billion

By evening in Asia, DefiLlama data showed about $3.5 billion in net outflows from Binance. Co-Chief Executive Officer Yi He said on X that some transfers were between Binance wallets, meaning the net outflow figure does not by itself show how much money customers removed from the platform.

The distinction matters because wallet movements after an exchange incident can include internal reshuffling, customer withdrawals and operational transfers. The supplied figures do not break down the $3.5 billion by category, so the customer-retention picture remains incomplete.

Fifteen networks come back

Binance said withdrawals had resumed on 15 blockchain networks by around 8:30 p.m. in Singapore. The restored networks included Ethereum, BNB Smart Chain, XRP and Base, according to the company.

The phased restart shows the exchange did not reopen all services at once. It also leaves two operational questions: whether remaining assets and networks return on schedule, and whether Binance imposes extra checks that slow customer transfers.

North Korea allegation remains open

The breach has been blamed on North Korea, but the available account did not identify a named government agency, investigator or company statement supporting that attribution. Until a source is identified, the allegation should be treated as a claim rather than a confirmed finding.

The reported loss of more than $6 billion would place the incident among the largest cyber thefts described in digital-asset markets. The material provided does not include an independent forensic report, a law-enforcement statement or a detailed Binance explanation of how the attackers accessed funds.

That gap is important for the industry. Without a public account of the failure point, rival exchanges, custodians and institutional clients have limited information on whether the problem was specific to Binance or tied to a broader weakness in wallet, network or operational controls.

Three paths for Binance

If withdrawals continue and net outflows slow, the global macro effect would probably remain confined to confidence in digital assets rather than broader financial conditions. Under that scenario, Binance’s immediate task would shift from reopening networks to explaining the breach and demonstrating stronger controls, while the wider sector would focus on custody and wallet defenses.

If outflows continue at a high pace, Binance would face a tougher liquidity and trust test even if transfers remain open. The industry effect would be a renewed focus on exchange reserves and operational transparency, while global policymakers could use the episode to press for stricter oversight of large crypto venues.

If new pauses or further losses emerge, the mechanism changes from reputational damage to operational stress. Binance would then have to manage customer access, security remediation and public attribution at the same time, while other exchanges could see customers reassess where they hold tokens.

The next signals are practical rather than rhetorical: whether all withdrawals stay open, whether outflows stabilize, and whether Binance or investigators publish a clearer account of the breach. Until then, the restoration of customer access is only the first stage of the exchange’s response.