Binance, the world's biggest cryptocurrency exchange by trading volume, said on Sunday that it had resumed customer withdrawals after a major hack that affected more than $6 billion in funds.
Binance had suspended user withdrawals after the attack. The exchange also announced that it had now reimbursed approximately 95% of the stolen funds using its own corporate reserves.
"First batch network now opened in phase one of withdrawals is $BTC bitcoin network," Binance said on X.
The company said in an earlier update that it was preparing to resume the first phase of withdrawals between 6 a.m. and 9 a.m. GMT on Sunday.
"We are taking a phased approach by prioritizing tokens based on the past week data of user demand, so that each network and asset pair can be restored carefully, with stability and security checks completed before access is reopened," it said.
Binance said Saturday that it has set aside more than $6.34 billion in company funds to cover losses in the hack, which is thought to be the biggest-ever crypto heist.
The heist, which the FBI has tied to North Korea and analysts believe may be the biggest financial robbery ever, adds to a string of recent crypto thefts. Last year, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to researchers at TRM Labs.
"User funds remain safe. Binance will absorb the financial impact of the stolen funds, not our users," it said on X.
Binance, which was founded in China, said the first phase of withdrawals would cover 15 crypto assets including bitcoin, ether, XRP and dogecoin.
FBI ties attack to North Korean unit
The FBI accused North Korea of being behind the attack on Saturday, confirming earlier suspicions from private investigators and analysts that a Pyongyang-affiliated group called TraderTraitor was behind the hack.
Analysts had also blamed North Korea for the heist.
The bulk of the theft unfolded in around 20 minutes beginning late on Thursday and bore similarities to previous large attacks blamed on North Korea, according to U.S. blockchain analysis firms TRM Labs and Chainalysis.
News of the cyberattack caused the prices of most major cryptocurrencies to fall sharply on Friday.
U.S. President Donald Trump, however, said on Saturday that the United States was still not certain if North Korea was involved.
"We don't know if it's North Korea, but if it is, we'll talk to North Korea about it," Trump told reporters on Saturday in comments posted by a White House account on X.
Binance founder thanks U.S. law enforcement
Binance, which allows users to buy, sell and trade digital assets, has 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report.
In a post on X that quoted the FBI statement on North Korea's involvement, Binance thanked the agency for its support. It did not respond to a request for comment on North Korea's involvement.
Binance founder Changpeng Zhao, who was convicted in the U.S. of failing to maintain an effective anti-money laundering program before being pardoned by Trump last year, said U.S. law enforcement agencies provided vital help, including by tracking and freezing the stolen assets.
"A tweet can't fully express our gratitude. Many crypto bros may not realize, a lot of the 'why bitcoin didn't drop more?' credit goes to them," Zhao wrote, referring to the U.S. law enforcement agencies.