Binance has allowed its customer to start withdrawing funds from the platform, as it begins to resume servies after a record $6.3bn hack.

The cryptocurrency exchange was hit by the theft on Thursday, forcing it to suspend withdrawals as it raced to fix the platform and investigate how hackers breached the system.

Binance began a phased reopening on Sunday following the hack, which has been blamed on a North Korea-linked group.

Binance first allowed customers who hold ethereum, USDT and USDC tokens on the Ethereum blockchain to retrieve funds, as well as some assets held on the BNB Smart Chain blockchain.

Holders of other tokens, including dogecoin and solana, were also allowed to withdraw their assets.

Replenishing the pot

The company said the phased approach was designed so “each network and asset pair can be restored carefully, with stability and security completed before access is reopened”.

It added that it was prioritising tokens based on user demand and that some users may experience “temporary delays or longer processing times due to traffic volume”.

The platform has said it had replenished 90 per cent of the amount stolen, paid for from its own revenue and an emergency fund. The remaining 10 per cent worth of tokens was dubbed “less liquid”, meaning they may take longer to buy, the firm wrote on X.

Binance promised to reimburse customers whose assets were stolen in the hack, with co-chief executive Richard Teng, adding the company is “committed” to users not bearing the financial impact of the attack.

On Saturday, the FBI blamed the heist on TraderTraitor, a group of hackers linked to North Korea. It expects the funds to be converted and “further laundered”.

The law enforcement agency urged private entities to “block transactions with or derived from addresses TraderTraitor actors” were “using to launder these stole assets”.

TraderTraitors is believed to be part of the Lazarus Group, which rose to notoriety in 2014, when it was accused of hacking into Sony Pictures. The FBI also blamed the hacker group for a $1.5bn theft of another crypto exchange Bybit in 2025.

Binance said it is working with law enforcement to investigate how the heist happened, but an initial investigation found that an engineer’s laptop has been compromised.

It added later that further “points of breach” had been discovered, with Teng confirming the firm is rebuilding and retesting its “entire infrastructure program”.