Crypto exchange Binance began reopening withdrawals on Sunday, three days after a hack that took about $6.3 billion from its hot wallets. The FBI has said North Korea was responsible, CNBC reported.
What has reopened
Binance first restored bitcoin withdrawals and then added the Ethereum network and BNB Smart Chain, CNBC reported. CoinDesk said the first window ran from 06:00 to 09:00 UTC on 1 November and covered bitcoin, ether, USDT, USDC, BNB and XRP, with more networks to follow. Binance says further phases depend on each blockchain passing security and stability checks.
Who pays
Binance said on Saturday that it had covered up to 90% of the stolen assets; by Sunday it was saying about 95%, CoinDesk reported. This does not mean the money was recovered from the attacker. Binance is buying the missing tokens itself, from its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury.
The remaining tokens are outside the top ten and less liquid, so they take longer to buy. "Binance will absorb the financial impact of these stolen funds, not our users," the company said.
Who did it
The FBI said late on Saturday that malicious North Korean actors had laundered the assets by converting them into Ethereum, and that it expected further laundering. Analytics firm TRM Labs had earlier pointed to North Korean hackers, and CoinDesk named the group TraderTraitor. CoinDesk also reported that about $3 billion is frozen, mostly in stablecoins; bitcoin and ether cannot be frozen in the same way.
What is still unknown
How the attack worked is not yet clear. Binance first suggested a compromised engineer's laptop, but co-CEO Richard Teng later said the attack was more complex than misuse of one engineer's access, CNBC reported.
Binance says major balances are fully backed and that users can check a proof-of-reserves snapshot on its website. It has promised a full proof-of-reserves report; CoinDesk did not give a date.
How we verified this
VerifiedThe reopening of withdrawals on 1 November, the phased restart and the replacement of stolen assets are reported by both CNBC and CoinDesk and are Binance’s own statements. The FBI’s attribution to North Korea is as reported by CNBC; CoinDesk attributes the attack to the North Korea-linked group TraderTraitor via analytics firms. Coverage figures differ by day (90% on Saturday, about 95% on Sunday) and are Binance’s claims. How the attack happened is still unclear.
