Binance has begun restoring withdrawals in phases, starting with the Bitcoin network, less than three days after a $6.3 billion hack forced the exchange to suspend them. The company says it has now covered about 95% of the losses with its own funds, up from 90% a day earlier.

The exchange said the first phase would begin between 06:00 and 09:00 UTC on Sunday, which corresponds to 7 a.m. to 10 a.m. in Nigeria. “Binance will absorb the financial impact of the stolen funds, not our users,” the company said in its latest update on X.

Phase one covers a limited set of networks and assets, selected according to user demand over the past week. Binance said it will add more networks and assets once it completes security and readiness checks. Deposits have remained open throughout. In practice, that means availability will widen in waves rather than all at once as each network clears those checks.

Users are advised to check the withdrawal page or the network status page to confirm whether their chosen asset and network are available. The exchange warned of possible delays or longer processing times during the initial rollout and said a failed withdrawal can be retried after a short wait. It described its approach as “controlled.”

Binance also said on X that it has added newly generated wallet addresses to its Proof of Reserves list, and that all withdrawals will now be processed from those addresses.

How much has Binance covered?

The exchange says it has covered $6 billion of the impacted amount, with the covered share rising at each update: about 80% on Friday, 90% on Saturday and now roughly 95%.

The 10 largest affected tokens are fully backed, according to the company’s statement. These are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 5% sits in less liquid tokens outside that group, which take longer to purchase at the required scale.

The funding comes from a partial deployment of the Secure Asset Fund for Users (SAFU), part of the exchange’s futures insurance fund, along with its corporate treasury. SAFU functions as a backstop for user losses in exactly this kind of scenario, and its deployment underscores the scale of the breach. Binance later said on X that the SAFU transfer is complete. It plans to replenish SAFU to about $1 billion, and the full proof of reserves is expected by Tuesday.

FBI blames North Korea

Separately, the FBI says North Korea was responsible for stealing more than $6 billion from the crypto exchange on or about October 29, an activity it calls “TraderTraitor.” TraderTraitor is the designation US authorities apply to North Korean-linked cryptocurrency theft operations. Binance thanked the FBI’s cyber branch for its support.

Working alongside the US Secret Service and IRS Criminal Investigation, the FBI said it has observed the hackers converting stolen assets mainly into Ether and expects them to launder the funds further through decentralized finance (DeFi) and instant swap services. The agencies are urging private firms to block transactions with addresses used by the hackers, and the FBI has published a list of those addresses. The published list gives firms a practical way to screen out transactions tied to the stolen funds. Blockchain analytics firms TRM Labs and Chainalysis had earlier linked the attack to North Korea.

What remains unknown

Binance says about $3 billion of the stolen assets has been frozen on-chain. The exchange notes that replacing assets is not the same as recovering them, and says it is working with law enforcement and partners on recovery.

The company’s initial assessment pointed to a compromised engineer’s laptop. It later said investigators had found “additional points of breach,” and co-CEO Richard Teng has described a “complex attack” involving malicious software designed to delete evidence, according to Reuters.

Binance had previously said it expected to share further technical findings within about 48 hours. It now says it will publish a post-incident report once the investigation is complete. How much of the frozen roughly $3 billion can ultimately be recovered — rather than merely replaced — remains the central unresolved question.