Binance has begun restoring withdrawal services after hackers removed approximately $6.3 billion in digital assets from the cryptocurrency exchange.

The company said its hot wallets were compromised at approximately 20:05 UTC on October 29. Hot wallets remain connected to online systems so transactions can be processed quickly, but that connectivity can also make them more exposed to cyberattacks.

Binance reported that approximately $3 billion of the stolen assets had been frozen on blockchain networks by October 30. The company has also said it expects to cover about 90% of the losses.

The Federal Bureau of Investigation has attributed the attack to North Korea. The agency identifies the specific North Korean cyber activity involved as TraderTraitor.

According to the FBI, the attackers have been converting stolen assets primarily into Ethereum. Investigators expect the funds to be moved through decentralised finance platforms and instant-swap services as part of further laundering attempts.

The FBI, US Secret Service and Internal Revenue Service Criminal Investigation division have asked cryptocurrency companies, blockchain operators and analytics businesses to block transactions connected with addresses being used to move the stolen assets.

The theft is believed to be the largest cryptocurrency heist recorded to date. Its scale has renewed concerns about the security controls protecting centralised exchanges and the financial risks customers face when large quantities of digital assets are held online.

Investors have also withdrawn billions of dollars from Binance following the breach, placing additional pressure on the exchange as it attempts to demonstrate that customer funds and its remaining systems are secure.

Binance says its investigation is continuing and has advised customers to rely on official company channels for updates. Restoring withdrawals is an important step, but the exchange will now face scrutiny over how the attack occurred, whether warning signs were missed and how it intends to prevent another breach.

Customers should be especially cautious of phishing emails or messages claiming to offer compensation. Large security incidents are frequently followed by scams designed to obtain passwords, recovery phrases or wallet credentials.