Binance users withdrew a net $4.9 billion by Monday morning after the world’s largest crypto exchange began restoring withdrawal services following a record $6.3 billion theft. The withdrawals represented nearly 3% of the assets held on the platform the day before the attack, according to data from DefiLlama.

The attack took place on Thursday night, and Binance suspended withdrawals while it worked to secure its platform and investigate how hackers accessed its systems. The exchange began gradually restoring withdrawals on Sunday, first allowing customers to withdraw tokens and later adding fiat currencies, including US dollars and UAE dirhams.

Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits during the nine and a half hours after withdrawals resumed on Sunday. It said the phased reopening was intended to allow each network and asset pair to be restored after stability and security checks.

Access was initially restored for Ethereum-based ETH, USDT and USDC, as well as some assets on the BNB Smart Chain. Binance later added withdrawals for tokens including dogecoin and solana on their respective blockchains. The company said it prioritized tokens based on user demand in the preceding week and warned that high volumes could cause delays.

Binance has said it will reimburse customers whose assets were stolen. It assembled funds equivalent to 95% of the stolen amount using company revenue and an emergency fund, and said it was working to buy the remaining 5% on the market. The company cited the tokens’ lower liquidity as a reason they would take longer to acquire in large quantities.

On Saturday, the FBI attributed the theft to TraderTraitor, a hacking group linked to North Korea, and said it expected the stolen assets to be converted and subjected to further laundering. Binance is investigating the incident with law enforcement and blockchain analytics firms and has said it will publish a report on its findings.

The company’s initial investigation found that an engineer’s laptop had been compromised and may have been used in the attack. Binance later said it had identified other possible points of entry. Co-CEO Richard Teng said after the theft that the company was rebuilding and retesting its infrastructure and carrying out a company-wide security review.

Sources: Folha Mercado.