Binance said it will resume withdrawals in phases after covering 95% of the $6.3 billion in tokens stolen from its platform, according to a Reuters report dated Nov 1. The first phase is set to start between 0600 and 0900 GMT on Sunday and will include bitcoin, ether, BNB, Solana, XRP, dogecoin and other tokens.

Binance said the remaining 5% of stolen tokens are less liquid and may take longer to source in the required amounts. The exchange made that statement on X late on Saturday.

The FBI said on Saturday that TraderTraitor, a North Korean state-sponsored unit, was responsible for the attack. The FBI said members of the unit were observed converting stolen assets into ether. It said it expects further laundering of the assets using related technology.

Pyongyang has denied for years using state-linked cyber units for espionage, financial theft and revenue. Its mission in Geneva and its embassy in China did not respond to requests for comment.