Binance said it had replaced 95 percent of about $6.3 billion in tokens taken in a Thursday theft and would restart withdrawals in phases on Sunday, according to Dawn and The National^6,7. The first window was listed as 0600 to 0900 GMT, covering 15 assets including bitcoin, ether, XRP and dogecoin^6,7.

Earlier Saturday the exchange had said 90 percent of the stolen assets were covered and that the rest were less liquid tokens that may take longer to buy, BBC and Al Jazeera reported^1,2. Dawn said the later figure was about $6 billion replaced, with 5 percent still outstanding⁶.

Binance said it would absorb the financial impact rather than pass it to users^1,2,7. Al Jazeera and Dawn said replacements came from a Secure Asset Fund for Users, a futures insurance fund and the corporate treasury^2,6. The Verge reported the company had reserved more than $6.34 billion⁴. Co-chief executive Yi He said 50 percent of the SAFU would be used and that Binance would replenish that fund, Dawn reported⁶.

The FBI said Saturday that North Korean actors linked to a group called TraderTraitor were converting stolen assets mainly into ether and asked virtual-asset firms to block listed addresses^2,6,7. TechCrunch and The Verge said TRM Labs, Elliptic and Chainalysis had already attributed the theft to that group^3,4. Dawn said President Donald Trump told reporters Saturday the United States was not certain North Korea was involved⁶. North Korea has denied involvement in such attacks, BBC noted¹.

Binance has said an engineer's laptop was compromised and later that investigators found additional points of breach^1,3,4. Co-chief executive Richard Teng described a complex attack with more than one person and software meant to hide tracks^1,2,4. The company said it found no evidence that wallet private keys leaked^3,4,5.

About $3 billion in stolen assets were frozen with partners, Binance said Friday^1,4,6. Ars Technica, citing Elliptic, said attackers had moved other sums into assets that could not be frozen⁵. The U.S. Secret Service said it was working with private partners to identify, freeze, trace and recover funds¹. Abu Dhabi's Financial Services Regulatory Authority said it was engaging with the company⁵. The National said deposits remained open⁷.