Binance, the world's largest cryptocurrency exchange, said it has replaced 90 per cent of the $6.3 billion in assets stolen in a hack on Thursday, and it began restoring customer withdrawals on Sunday.
The company said the remaining 10 per cent may take longer to source in the required amounts because those tokens are less liquid. Co-chief executive Richard Teng said Binance is committed to covering that portion and that users will not bear the financial impact. The theft is believed to be the largest in crypto history, surpassing a $1.5 billion hack of the Bybit exchange in 2025.
How Binance is covering the losses
Binance said it has set aside more than $6.34 billion in company funds. In a post on X, it said the money used to rebuy tokens came from part of its $1 billion Secure Asset Fund for Users, some of its futures insurance fund and its own corporate treasury.
The company said all holdings of bitcoin, Ethereum and Tether are covered, along with seven other widely traded crypto assets. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement on Saturday.
Withdrawals were suspended after the hack. Binance said a phased reopening began Sunday after 2 p.m. Singapore time, starting with Ethereum, USDT and USDC tokens on the Ethereum blockchain and some assets on the BNB Smart Chain. Dogecoin and Avalanche dealing later resumed on their own platforms.
Who is blamed
The FBI said on Saturday that North Korea was responsible for the theft of more than $6 billion in virtual assets. It named TraderTraitor, a unit believed to be part of the Lazarus Group, and said it had seen the actors converting stolen assets into Ethereum. The bureau said it expects the assets to be laundered further through decentralized finance and instant swap services, and it urged private companies to block transactions linked to the addresses involved.
Trump told reporters on Saturday night that the United States is still unsure who is responsible. "We're learning about it. We don't know if it's North Korea - but if it is, we'll talk to North Korea about it," he said. North Korea has long denied involvement in such attacks.
Analytics firms TRM Labs and Chainalysis had earlier linked the attack to North Korean hackers, with TRM and Chainalysis each expressing high confidence. Teng said earlier that Binance's investigation had not attributed responsibility to any individual.
What investigators say about the breach
Binance first said an engineer's laptop was compromised, allowing unauthorized withdrawals. It later said the investigation had found additional points of breach. Teng said more than one person was involved and that the attackers used a self-destruct mechanism that erased tools and traces, making the attack harder to investigate.
TRM and Chainalysis say most of the theft occurred over about 20 minutes. TRM said the attacker moved about $6.36 billion out of Binance wallets on 10 blockchains.
Binance said on Friday that it had frozen about $3 billion of the stolen assets with help from law enforcement, intelligence firms and partners, including more than $2.3 billion by Tether and Circle, according to Reuters. The U.S. Secret Service said it is working around the clock with private sector partners to identify, freeze, trace and recover the funds. Binance has said the investigation is continuing and that the total may continue to increase.
Market and legal fallout
Bitcoin fell nearly 5 per cent after news of the hack, according to the Guardian, and Binance's BNB token dropped nearly 10 per cent. Coinbase said it was unaffected.
Lawyer Daniel Tunkel of the London firm Edwin Coe said whether customers could recover losses through litigation would depend on what they were promised in their contracts. Binance has said a detailed post-mortem will be shared when its investigation is complete.
Comments (0)
Please log in to comment.
No comments yet.