Binance said Saturday that it has replaced as much as 90% of the roughly $6.3 billion in tokens taken from its hot wallets in what has been described as the largest cryptocurrency theft on record. Late the same day, the FBI said North Korea was responsible.
The exchange said it will keep buying the remaining tokens through market and over-the-counter channels until every affected token is covered in full. It said its holdings of bitcoin, ether, tether, BNB, solana, USDC, XRP, USD1, RLUSD and zcash are already fully backed, and that the company, not its users, will bear the financial cost of the theft.
According to Binance, the remaining 10% consists of tokens that fall outside its 10 largest holdings. The exchange said those assets are less liquid and may take longer to acquire in the amounts needed.
How Binance is covering the loss
To restore the assets, Binance said it is drawing on its Secure Asset Fund for Users, known as SAFU, along with part of its futures insurance fund and its corporate treasury.
The exchange said its next goal is to restart withdrawals for users by Sunday, pending security checks, while its investigation continues. On Friday, Binance had said deposits were not affected and that suspended withdrawals were expected to resume within a day or two.
Binance also said it worked with blockchain partners to freeze about $3 billion of the affected assets, and it has pledged to cover all customer losses.
How the attackers got in
How the attackers got in remains unclear. Binance first said the breach may have involved a DevOps engineer's compromised laptop, which it said let an attacker reach a service container and submit unauthorized withdrawals. A later review found additional breach points, the company said, and co-CEO Richard Teng said the attack was more complex than the misuse of a single engineer's permissions.
Binance said it had found no evidence that any wallet private key had leaked and that it would publish more technical details once its investigation is finished. The company declined to give further details, pointing instead to its most recent statement.
Pointing to North Korea
Blockchain intelligence firm TRM Labs was among the first to point to North Korea. In a post on Thursday, the U.S.-based firm attributed the attack with high confidence to TraderTraitor, which it described as North Korea's elite hacking unit. TRM said an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it within roughly 20 minutes.
TRM said the attack shared several traits with earlier heists linked to North Korea, including the Bybit hack and an April 2026 attack on KelpDAO. It cited small withdrawals from the Tornado Cash mixer that funded an operator wallet, preparations that began well before the theft, and signatures gathered ahead of time and then executed all at once.
The FBI said Saturday that TraderTraitor was behind the attack. The agency said the North Korean actors have been converting the stolen assets into Ethereum and expects them to keep converting the funds as they prepare them for further laundering. According to the FBI, TraderTraitor also targeted the exchange Bybit in 2025, an attack that resulted in a $1.5 billion loss.
Jonathan Levin, co-founder and CEO of blockchain research firm Chainalysis, also said on social media that TraderTraitor likely carried out the Binance hack.
Analysts believe TraderTraitor's members belong to a broader North Korean hacking operation known as the Lazarus Group, which, according to the U.S. Treasury Department, targets institutions in government, finance and other sectors. In 2018, the Justice Department alleged that the Lazarus Group carried out a 2014 attack on Sony Pictures Entertainment that exposed large amounts of sensitive company data.
Experts say North Korea has turned to cryptocurrency theft and other illicit cyber activity to raise foreign currency for its struggling economy and its nuclear program, in the face of tough U.N. sanctions. In December 2022, South Korea's spy agency estimated that North Korean hackers had stolen about 1.5 trillion won, or $1.1 billion, in cryptocurrency and other virtual assets over the previous five years, with more than half of that taken in 2022. The agency said North Korea's ability to steal digital assets ranked among the best in the world.
Questions for Binance
Binance founder Changpeng Zhao, known as CZ, started the company in 2017. He stepped down as CEO in 2023 after pleading guilty to a felony tied to failing to prevent money laundering on the platform, and President Trump pardoned him in 2025. On Thursday, Zhao wrote on social media that user funds were safe but that the incident did appear to be a hack on Binance. He said he no longer runs the exchange but, as a shareholder, expects all user funds to be fully covered.
Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said the incident raises questions about why stronger approval controls were not in place. He said it appeared that a single signature had given the attacker a full-access token to a Binance hot wallet that never expired. Hot wallets are internet-connected wallets that store users' private keys digitally.
Binance said its teams are working around the clock on the problem and are cooperating closely with law enforcement to identify those responsible and bring them to justice.
