Binance Says It Has Replaced Most Assets Stolen in $6.3 Billion Hack
Binance said Saturday it has replaced up to 90% of approximately $6.3 billion in token assets stolen from its hot wallets in a theft disclosed Thursday. The cryptocurrency exchange said it would cover the remaining assets and that users would not bear the losses.
The company said Bitcoin, Ether, and eight other major tokens are fully backed. The outstanding portion consists of less liquid tokens outside its top 10, which could take longer to acquire in the necessary quantities. Binance said it is purchasing replacement assets through market and over-the-counter transactions.
To finance the effort, Binance said it is using its Secure Asset Fund for Users, part of its Futures insurance fund and corporate treasury. The exchange said it would continue reporting its progress as it works toward replacing all affected tokens.
Separately, the FBI said late Saturday that it had determined North Korea was responsible for the theft. According to the agency, the attackers converted stolen assets into Ethereum as part of a laundering process. The FBI said it expects further conversions as the assets move through additional laundering stages.
Blockchain intelligence firm TRM Labs had also linked the attack to North Korean hackers. It cited similarities to previous incidents, including early preparation, small withdrawals through Tornado Cash and transactions executed in a concentrated burst.
The method used to breach Binance remains unclear. The exchange initially raised the possibility that an attacker compromised a DevOps engineer’s laptop and gained access to a service container. Co-CEO Richard Teng later said the operation was more complex than misuse of one employee’s permissions.
Binance said its next target was to resume customer withdrawals by Sunday, subject to security checks. It has not provided further details about its investigation. The reopening would mark an operational step for the exchange following the theft.