Binance Covers 90% of $6.3bn Hack FBI Blames on North Korea

Binance, the world's largest cryptocurrency exchange, said it has covered 90% of the $6.3bn in assets stolen in a hack last Thursday, with the remaining 10% expected to take longer to source, according to the company, the BBC reported.

The exchange has pledged to cover 100% of the losses using its own funds rather than user assets. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement Saturday, per the BBC.

What did Binance say caused the breach?

Binance's initial investigation pointed to a compromised engineer's laptop that allowed unauthorized withdrawals. A later update from the company said it had uncovered "additional points of breach." Richard Teng, Binance's co-chief executive officer, said more than one person carried out the attack and that the hackers used a "self-destruct mechanism" to hide their tracks, the BBC reported.

Who does the FBI say is responsible?

The FBI said Saturday that North Korea was responsible for the attack. The bureau said it had observed hackers converting stolen assets into Ethereum, with the funds expected to be converted again through decentralized finance and instant swap services, according to the BBC. The FBI specifically named the Lazarus Group, also known as TraderTraitor, a North Korean state-backed hacking unit. Two analytics firms separately told the BBC they had intelligence pointing to the same group. North Korea has consistently denied involvement in past attacks attributed to it, including a $1.5bn heist on the Bybit exchange in 2025 that the FBI also blamed on North Korea.

President Donald Trump offered a more cautious assessment Saturday night. "We're learning about it. We don't know if it's North Korea - but if it is, we'll talk to North Korea about it," he told reporters, according to the BBC.

How much has been recovered or frozen?

• Binance said Friday it had frozen roughly $3bn of the stolen assets after working with law enforcement, intelligence firms and other partners.
• The exchange set aside more than $6.34bn in company funds to cover the losses in full.
• Coverage extends to all holdings in bitcoin, Ethereum and Tether, plus seven other widely traded crypto assets, Binance said.
• The US Secret Service said Friday it is "working around the clock" with private-sector partners to "identify, freeze, trace, and recover funds."

Are withdrawals back to normal?

Binance said Sunday that withdrawals had been restored on several of its networks after being suspended following the hack. The company had previously said withdrawals would resume in phases rather than all at once.

What happens next?

• Binance's investigation into the breach remains ongoing, the company said.
• Tracing of the remaining unfrozen funds continues as hackers reportedly move assets through Ethereum conversions and swap services.
• Any US response toward North Korea depends on attribution the Trump administration says it has not yet confirmed.

The hack is believed to be the largest in cryptocurrency history, surpassing the $1.5bn Bybit breach in 2025. Binance, founded in China in 2017, is estimated to serve hundreds of millions of users worldwide who buy, sell and trade digital assets through the platform.