Two things changed over the weekend in the largest cryptocurrency theft on record.
First, the attribution hardened. On Saturday the Federal Bureau of Investigation said North Korea was responsible for the theft of $6.3bn (£4.7bn) from Binance. Until then the finger had been pointed by two private blockchain analytics firms; it is now pointed by the United States government, which specifically named the state-backed unit TraderTraitor, also known as the Lazarus Group.
Second, the money started coming back. Binance says it has covered 90% of the stolen assets, having set aside more than $6.34bn in company funds to cover the whole amount.
"Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement on Saturday. The remaining 10%, it added, may take longer to source in the required amounts.
What is covered, and when withdrawals return
Binance said it replenished the assets from various funds and its own corporate treasury, and that all holdings of bitcoin, ethereum and Tether are covered, along with seven other widely traded crypto assets.
The company said its next goal was resuming withdrawals, and that it remained on track to reopen them on Sunday 1 November — today — with a further update once details were confirmed.
How it was done
Binance’s initial investigation suggested an engineer’s laptop had been compromised, allowing unauthorised withdrawals. A later update said investigators had uncovered "additional points of breach".
Co-chief executive Richard Teng said the hack was carried out by more than one person and that the attackers used sophisticated methods to cover their tracks, including a "self-destruct mechanism".
On Friday the company said it had frozen around $3bn of the stolen assets after working with law enforcement, intelligence firms and partners. The US Secret Service said it was "working around the clock" with private sector partners to "identify, freeze, trace, and recover" the funds. The investigation continues.
The record it broke
The theft is believed to be the largest in history, eclipsing the $1.5bn taken from the Bybit exchange in 2025 — an attack the FBI also attributed to North Korea. Pyongyang has always denied involvement in these attacks.
Binance, founded in China in 2017, lets users buy, sell and trade digital assets and is estimated to have hundreds of millions of users worldwide.
Why the FBI saying it matters
Private attribution and state attribution are different instruments. TRM Labs and Chainalysis trace money across public blockchains and publish what the patterns suggest; they are good at it, and their findings are evidence. But they are commercial firms describing probabilities, and a government can treat their conclusions as interesting without acting on them.
An FBI attribution is the United States putting its own name behind the claim. It is the step that lets sanctions, indictments and asset-seizure actions follow, and it is the reason the US Secret Service is now working with private partners to trace and recover the funds rather than waiting for Binance to finish its own investigation.
What covering the loss does and does not mean
Binance replacing the assets protects its users. It does not recover the money, and it does not undo the theft: the stolen funds are still moving somewhere, and the company has absorbed a hole in its own balance sheet to keep customer accounts whole.
That is a meaningful protection and it depends entirely on the exchange being large enough to do it. The promise to cover 100% is a promise about Binance’s solvency as much as about its intentions, which is worth remembering when comparing exchanges.
The remaining 10% is the part to watch. Binance says sourcing it in the required amounts may take longer — meaning the company has to acquire specific assets in specific quantities without moving their prices against itself while doing so.
