Binance, the world's largest cryptocurrency exchange, announced that it would gradually resume customer withdrawals after replacing 95% of the cryptocurrency stolen in a record $6.3 billion breach of its platform. The FBI has linked the attack, the largest digital heist in history, to North Korea. Binance used its own funds to purchase replacement cryptocurrency.
According to the company, the money used to repurchase the assets came from three sources: part of its $1 billion Secure Asset Fund for Users (SAFU), a Bitcoin reserve maintained to protect customers in the event of security breaches, part of its futures insurance fund and funds from the company's own reserves.
Gallery
Binance; the company used its Bitcoin reserves to repurchase stolen assets
(Photo: Shutterstock)
Binance added that it had taken a new snapshot of assets on its platform as of midnight Oct. 31 as part of its proof-of-reserves process, designed to verify that the exchange holds enough assets to cover customer deposits. Once the full verification is available, users holding any of the 10 listed cryptocurrencies will be able to confirm that their holdings are backed by reserves at a ratio of at least 1:1. The cryptocurrencies are Bitcoin, Ethereum, Tether (USDT), BNB, Solana, USDC, XRP, USD1, RLUSD and ZEC.
According to Binance, the first phase will begin Sunday morning and include Bitcoin, Ethereum, BNB, Solana, XRP, Dogecoin and other cryptocurrencies. In a statement posted on X on Saturday night, the company said the remaining 5% consists of less liquid assets, which may take longer to acquire in the necessary quantities.
Earlier Saturday, when the company had replaced 90% of the stolen assets, Richard Teng, one of Binance's two co-CEOs, wrote on X: "We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident."
The FBI announced that TraderTraitor, a North Korean state-sponsored hacking group, was responsible for the attack. According to the agency, law enforcement officials tracked members of the group as they converted the stolen assets into Ethereum. The FBI added that it expected "further laundering" of the assets using related technology.
Pyongyang has denied for years that it uses state-linked cyber units for espionage, financial theft and revenue generation. Its diplomatic mission in Geneva and its embassy in China did not respond to requests for comment.
Two major blockchain analysis firms, TRM Labs and Chainalysis, also linked the attack to TraderTraitor, a North Korean hacking unit associated with the Lazarus Group. Both expressed high confidence in their findings, citing intelligence and similarities to previous attacks.
Bitcoin; hackers carried out a 'sophisticated attack'
(Photo: AI-generated image)
Experts accuse Kim Jong Un's government of relying on cybercrime to finance its operations. North Korea is one of the poorest countries in the world, and internet access there is severely restricted. Most of its hacking activity is financially motivated.
In 2025, the FBI determined that North Korea was responsible for the theft of $1.5 billion from cryptocurrency exchange Bybit. Following that breach, the FBI reported that TraderTraitor had rapidly laundered and dispersed the stolen assets, converting them into Bitcoin and other digital assets with the ultimate aim of exchanging them for hard currency. North Korean hackers are also suspected of stealing $620 million worth of cryptocurrency in 2022.
North Korea's most notorious cyberattack, although not financially motivated, took place in 2014 against Sony Pictures. The studio had produced the Hollywood film "The Interview," whose plot centers on an assassination attempt against Kim. The hack exposed thousands of embarrassing emails exchanged by senior studio executives.
According to reports, North Korea has systematically developed its cyber capabilities. It recruits the most promising university students and assigns them to hacking groups overseen by its intelligence service. Analyses by technology companies indicate that some of its cyberwarfare operations are conducted across the border in China.
Teng said Friday that the breach was a "sophisticated attack." He said it involved a compromised laptop and malicious software designed to erase traces of the hackers' activity, making the attack more difficult to track and investigate.
The company initially suspected that a compromised engineer's laptop had enabled unauthorized withdrawals, but later discovered that the attack was more extensive. "The initial investigation indicated that the security incident may have been related to a compromised laptop; however, the subsequent investigation uncovered additional points of entry," Binance said in a statement.
North Korean operatives are suspected of using special access privileges to turn one of Binance's "hot wallets" — a cryptocurrency wallet connected to the internet — into a wallet that automatically transferred funds to the attacker.
According to TRM Labs, the attacker likely gained the ability to authorize transactions through Binance's hot-wallet signing system. Chainalysis said the attackers used "never-seen-before laundering patterns," apparently relying on automated transactions to conceal the movement of stolen funds.
Experts believe the rise of artificial intelligence has given criminals new ways to operate, including through automation and other methods. They say AI was likely also used in this case to penetrate the systems.
Following the breach, the exchange suspended customer withdrawals. Binance said it had internally allocated approximately $6.34 billion in company funds to cover the losses.