Binance has announced it has covered approximately 90% of the $6.3 billion in token assets stolen in a recent record-setting hack and plans to resume withdrawals by Sunday. The cryptocurrency giant is utilizing its SAFU fund, Futures insurance fund, and corporate treasury to absorb the financial impact. Separately, the FBI has identified North Korean malicious actors as responsible for the sophisticated cyberattack, which involved laundering stolen assets into Ethereum.
Binance, the world's largest cryptocurrency exchange, announced Saturday that it has successfully covered approximately 90% of the massive $6.3 billion in token assets stolen from its hot wallets in a record-breaking crypto theft that shook the market on Thursday. This significant recovery effort comes as the exchange aims to restore withdrawal services for its users by Sunday, pending final security validations.
Adding a critical dimension to the unfolding saga, the Federal Bureau of Investigation (FBI) confirmed late Saturday that it has identified North Korean malicious actors as being responsible for the sophisticated cyberattack.
Binance assured its users that it is committed to fully replenishing the stolen funds. "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," the company stated in an official announcement. "Binance will absorb the financial impact of these stolen funds, not our users." The exchange further clarified that it continues to acquire the remaining 10% of affected tokens, primarily less liquid assets outside its top 10, through market and over-the-counter channels to ensure complete restoration.
To back the compromised assets, Binance has leveraged its Secure Asset Fund for Users (SAFU), a dedicated portion of its Futures insurance fund, and its substantial corporate treasury. The company reiterated its steadfast commitment: "Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions."
The incident, marking the largest crypto theft on record, has prompted intense scrutiny into blockchain security. While initial reports hinted at a compromised DevOps engineer's laptop, Binance Co-CEO Richard Teng later indicated that the attack involved a much more intricate process than a simple misuse of permissions, suggesting a highly sophisticated operation.
North Korea Linked to Historic Crypto Heist
The FBI's announcement detailed that malicious North Korean actors laundered the stolen Binance assets by converting them into Ethereum, a common tactic to obscure the funds' origins before subsequent laundering stages. This assessment aligns with earlier suspicions raised by blockchain intelligence firm TRM Labs, which had initially pointed towards North Korean hackers.
TRM Labs highlighted several similarities between this incident and previous North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026. These patterns include the use of small Tornado Cash withdrawals to fund operator wallets, pre-theft staging, and the execution of pre-obtained signatures in a rapid burst.
Binance has declined to provide further details on its ongoing investigation, referring all inquiries to its latest public statements.
Visualizing the scale of the incident:
For a deeper dive into the implications and Binance's response, watch this CNBC report:
— Contributions from Jenny Lee, Liz Napolitano and Davis Giangiulio.
