Binance Covers 90% of $6.3 Billion Hack Shortfall as FBI Blames North Korean Group

• Binance has covered approximately 90% of the shortfall from the $6.3 billion hack that occurred on Thursday.
• The FBI confirmed a North Korea-sponsored entity was responsible for the heist.
• Withdrawals on the crypto platform have resumed.
• OKX’s CEO is calling for a unified rapid-response system across crypto exchanges and stablecoin issuers.

Binance, the world’s largest cryptocurrency exchange by trading volume, has made substantial progress in covering the deficit caused by the $6.3 billion hacking incident on Thursday. At the same time, the United States’ Federal Bureau of Investigation (FBI) has gathered strong evidence linking a notorious North Korean entity to the attack.

Binance Replenishes 90% of Shortfall Using Reserves

The cryptocurrency industry was shaken once again by a major security breach at a leading exchange. This time, attackers penetrated the defenses of Binance, the largest player in the digital asset sector.

The incident drained $6.3 billion in crypto assets across ten blockchains, including Bitcoin (BTC), Ethereum (ETH), XRP Ledger (XRP), Solana (SOL), Tron (TRX), Avalanche (AVAX), and Polygon (POL). A swift, coordinated response among major industry participants resulted in the freezing of nearly half of the stolen assets.

As of its Sunday update, the exchange has covered roughly 90% of the affected amount. According to former CEO and major investor Changpeng “CZ” Zhao, Binance closed the gap using approximately $1 billion from its SAFU (Secure Asset Fund for Users) program, part of the Futures insurance fund, and corporate treasury funds.

This does not mean Binance has recovered the stolen funds themselves. Additionally, roughly $3 billion in assets frozen by blockchain partners remains pending recovery.

Nevertheless, Binance’s leadership—co-CEOs Richard Teng and Yi He—committed to covering the remaining 10%. Initial discussions included selling about $1 billion in SpaceX (SPCX) shares after executives, including CZ, took exception to Elon Musk’s mocking remarks following the exploit. Leadership later abandoned that idea.

Withdrawals Resume

Binance’s Proof of Reserves (PoR) indicates that all assets on affected chains maintain at least a 100% reserve ratio. The exchange began processing withdrawals in phases at 6:00 UTC on Sunday, starting with 15 supported networks.

As expected, the platform experienced a surge in withdrawals that eventually stabilized. Between that period and 15:00 UTC, it processed $4.649 billion in withdrawals. Deposits during the same timeframe totaled $1.01 billion, resulting in a net outflow of approximately $3.64 billion.

The company stated it will continue rigorously testing its networks and assets while providing regular customer updates. It also confirmed that market conditions remain stable.

FBI Blames North Korean Hacking Entity

Speculation swirled that a North Korea-backed group was behind the Binance breach. CNN was among the first to report the allegations, even as representatives for Pyongyang at a United Nations (UN) mission dismissed them.

Over the weekend, the FBI confirmed public suspicions, attributing the largest crypto exploit in history to a North Korean state-sponsored group. The agency identified the “TraderTraitor” entity, which operates under the Lazarus Group and is directed by North Korea’s Reconnaissance General Bureau (RGB), its intelligence agency.

The FBI’s cyber division, working alongside the U.S. Secret Service (USSS) and IRS Criminal Investigation (IRS-CI), found that TraderTraitor actors converted stolen assets primarily into Ethereum. Authorities expect the group to launder the proceeds further through decentralized finance (DeFi) platforms and instant swap services to obscure their trail.

U.S. authorities called on the private sector—particularly THORNode operators on THORChain (RUNE), RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers (VASPs)—to block transactions tied to the Binance hack and all TraderTraitor activity.

What Other Exchanges Are Doing After the $6.3 Billion Binance Hack

In response to the incident, stablecoin issuers such as Tether (USDT) and Circle (USDC) played a significant role in freezing a substantial portion of the $6.3 billion heist. Rival exchanges, including Coinbase, OKX, Kraken, and others, coordinated closely with Binance’s management and recovery teams.

As a precaution, crypto platforms have begun auditing their security systems and tightening cold-storage controls to protect customer funds. Notably, OKX CEO Star Xu—an outspoken Binance critic—praised those who assisted during the incident. He stressed that the situation highlights the need for a real-time alert system enabling digital asset participants to share information immediately after a hack.

Xu explained that his platform would help coordinate a rapid response and temporarily freeze suspected stolen funds before bad actors can launder them beyond recovery. He argued that speed is essential, and the industry needs standardized protocols, clear responsibilities, and appropriate safeguards so participants can act within minutes of an attack, not hours or days.

Despite intense competition in Web3 and crypto, Xu emphasized that protecting users and their assets must come first and should be a shared responsibility across the entire industry, not just individual platforms.

Source link