Crypto firm Binance says it has covered 90 percent of losses from the multibillion-dollar hack.
Published On 1 Nov 2026
The FBI has linked North Korea to the theft of a record $6.3 bn in virtual assets from the cryptocurrency exchange Binance.
North Korean actors were observed laundering the stolen funds mainly by converting them into Ethereum, according to an FBI statement released on Saturday.
The U.S. agency said the operation was carried out by the group TraderTraitor, the same cohort blamed for a $1.5 bn theft from the Bybit platform in February of last year.
Officials expect the stolen assets to undergo further staged laundering.
The FBI urged virtual‑asset service providers to block transactions linked to the ongoing laundering effort and provided suspected digital addresses for monitoring.
In a separate statement on Saturday, Binance reported that it has replaced 90 percent of the stolen amount using company funds to purchase new tokens.
The remaining 10 percent consists of less liquid tokens, which may require additional time to liquidate, the exchange added.
“We will continue to buy the remaining relevant token assets… until the covered amount reaches 100 percent for all tokens. Binance will absorb the financial impact of these stolen funds, not our users,” the company said on X.
The cost of repurchasing the tokens was drawn from Binance’s $1 bn Secure Asset Fund for Users (SAFU), a Bitcoin reserve intended to protect customers during security breaches, as well as from its Futures Insurance Fund and corporate treasury.
Crypto prices fell on Friday as Binance, operator of the world’s largest exchange, worked to assure customers that their holdings remained safe.
Co‑CEO Richard Teng described the breach as a “complex attack” that involved a compromised laptop and malicious software designed to delete evidence, complicating investigation.
Following the incident, Binance halted customer withdrawals.
The exchange later confirmed it was on track to resume withdrawals on Sunday.
Binance also released a new proof‑of‑reserves snapshot, enabling users to independently verify that their assets are backed at a minimum 1:1 ratio.
