FBI attributes attack to North Korea; the country denies involvement
Binance, described by BBC News as the world’s largest cryptocurrency exchange, said on Sunday it had covered 90% of the $6.3bn (£4.7bn) in assets stolen in Thursday’s hack. The company said the remaining 10% might take longer to source in the required amounts and that its investigation was ongoing.
The exchange had consistently pledged to cover 100% of the losses from what was suspected to be cryptocurrency’s biggest hack on record and said it had set aside more than $6.34bn in company funds to do so. In a statement on Saturday, Binance said, “Binance will absorb the financial impact of these stolen funds, not our users.” The company said it had replenished the stolen assets using various funds and its own corporate treasury. All holdings of bitcoin, Ethereum and Tether were covered, along with seven other widely-traded crypto assets, Binance said.
In an update on Sunday, Binance said withdrawals had been restored on several of its networks after they were suspended following the hack. Binance had previously said withdrawals would resume in phases.
The FBI said on Saturday that North Korea was responsible for the attack. It said it had observed hackers converting stolen assets into a type of cryptocurrency called Ethereum and expected the assets to be converted again using decentralized finance and instant swap services. Two analytics firms told the BBC they had robust intelligence pointing to the North Korean state-backed hacking unit Lazarus Group, also known as TraderTraitor and specifically named by the FBI, as the likely culprits.
Speaking to reporters on Saturday night, US President Donald Trump said the US was still unsure who the culprits were. “We’re learning about it. We don’t know if it’s North Korea - but if it is, we’ll talk to North Korea about it,” he said. North Korea has always denied involvement in such attacks.
Binance’s initial investigation suggested that an engineer’s laptop had been compromised, allowing unauthorized withdrawals. A later company update said it had uncovered “additional points of breach.” Richard Teng, Binance’s co-chief executive officer, said the hack was carried out by more than one person and that the hackers used sophisticated methods to hide their tracks, including a “self-destruct mechanism.”
On Friday, Binance said it had frozen around $3bn of stolen assets after working with law enforcement, intelligence firms and partners. The investigation was ongoing. The US Secret Service also said on Friday that it was “working around the clock” with private-sector partners to “identify, freeze, trace, and recover funds” stolen from Binance.
The hack was believed to be the largest in cryptocurrency history, eclipsing the record of a $1.5bn heist on the Bybit exchange in 2025. The FBI also said North Korea was responsible for the Bybit theft.
Binance was founded in China in 2017 and lets users buy, sell and trade digital assets. It was estimated to have hundreds of millions of users worldwide.
Crypto is a digital asset that does not exist physically and is accessed through digital wallets or computers.
The unresolved matters included the source of the remaining 10%, the additional breach points, the tracing and recovery of stolen assets, and responsibility for the attack. The FBI had attributed it to North Korea and Lazarus Group, while North Korea denied involvement and Trump said the US remained unsure.