Binance says it has covered 90% of $6.3bn stolen in hack the FBI attributes to North Korea

Binance, the world's biggest cryptocurrency exchange, says it has replaced nine-tenths of the roughly $6.3 billion in digital assets stolen from it on Thursday, BBC News reported. On Saturday, the FBI said North Korea was behind the attack.

According to the BBC, the theft is suspected to be the largest ever recorded in the crypto industry. It is more than four times the size of the $1.5 billion Bybit exchange hack in 2025, which the FBI also blamed on North Korea. Pyongyang has consistently denied a role in such attacks, the BBC noted.

Both outlets reported that Binance has pledged to make customers whole and has reserved more than $6.34 billion of its own money to do it.

The company told the BBC it drew on several funds as well as its corporate treasury to restore what was taken. Customers' bitcoin, ethereum and Tether have been fully replaced, Binance said, and so have seven other popular tokens. Gathering enough of the assets to cover the last tenth may take more time, the company added.

Binance also said that, working with police and blockchain partners, it had frozen around $3 billion of the stolen money. The BBC reported that the US Secret Service is assisting efforts to track and recover the funds.

The FBI's finding came after analytics firms had pointed in the same direction. PBS NewsHour, carrying an Associated Press report, said the firm TRM attributed the hack with high confidence to TraderTraitor, a North Korean hacking group. TRM said roughly $6.36 billion left Binance wallets across ten blockchains, the bulk of it in about 20 minutes. The head of Chainalysis reached a similar view, PBS reported.

Speaking with reporters at the White House on Friday, President Donald Trump said US officials were looking into the hack. On whether North Korea was involved, he said: "We're looking at that," according to PBS.

Both outlets said Binance initially linked the breach to an engineer's compromised laptop, then later disclosed it had found other entry points.

Co-chief executive Richard Teng said the attack was the work of several people who used advanced techniques, among them a self-destruct feature that has complicated the inquiry. He confirmed that one of the exchange's internet-connected hot wallets was hit, while saying most customer holdings sit in offline cold storage.

"We are working nonstop to resolve this," Teng said in a video on X, PBS reported.

The outlets gave slightly different timing for restoring withdrawals, which have been paused. PBS said deposits were not affected and that withdrawals were expected back within a day or two. The BBC said Binance still planned to restart them on Sunday, 1 November, with more details to follow.

Independent analyst Garrick Hileman told PBS there is evidence the attackers have already begun moving and converting some of the funds that were not frozen.

Compiled by True News from reporting by BBC News and PBS NewsHour. Each outlet's original story is linked below.

Originally published by True News: https://truenews.bagleyenterprises.net/stories/654