Binance says it has covered 90% of $6.3bn stolen assets, FBI blames North Korea

Binance has replaced about nine-tenths of the $6.3 billion in tokens taken from its hot wallets, the exchange said Saturday, according to CNBC Technology. The FBI said late Saturday that it had concluded North Korea was behind the theft, which was announced Thursday and is the biggest crypto heist on record.

The exchange said it will keep purchasing the tokens that remain outstanding through market and over-the-counter channels until every asset is fully covered. Ten major tokens, among them bitcoin, ether, solana and several stablecoins, are already backed in full, Binance said. The company also said users would not bear the cost of the loss.

The remaining tenth involves smaller tokens outside the top ten, which Binance described as harder to trade. It said sourcing those amounts could take longer because the market for them is thinner.

To rebuild reserves, Binance is drawing on its Secure Asset Fund for Users, a slice of the insurance pool tied to its futures business, and company funds. The exchange said it would keep reporting progress and take concrete steps to show it is making good on its pledge to absorb the entire loss.

Its next target is to bring withdrawals back online by Sunday, provided security checks are passed, while investigators continue to examine the breach. Binance declined to give CNBC further detail on the probe and pointed to its public statement.

How the attack was carried out is still unknown. Binance first suggested a compromised laptop belonging to a DevOps engineer may have let an intruder reach a service container and push through unauthorized withdrawals. Co-CEO Richard Teng later said the operation was more elaborate than one employee's credentials being misused.

The FBI said North Korean actors have been moving the stolen assets by swapping them into ether, and the agency expects further conversion as the funds are readied for additional laundering. TRM Labs, a blockchain intelligence firm, had earlier attributed the incident to North Korean hackers. The company said the pattern echoed two earlier episodes, the Bybit breach and the KelpDAO hack in April 2026, citing small Tornado Cash withdrawals that funded an operator wallet, preparation that started long before the theft, and signatures collected ahead of time and used in a single burst.