FBI: North Korea Behind $6.3 Billion Binance Hack; Exchange Says 90% of Stolen Assets Replenished
The FBI said Saturday that North Korea's state-sponsored TraderTraitor hacking unit carried out this week's record $6.3 billion Binance theft, as the exchange said 90% of stolen assets were replenished using company funds and withdrawals remain on track to reopen Sunday.
The FBI said Saturday that North Korea's state-sponsored hacking unit known as TraderTraitor was responsible for this week's record $6.3 billion theft from Binance, as the world's largest cryptocurrency exchange said it has now replenished 90% of the stolen assets using company funds.
Binance said it replaced the tokens by purchasing new ones with corporate money - restoring customer asset backing, not recovering funds from the attacker. The FBI said unit members were observed converting stolen assets into ethereum and that it expects "further laundering" of the funds.
"We've now replenished 90% of the stolen assets, and we're committed to covering the remaining 10%. Our users will not bear the financial impact of this incident," Binance co-CEO Richard Teng said in a statement posted on X. The remaining 10% consists of less-liquid tokens that may take longer to buy.
The replenishment drew on three company sources: part of Binance's $1 billion Secure Asset Fund for Users (SAFU), a portion of its Futures Insurance Fund, and its corporate treasury. The exchange said it has set aside about $6.34 billion of company funds internally to cover the losses.
Binance said it remains on track to reopen withdrawals on Sunday, November 1, "and will provide a further update as soon as details are confirmed." Deposits and withdrawals were paused after the breach, which Teng described Friday as a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity.
The exchange also published a new proof-of-reserves snapshot based on balances as of 00:00 UTC Saturday. Users holding the 10 listed tokens - BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC - will be able to verify their assets are backed at a minimum 1:1 ratio once the full zero-knowledge proof is available, expected by November 3.
The FBI's attribution Saturday makes the breach the largest crypto theft on record, according to The Associated Press. North Korean state hackers have been tied to a series of major crypto thefts in recent years.