Binance Backfills 90% of Stolen Assets, Vows Full Compensation
Binance confirmed on Saturday that it has replenished up to 90 percent of the approximately $6.3 billion in digital assets drained from its hot wallets in what has been described as the largest cryptocurrency theft in history. The exchange first disclosed the breach on Thursday, and over the following days it worked to replace the missing holdings.
In a public statement, the exchange listed the specific tokens it has already fully restored: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. Binance emphasized that the financial burden of the incident will fall on the company itself rather than on its customer base.
The exchange added that it will keep purchasing the remaining relevant tokens through open-market buying and over-the-counter arrangements until every affected token is backed at 100 percent. The residual 10 percent gap, according to Binance, involves digital assets that rank outside its top ten by trading volume. Those smaller-cap tokens are significantly less liquid, which the company noted could slow the process of sourcing them in the required quantities.
To fund the replenishment, Binance said it is drawing on its Secure Asset Fund for Users (SAFU), a component of its futures insurance fund, as well as its own corporate treasury. The exchange framed its response as ongoing, stating that it will keep demonstrating its commitment through "measurable progress, transparent reporting, and concrete actions."
Withdrawals Set to Resume Sunday as Investigation Continues
Binance outlined its next operational milestone: restoring the ability for users to withdraw funds by Sunday, contingent on the completion of internal security checks. The exchange stressed that it is still actively investigating how the attack unfolded.
When approached by CNBC for further details on the investigation, Binance declined to provide additional information and directed reporters to its latest public statement.
The exact mechanics of the breach remain unclear. In its initial disclosure, the exchange suggested the intrusion may have begun with a compromised DevOps engineer's laptop, which an attacker allegedly used to access a service container and push unauthorized withdrawal transactions. However, Co-CEO Richard Teng subsequently clarified that the operation was more intricate than the exploitation of a single engineer's credentials, indicating a multi-step process rather than a straightforward permission misuse.
FBI Confirms North Korean Involvement in Largest Crypto Heist
In a separate development, the Federal Bureau of Investigation announced late Saturday that it has concluded North Korean actors were behind the theft. The agency indicated that the perpetrators have already begun laundering the stolen assets by converting them into Ethereum. The FBI further stated it expects the thieves to continue converting the digital holdings as they move them through additional laundering stages.
The attribution aligns with earlier findings from TRM Labs, a blockchain intelligence and AI-driven investigations firm, which had identified North Korean-linked groups as the most likely culprits shortly after the breach was reported.
TRM Labs detailed several operational signatures that matched prior North Korea-associated heists, specifically referencing the Bybit hack and the KelpDAO theft in April 2026. According to the firm, the attack pattern included small withdrawals through Tornado Cash used to fund an operator wallet, preparatory staging that began well before the actual theft, and cryptographic signatures that were obtained in advance and then executed in a single burst.
The convergence of the FBI's determination and TRM Labs' technical analysis has effectively solidified the narrative that a state-linked North Korean hacking operation orchestrated what is now the most significant cryptocurrency theft on record.