Binance says it has replaced 90% of the roughly $6.3 billion in crypto assets stolen in a breach at the world's largest cryptocurrency exchange, as the FBI formally attributed the attack to hackers linked to North Korea.
The exchange said it used more than $6.34 billion of its own corporate funds to buy and reissue tokens matching what was stolen, rather than recovering the original assets, which remain largely in the hackers' control. The remaining 10% of the shortfall is in less-liquid tokens that Binance said will take longer to replace. Separately, the company said it had frozen roughly $3 billion worth of the stolen assets in cooperation with law enforcement and blockchain-intelligence firms, and that customer withdrawals — suspended in the immediate aftermath of the breach — were on track to reopen Sunday.
North Korea attribution, with a presidential hedge
The FBI tied the theft to TraderTraitor, a hacking group that blockchain analytics firms including Chainalysis and TRM Labs have separately linked to North Korea's state intelligence apparatus, a pattern consistent with years of North Korean-linked crypto theft used to help fund the isolated regime. But President Trump, asked directly about the attribution, said "we don't know" whether North Korea was responsible and that the administration was "looking at that" — leaving a gap between the bureau's public attribution and the White House's own characterization of it.
The breach, among the largest in crypto history, is a significant test of Binance's financial cushion and of the broader industry's post-FTX promises around exchange solvency and customer protection. Making customers whole with corporate funds rather than recovered assets preserves user balances in the short term, but it also means Binance is absorbing a multibillion-dollar loss directly — a bet that its balance sheet can weather a hit of this size without disrupting operations. The exchange has not disclosed how the breach itself occurred, leaving open questions about what security gap the hackers exploited and whether other exchanges share the same exposure.
Law enforcement's recovery of the frozen $3 billion will likely take months to resolve through international asset-forfeiture channels, and investigators are expected to publish more technical detail on the intrusion in the coming weeks. For now, the case adds to a growing tally of state-linked crypto heists that blockchain trackers say have funneled well over a billion dollars a year toward North Korea's weapons programs, intensifying pressure on exchanges to harden the custody systems that hold customer funds.
