Binance says it has covered 95% of $6.3B North Korean crypto hack

Cryptocurrency exchange Binance said Monday that it had secured assets covering about 95% of the $6.3 billion in digital currencies stolen in a record-breaking hack attributed to North Korean hackers, The Washington Post reported.

The theft, which took place Thursday, is the largest cryptocurrency hack in history and has prompted Binance to reassure users that their funds will be fully covered through a combination of the company's assets, an insurance fund and a $1 billion strategic bitcoin reserve.

Binance's former CEO, Changpeng Zhao, also sought to reassure customers as the exchange resumed withdrawals following a temporary pause.

"Trust isn't earned by what you say in good times. It's earned by what you do in hard times," Zhao wrote on US social media company X on Sunday.

Zhao stepped down as Binance CEO in 2023 after pleading guilty in the US to violating criminal anti-money laundering requirements. He was later pardoned by President Donald Trump and remains Binance's largest shareholder.

Despite Binance's assurances, users withdrew billions of dollars from the platform. The exchange recorded a net outflow of $3.6 billion during the first nine hours after withdrawals resumed, equivalent to about 2% of the $171 billion in assets it manages.

Binance operates as an exchange and custodian where users can trade digital assets such as bitcoin and hold them on the platform.

The stolen assets included a range of cryptocurrencies, including stablecoins, digital tokens typically designed to maintain a value pegged to the US dollar and backed by assets held by their issuers.

Stablecoin companies froze about $3 billion of the affected funds after the breach, preventing the hackers from moving or laundering those assets further.

Binance also bought back various cryptocurrencies on the open market and published evidence based on cryptographically verified internal records and transactions recorded on the public blockchain.

The FBI and independent analysts have attributed the attack to TraderTraitor, a North Korean state-linked hacking group that has been associated with several major cryptocurrency thefts.

Cryptocurrency exchanges have frequently been targeted by North Korean hackers, with some platforms unable to fully compensate users for their losses. Indian exchange WazirX, for example, lost about $234 million, nearly half of its assets, in a 2024 hack and subsequently underwent restructuring.

Binance, the world's largest cryptocurrency exchange, has sufficient assets to cover the losses. However, the cryptocurrency industry remains largely unregulated compared with traditional financial institutions and lacks protections such as government-backed deposit insurance available to bank customers.

Much of the analysis of the Binance attack has been conducted by cybersecurity and blockchain firms tracking the movement of funds through the public blockchain.

Security firms Elliptic and Chainalysis said the attackers appeared to have moved the stolen funds between multiple wallets in an automated manner, based on the speed and timing of transactions. Some activity continued overnight in Pyongyang.

However, Elliptic researcher Tom Robinson said some transactions appeared to involve human decision-making, including small test transfers made before larger amounts were moved.

The hack has also raised questions about whether artificial intelligence could be used to identify and exploit vulnerabilities in financial systems, although there is currently no clear evidence that AI was used in the Binance attack.

The incident has renewed criticism of the cryptocurrency sector's security and regulatory safeguards, while some industry executives said the attack could lead to stronger protections.