Key Takeaways
- • Binance said Monday it has obtained assets to cover about 95 percent of the $6.3 billion in digital currencies stolen in a heist attributed to North Korean hackers, which the Washington Post described as the biggest crypto hack in history.
- • Binance reported a net outflow of $3.6 billion in the first nine hours of withdrawals, about 2 percent of the $171 billion in assets it manages.
- • Binance says recovery will come from a combination of its own assets, an insurance fund and a strategic bitcoin reserve of $1 billion, while stablecoin issuers froze about $3 billion in affected funds.
- • The FBI and third-party analysts attribute the attack to North Korean state group TraderTraitor, which has been linked to previous record crypto hacks.
- • The incident underscores the lack of deposit-insurance-style safeguards in crypto exchanges, even as Binance, the world's largest crypto exchange, has the balance sheet to absorb the losses.
Summary
Cryptocurrency exchange Binance said Monday that it had obtained assets to cover about 95 percent of the $6.3 billion in digital currencies stolen in a heist by North Korean hackers on Thursday, according to the Washington Post. A separate Nikkei Asia report cited a 90 percent coverage figure for the same hack, reflecting the differing dates and figures in early reporting.
In the days since the breach, Binance has sought to reassure users that they will be made whole through a combination of its assets, an insurance fund and a strategic bitcoin reserve of $1 billion. Former CEO Changpeng Zhao, who stepped down in 2023 after pleading guilty to violating U.S. anti-money laundering rules and was later pardoned by President Donald Trump, remains the company's largest shareholder. He posted on X on Sunday, "Trust isn't earned by what you say in good times. It's earned by what you do in hard times," as Binance ended a pause on withdrawals.
Despite these assurances, some users sought to withdraw funds. Binance recorded a net outflow of $3.6 billion in the first nine hours of withdrawals, roughly 2 percent of the $171 billion in assets it manages. The stolen funds included a variety of cryptocurrencies, among them stablecoins. After the breach, stablecoin companies froze about $3 billion in affected funds, limiting the hackers' ability to launder them. Binance also bought back a range of cryptocurrencies in the market and published proof based on cryptographically verified internal records and the public blockchain.
The FBI and third-party analysts have attributed the attack to TraderTraitor, a North Korean state-linked group previously tied to record crypto hacks. Blockchain security firms Elliptic and Chainalysis observed that the funds were shuffled across wallets in apparently automated fashion, though Elliptic researcher Tom Robinson noted human-like steps such as small test transactions before larger moves. Reporting also notes that it is unclear whether the hackers used artificial intelligence.
The Washington Post noted that prior exchange hacks by North Korean actors have not always been followed by full repayment; WazirX, the Indian exchange hacked in 2024 for about $234 million, was unable to fully cover its losses and underwent a restructuring. Binance, by contrast, has the financial capacity to absorb the losses, but the episode highlights that crypto remains largely unregulated and lacks safeguards such as deposit insurance. Blockaid CEO Ido Ben-Natan said the industry would be hardened by the attack.
In the days since the breach, Binance has sought to reassure users that they will be made whole through a combination of its assets, an insurance fund and a strategic bitcoin reserve of $1 billion. Former CEO Changpeng Zhao, who stepped down in 2023 after pleading guilty to violating U.S. anti-money laundering rules and was later pardoned by President Donald Trump, remains the company's largest shareholder. He posted on X on Sunday, "Trust isn't earned by what you say in good times. It's earned by what you do in hard times," as Binance ended a pause on withdrawals.
Despite these assurances, some users sought to withdraw funds. Binance recorded a net outflow of $3.6 billion in the first nine hours of withdrawals, roughly 2 percent of the $171 billion in assets it manages. The stolen funds included a variety of cryptocurrencies, among them stablecoins. After the breach, stablecoin companies froze about $3 billion in affected funds, limiting the hackers' ability to launder them. Binance also bought back a range of cryptocurrencies in the market and published proof based on cryptographically verified internal records and the public blockchain.
The FBI and third-party analysts have attributed the attack to TraderTraitor, a North Korean state-linked group previously tied to record crypto hacks. Blockchain security firms Elliptic and Chainalysis observed that the funds were shuffled across wallets in apparently automated fashion, though Elliptic researcher Tom Robinson noted human-like steps such as small test transactions before larger moves. Reporting also notes that it is unclear whether the hackers used artificial intelligence.
The Washington Post noted that prior exchange hacks by North Korean actors have not always been followed by full repayment; WazirX, the Indian exchange hacked in 2024 for about $234 million, was unable to fully cover its losses and underwent a restructuring. Binance, by contrast, has the financial capacity to absorb the losses, but the episode highlights that crypto remains largely unregulated and lacks safeguards such as deposit insurance. Blockaid CEO Ido Ben-Natan said the industry would be hardened by the attack.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.