Binance, the world’s largest cryptocurrency exchange, has announced that it has successfully replaced 90 percent of the $6.3 billion (£4.7 billion) in digital assets stolen during a catastrophic cyberattack on Thursday. To ensure that individual platform users do not suffer financial losses from the unprecedented breach, the company confirmed that it has set aside more than $6.34 billion in internal corporate reserves and company funds. The massive allocation is intended to fulfill Binance’s standing pledge to fully cover 100 percent of all losses resulting from what is now recognized as the largest cyber heist in cryptocurrency history.
In an official public statement released on Saturday, the trading venue sought to directly reassure its global customer base regarding the safety of their holdings and the financial stability of the platform. "Binance will absorb the financial impact of these stolen funds, not our users," the company stated, emphasizing that customer account balances would remain protected. While nine-tenths of the stolen assets have already been restored within the system, Binance acknowledged that sourcing the remaining 10 percent in the exact required cryptocurrency denominations may take additional time due to liquidity conditions and the sheer volume of assets required.
Following the immediate security lock down that halted activity across the exchange immediately after the intrusion was detected, Binance issued an operational update on Sunday confirming that asset withdrawals have been successfully restored across several of its underlying blockchain networks. The platform had previously announced that user withdrawals would be brought back online through a controlled, phased rollout to maintain technical security and system stability while recovery procedures were executed.
To replenish the compromised account balances, Binance drew heavily upon its internal reserves alongside its corporate treasury. The exchange confirmed that user holdings in major digital currencies—specifically including Bitcoin, Ethereum, and the fiat-pegged stablecoin Tether—have been completely covered. Beyond these prominent digital assets, Binance confirmed that seven other widely traded cryptocurrencies impacted during the cyberattack have also been fully reimbursed using the company’s dedicated capital funds.
The unprecedented intrusion has sent shockwaves through the global financial technology sector as details regarding the execution of the breach continue to emerge. Binance’s initial internal investigation suggested that the attack began after an engineer’s work laptop was compromised, granting unauthorized access that enabled the hackers to initiate massive capital transfers. However, as internal cybersecurity teams and digital forensic investigators conducted a broader audit of the exchange’s infrastructure, Binance issued a subsequent technical update admitting that investigators had uncovered "additional points of breach" beyond the single compromised device, signaling a far more complex penetration than initially recognized.
Providing further insight into the technical nature of the incident, Richard Teng, the co-chief executive officer of Binance, publicly disclosed that the heist was carried out by a coordinated group of perpetrators rather than a single rogue hacker. Teng stated that the attackers utilized highly sophisticated, advanced methods to obscure their digital tracks and delay forensic tracking. Among these evasive techniques was the deployment of an embedded "self-destruct mechanism," which the perpetrators triggered during the operation to erase digital footprints and hinder post-incident investigation efforts.
Despite the advanced countermeasures used by the perpetrators, swift containment operations initiated immediately after the intrusion managed to lock down a substantial portion of the stolen funds. Binance confirmed on Friday that it had succeeded in freezing approximately $3 billion of the stolen digital assets. The company noted that this multi-billion-dollar mitigation was achieved through direct collaboration with international law enforcement authorities, specialized blockchain intelligence firms, and key industry partners across the broader crypto ecosystem.
The multi-agency investigation into the record-breaking theft remains active and fluid. On Friday, the United States Secret Service confirmed its active involvement in the law enforcement response, stating that its agents and specialists are "working around the clock" alongside private sector partners. The Secret Service confirmed that its efforts are focused on intensive operations to identify, freeze, trace, and recover the remaining billions in capital that were illicitly siphoned from Binance’s platform.
As investigators trace the movement of the stolen assets across digital ledger networks, official law enforcement attribution has focused directly on state-sponsored cyber actors. On Saturday, the Federal Bureau of Investigation (FBI) formally declared that North Korea was responsible for the massive cyberattack. Federal agents reported observing the hackers actively converting the stolen funds into Ethereum, a major decentralized cryptocurrency, as part of an initial laundering phase.
The FBI stated that it expects the perpetrators to further obscure the digital paper trail by transferring the converted Ethereum through decentralized finance (DeFi) protocols and instant swap services. These automated platforms allow users to trade digital tokens without central intermediaries or traditional identification checks, presenting significant hurdles for law enforcement attempts to monitor, trace, or freeze illicit financial flows once they enter non-custodial channels.
The FBI specifically named the North Korean state-backed hacking unit known as the Lazarus Group—also tracked by international security agencies under the alias TraderTraitor—as the specific culprit behind the intrusion. This formal attribution by US authorities aligns with evidence gathered by private security analysts. Two blockchain analytics firms previously told the BBC that they possessed robust intelligence pointing directly to the Lazarus Group as the primary entity responsible for executing the attack on Binance.
However, senior political leadership in Washington offered a more cautious public assessment regarding definitive responsibility. Speaking to reporters on Saturday night, United States President Donald Trump noted that federal authorities were still actively gathering and evaluating information surrounding the massive cyberattack. "We’re learning about it. We don’t know if it’s North Korea – but if it is, we’ll talk to North Korea about it," President Trump said, indicating that diplomatic or strategic engagements could follow if official intelligence conclusively verifies Pyongyang’s involvement. For its part, North Korea has consistently denied all allegations of involvement in international cyberattacks, digital bank heists, or financial breaches.
The historical magnitude of Thursday’s attack dramatically surpasses all previous security incidents recorded in the digital asset sector. Prior to this event, the largest cryptocurrency heist on record occurred in 2025, when hackers compromised the Bybit exchange and stole $1.5 billion in digital assets. In that previous instance, the FBI similarly concluded that North Korean state-sponsored hackers were responsible, reflecting an ongoing pattern of high-value cyber operations directed against global digital asset infrastructure.
The incident underscores the scale and systemic importance of major centralized cryptocurrency platforms within the broader financial ecosystem. Cryptocurrencies are purely digital assets that have no physical form and exist entirely as software data accessible through digital wallets or computing equipment. Founded in China in 2017, Binance has expanded over the years to become the dominant global infrastructure provider for digital assets, facilitating trading, buying, and selling operations for an estimated hundreds of millions of users worldwide.
By deploying more than $6.34 billion from its corporate treasury to protect its user base, Binance has demonstrated an unprecedented financial capacity to absorb massive operational shocks that could otherwise destabilize digital asset markets. As the company continues its phased work to restore full platform services and source the remaining 10 percent of missing user balances, global law enforcement agencies, security firms, and forensic analysts remain engaged in an ongoing international operation to track, isolate, and recover the remaining billions stolen in the record heist.