Binance says it has replenished 95% of the cryptocurrency stolen in a $6.3bn cyberattack, while the FBI has attributed the incident to a North Korean state-backed hacking operation.
Binance has replenished 95% of the cryptocurrency stolen in a major cyberattack, the exchange said, as it works to restore withdrawal services following one of the largest reported thefts in the industry's history.
The latest figure, reported by Reuters on Sunday, 1 November, represents an increase from the 90% replenishment level announced a day earlier. Binance said the remaining 5% could take longer to replace because the affected digital tokens are less liquid and harder to source in large quantities.
The company has pledged to cover the financial impact of the theft, saying customers will not be responsible for the missing funds.
Binance previously said it had allocated more than $6.34bn to address the losses. The funds have come from several sources, including its corporate treasury, the Secure Asset Fund for Users (SAFU) and its Futures Insurance Fund.
In an update on 31 October, the exchange said it had fully backed customer holdings across 10 cryptocurrencies, including Bitcoin, Ethereum, Tether, BNB, Solana and XRP. It added that efforts to replenish the remaining assets were continuing through market purchases and over-the-counter transactions.
The FBI links the attack to North Korea.
The US Federal Bureau of Investigation (FBI) said on 31 October that North Korea was behind the theft of more than $6bn in virtual assets from Binance.
The agency identified the operation as TraderTraitor, a cyber campaign associated with North Korean state-backed hackers.
According to the FBI, the attackers converted a significant portion of the stolen cryptocurrency into Ethereum. Investigators warned that the funds could be moved through decentralised finance platforms and cryptocurrency exchange services in an attempt to make them more difficult to trace.
The agency urged cryptocurrency exchanges, blockchain service providers and other digital asset businesses to monitor and block transactions connected to the wallets identified in the investigation.
Two blockchain analytics firms had earlier pointed to the Lazarus Group, a North Korean-linked hacking organisation also associated with the TraderTraitor designation, as a likely suspect.
North Korea has repeatedly denied allegations that it is involved in international cyberattacks.
Investigation reveals further security concerns.
Binance's initial investigation suggested that an engineer's laptop had been compromised, potentially giving attackers a route to carry out unauthorised withdrawals.
However, the company later reported finding additional points of breach, indicating that the incident may have involved more than one compromised access point.
Binance co-chief executive Richard Teng said the attackers had used sophisticated techniques to hide their activities, including mechanisms designed to destroy evidence.
The exchange is working with law enforcement agencies, cybersecurity specialists and industry partners to trace the stolen cryptocurrency and recover as much as possible.
The US Secret Service has also joined the effort. The agency said it was working with private-sector partners to identify, freeze, trace and recover funds linked to the attack.
Binance prepares to restore withdrawals.
Restoring normal withdrawal services remains a key priority for the exchange.
Reuters reported on 1 November that Binance planned to reopen withdrawals in stages, with the initial phase scheduled for between 06:00 and 09:00 GMT.
The phased approach is intended to restore customer access while the company continues working to replace the remaining stolen assets.
Binance has also updated information about its reserves following the incident. The company said customers holding the 10 cryptocurrencies covered by its replenishment measures would be able to check their holdings through its proof-of-reserves system once the updated cryptographic verification was available.
The incident has renewed concerns about the security of major cryptocurrency exchanges and the ability of digital asset platforms to protect customer funds. It also highlights the difficulties investigators face when tracing stolen cryptocurrency across multiple blockchain networks and trading platforms.
