Binance covers 95% of $6.3 billion North Korean heist losses

Binance has replaced 95% of the $6.3 billion in digital assets stolen in a security breach attributed to a North Korean state unit. The world’s largest cryptocurrency exchange resumed online service Monday, reporting that customers withdrew $3.64 billion, or 2.1% of total assets, following the incident.

The theft occurred in late Thursday, unfolding over roughly 20 minutes. The FBI announced on Saturday that the North Korean group TraderTraitor was responsible. Law enforcement observed the unit converting stolen assets into ether and expects further laundering through related technology. The exchange moved to stabilize the market, stating that withdrawal volumes had settled after an initial spike and deposit volumes remained substantial.

Binance has set aside approximately $6.34 billion in company funds to cover the losses. Co-CEO Yi He confirmed the company will use 50% of its Secure Asset Fund for Users (SAFU), a $1 billion bitcoin reserve, along with portions of its Futures Insurance Fund and corporate treasury. She stated the company committed to replenishing the SAFU fund to its original level. He warned that new scams had emerged in the days following the breach.

Market conditions showed signs of recovery over the weekend. Bitcoin, which hit a six-week low on Friday, traded above $78,000 on Monday. Ether, which reached a two-month low on Friday, recovered to $2,287. The combined market capitalization of USDT and USDC, the two largest stablecoins, dropped by about $1.2 billion since Friday, according to Coinmarketcap.com.

Binance is rolling out withdrawals in phases based on user demand data from the past week. The first phase covers 15 tokens, including bitcoin, ether, dogecoin, and specific USDC and USDT stablecoins. The company said the remaining 5% of stolen assets consist of less liquid tokens that may take longer to source. A spokesperson noted that net outflows reflect both withdrawals and deposits, clarifying that earlier data from the analytics platform DefiLlama did not account for flows to new hot wallets.

Ari Redbord, global head of policy at TRM Labs, described the withdrawal activity as a precautionary reaction rather than capital flight. The breach adds to a series of recent crypto thefts, with researchers at TRM Labs recording $2.9 billion stolen across nearly 150 incidents last year. Binance serves 335 million registered users globally and reported $171 billion in assets under management as of October 28.

Pyongyang has historically denied using state-linked cyber units for financial theft. Its mission in Geneva and embassy in China did not respond to comment requests. US President Donald Trump said on Saturday that it remained unclear whether North Korea was involved, though he pledged to discuss the matter with the country if confirmed. The exchange said market conditions are stable as it continues to process user requests.