The world's largest cryptocurrency exchange is racing to make its users whole after suffering what appears to be the biggest hack in crypto history. Binance announced Saturday it has already replenished 90% of the $6.3bn (£4.7bn) in digital assets stolen in a Thursday breach — and has pledged to cover every last dollar of the losses itself.
The remaining 10% of stolen assets may take longer to source in the required amounts, the company acknowledged. Still, Binance has set aside more than $6.34bn in company funds to back that promise, drawing from various internal funds and its own corporate treasury.
"Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement released Saturday.
All holdings in bitcoin, ethereum, and Tether are now covered, along with seven other widely-traded crypto assets. Binance said its immediate priority is restoring withdrawal services, with the company stating it remained on track to reopen withdrawals on Sunday, November 1, pending final confirmation.
FBI Names North Korea's Lazarus Group
On the same day Binance issued its recovery update, the Federal Bureau of Investigation (FBI) publicly attributed the attack to North Korea. Specifically, the FBI named the Lazarus Group — also tracked under the alias TraderTraitor — as the perpetrators. Two independent analytics firms had earlier told the BBC they held intelligence pointing to the same North Korean state-backed unit before the FBI's formal attribution.
North Korea has consistently denied involvement in cyberattacks of this nature.
The scale of Thursday's breach is staggering. It eclipses the previous record — a $1.5bn heist on the Bybit exchange in 2025 — which the FBI also blamed on North Korea. If confirmed, the Binance hack stands as the single largest theft in the history of cryptocurrency, a sector that is no stranger to high-profile security breaches.
Sophisticated Attack, Multiple Breach Points
Binance's early investigation suggested the attack began when an engineer's laptop was compromised, giving hackers a foothold to authorise withdrawals. But a later update revealed the team had uncovered "additional points of breach" beyond that initial entry.
Richard Teng, Binance's co-chief executive officer, confirmed the hack was carried out by more than one person. He said the attackers used sophisticated techniques to cover their tracks, including what he described as a "self-destruct mechanism" designed to erase evidence.
The US Secret Service said Friday it is "working around the clock" alongside private sector partners to identify, freeze, trace, and recover funds stolen from Binance. The investigation remains ongoing.
What It Means for Binance Users
Founded in China in 2017, Binance has grown into a platform estimated to serve hundreds of millions of users worldwide. It allows them to buy, sell, and trade a wide range of digital assets. The fact that the exchange is absorbing the full financial hit — rather than passing losses to customers through a haircut or socialised loss mechanism — is a significant commitment at this scale.
The broader crypto industry will be watching closely. Incidents like this put intense pressure on exchanges to demonstrate they can handle catastrophic security failures without destroying user trust. For anyone tracking developments in emerging digital asset technology, the Binance hack is a reminder of just how high the stakes have become.
Binance has said it will provide a further update once withdrawal resumption details are confirmed.