Binance said Saturday it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a record crypto theft announced Thursday.
Separately, the FBI said late Saturday it has determined North Korea was responsible for the theft.
Binance said it will continue to buy the remaining relevant token assets through market and over-the-counter channels until the covered amount reaches 100% for all tokens.
“All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement. “Binance will absorb the financial impact of these stolen funds, not our users.”
The exchange said the outstanding 10% consists of tokens outside its top 10 that are “less liquid, which means they may take longer to source in the required amounts.”
Binance said it is tapping its Secure Asset Fund for Users, or SAFU, a portion of its Futures insurance fund, and its corporate treasury to replenish the assets.
“Our commitment remains the same: Binance will fully cover the financial impact of the funds stolen in this incident. We will continue to demonstrate this commitment through measurable progress, transparent reporting, and concrete actions,” Binance said.
The exchange said its “next milestone” will be resuming withdrawal services for users by Sunday, subject to security checks, while it continues its investigation into the attack.
It still isn’t clear how the attack, the largest crypto theft on record, took place.
The world’s largest crypto exchange initially said the hack may have involved “a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” However, Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer’s permissions.
The FBI said malicious North Korean actors laundered Binance’s stolen assets by converting them into Ethereum. The agency said it expects the thieves will continue converting the digital assets as they prepare them for “further laundering stages.”
TRM Labs, a blockchain intelligence and AI investigations company, had initially pointed to North Korean hackers as the culprits.
“Several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst,” the company said.
