Binance covers 95% of $6.3B North Korean crypto hack

Binance announced Monday it had secured assets covering approximately 95% of the $6.3 billion in digital currencies stolen last Thursday in the largest cryptocurrency breach on record. The exchange said it would fully cover user losses through a combination of corporate assets, an insurance fund, and a $1 billion strategic bitcoin reserve.

Changpeng Zhao, the company's former chief executive who remains its largest shareholder, sought to reassure customers as the platform resumed withdrawals following a temporary suspension. "Trust isn't earned by what you say in good times. It's earned by what you do in hard times," Zhao wrote on X on Sunday, according to The Washington Post.

Withdrawal surge and executive history

Despite these assurances, users withdrew billions of dollars after operations resumed, with the exchange recording a net outflow of $3.6 billion during the first nine hours — equivalent to roughly 2% of the $171 billion in assets under management. Stablecoin issuers separately froze approximately $3 billion of the affected funds, preventing the hackers from moving or laundering those assets further.

Zhao stepped down as Binance CEO in 2023 after pleading guilty in the United States to violating criminal anti-money laundering requirements, though he was later pardoned by President Donald Trump. He purchased various cryptocurrencies on the open market and published evidence based on cryptographically verified internal records and blockchain transactions to substantiate the recovery efforts.

State-linked attribution and analysis

The Federal Bureau of Investigation and independent analysts have attributed the attack to TraderTraitor, a North Korean state-linked hacking group previously associated with several major cryptocurrency thefts. Security firms Elliptic and Chainalysis reported that the attackers moved stolen funds between multiple wallets in an automated manner, with some activity continuing overnight in Pyongyang.

However, Elliptic researcher Tom Robinson noted that certain transactions appeared to involve human decision-making, including small test transfers executed before larger amounts were moved. The incident has renewed criticism of the cryptocurrency sector's lack of government-backed deposit insurance available to traditional banking customers — protections absent from an industry that remains largely unregulated compared with conventional financial institutions.

Industry vulnerabilities

Cryptocurrency exchanges have frequently been targeted by North Korean hackers, with some platforms unable to fully compensate users for their losses. Indian exchange WazirX, for example, lost approximately $234 million — nearly half of its assets — in a 2024 hack and subsequently underwent restructuring, unlike Binance which maintains sufficient reserves to absorb the current breach.

The hack has also raised questions about whether artificial intelligence could be used to identify and exploit vulnerabilities in financial systems, although there is currently no clear evidence that AI was used in the Binance attack. Some industry executives said the incident could lead to stronger protections, according to analysts tracking the movement of funds through the public blockchain.