Cryptocurrency exchange Binance has replaced more than 90% of the $6.3 billion stolen in a record-breaking cyberattack attributed to North Korean hackers, using billions of dollars from its corporate reserves and emergency funds to protect customers from financial losses.
The world’s largest cryptocurrency exchange announced Saturday, October 31, that it had replenished approximately $6 billion in stolen digital assets. By Sunday, November 1, the company reported that its coverage had reached 95%, although the remaining assets were proving more difficult to replace because of limited market liquidity.
How Binance replaced billions in stolen cryptocurrency
According to Reuters and CoinDesk, Binance financed its recovery operation through corporate treasury funds, its Futures Insurance Fund and part of its $1 billion Secure Asset Fund for Users (SAFU), which was established to protect customers during extraordinary security incidents.
The company said it had allocated approximately $6.34 billion to cover the losses and would replenish SAFU to around $1 billion. Its co-chief executive, Richard Teng, assured customers that the platform would absorb the financial impact rather than transfer the losses to account holders.
Binance also collaborated with blockchain investigators and stablecoin issuers, including Tether and Circle, to identify suspicious transactions and prevent stolen assets from being transferred further. Approximately half the stolen funds were rapidly located or frozen, although their identification does not necessarily mean they have been returned to Binance.
The exchange conducted a new snapshot of its reserves on October 31 to demonstrate that holdings in major cryptocurrencies, including Bitcoin, Ethereum and several stablecoins, remained backed by corresponding assets.
Following the temporary suspension of withdrawals, Binance announced plans to resume services Sunday in stages, initially covering 15 cryptocurrencies.
FBI identifies North Korean hackers behind record crypto theft
The cyberattack occurred Thursday, October 29, when hackers transferred approximately $6.36 billion from Binance wallets across 10 blockchain networks, with most transactions completed within about 20 minutes.
According to blockchain intelligence company TRM Labs, the attackers had begun preparing at least 36 hours before the theft. Investigators believe the operation involved compromising an employee’s laptop, gaining unauthorized access to internal systems and deploying malicious software designed to erase evidence.
On Saturday, the FBI formally attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation previously linked to major cryptocurrency thefts. The agency warned that the attackers were converting stolen assets primarily into Ethereum before attempting further laundering through decentralized financial services and cryptocurrency exchanges.
The theft surpassed the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025, another attack attributed to North Korean hackers. Researchers at TRM Labs estimated that hackers stole $2.9 billion across nearly 150 cryptocurrency attacks in 2025, illustrating the continuing security challenges facing the industry.
Binance’s ability to replace most of the stolen assets within days has helped stabilize customer confidence, but investigators have yet to establish how much of the original $6.3 billion can ultimately be recovered.
See all the latest news from Greece and the world at Greekreporter.com. Contact our newsroom to report an update or send your story, photos and videos. Follow GR on Google News and subscribe here to our daily email!
