Skip to content

Cybercrime

Binance says it replaced 90% of $6.3 billion stolen in record heist

The exchange will cover the remaining 10% directly and resume withdrawals Sunday.

https://breach-signal.com/cybercrime/binance-replaces-90-6-3-billion-stolen/

Share

Binance said it replaced 90% of the $6.3 billion stolen in the record crypto heist and will cover the remaining 10% directly, Yahoo! Finance reported. Co-CEO Richard Teng made the announcement on X. Binance also said customers can resume withdrawals Sunday. <||>

The company bought roughly $5.7 billion in cryptocurrency through markets and private brokers Saturday morning to replenish the stolen assets, the report said. Teng wrote, “We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%,” Yahoo! Finance reported. The purchases came after the exchange determined its own reserves were not enough. <||>

Binance first disclosed the breach Thursday at approximately 4 p.m., initially blaming a compromised employee laptop, Yahoo! Finance reported. The exchange later said the attack extended beyond a single device and involved a broader scope. The company has since moved to restore customer access, with withdrawals set to resume Sunday. <||>

Security analysts tied the heist to TraderTraitor, a North Korean group they described as the likely perpetrator, according to Yahoo! Finance. Blockchain intelligence firms linked the attack to the same group. The FBI tied TraderTraitor to a $1.5 billion theft at Bybit in 2025, the report noted. <||>

Binance drew on its Futures Insurance Fund, a reserve the exchange normally uses to guard against market volatility, as part of its response to the theft. Yahoo! Finance reported the exchange’s existing $1 billion emergency fund was not large enough to cover the attack. The report said the theft’s scale pushed the company to use reserves beyond their standard purpose. <||>

Elliptic estimated that hackers moved roughly $786 million into currencies that are hard to trace. On Friday, Ari Redbord of TRM Labs said North Korean hackers probably use stolen cryptocurrency to pay for the country’s weapons program. Stablecoin issuers tried to freeze some of the assets. <||>

Was this helpful?

Join the discussion

Please read our Comment Policy before commenting. First-time comments are held for moderation. By posting a comment you agree to our Terms of Use and Privacy Policy, which explain how your name, email address and comment are used.

Your email address will not be published. Required fields are marked *