Binance has secured assets covering approximately 95 percent of the $6.3 billion in digital currencies stolen in what is being described as the largest cryptocurrency hack in history, The Washington Post reported on Monday.
The theft, which occurred on Thursday and has been attributed by the FBI and independent analysts to North Korean-linked hackers, prompted the exchange to reassure customers that their funds would be fully covered through a combination of company assets, an insurance fund and a $1 billion strategic bitcoin reserve.
Binance resumed withdrawals after a temporary suspension, while former CEO Changpeng Zhao also sought to reassure customers.
"Trust isn't earned by what you say in good times. It's earned by what you do in hard times," Zhao wrote on X on Sunday.
Billions withdrawn despite Binance assurances
Despite the exchange's efforts to restore confidence, customers withdrew billions of dollars after withdrawals resumed.
Binance recorded net outflows of $3.6 billion during the first nine hours, equivalent to approximately 2 percent of the $171 billion in assets it manages.
The exchange operates as both a trading platform and custodian, allowing users to buy and sell digital assets such as bitcoin and hold their funds on the platform.
Zhao stepped down as Binance CEO in 2023 after pleading guilty in the United States to violating anti-money laundering requirements. US President Donald Trump later pardoned him. Zhao remains the company's largest shareholder.
Frozen funds and blockchain tracking help limit losses
The stolen assets included several cryptocurrencies, among them stablecoins — digital tokens typically designed to maintain a value pegged to the US dollar and backed by assets held by their issuers.
Stablecoin issuers froze approximately $3 billion of the affected funds after the breach, preventing hackers from moving or laundering those assets.
Binance also purchased various cryptocurrencies on the open market and published evidence of its recovery efforts based on cryptographically verified internal records and transactions recorded on the public blockchain.
The FBI and independent analysts have attributed the attack to TraderTraitor, a North Korean state-linked hacking group associated with previous major cryptocurrency thefts.
Cybersecurity firms Elliptic and Chainalysis said the attackers appeared to have transferred the stolen assets between multiple wallets through automated transactions, based on the speed and timing of the movements. Some activity reportedly continued overnight in Pyongyang.
However, Elliptic researcher Tom Robinson said certain transactions suggested human involvement, including small test transfers made before larger amounts were moved.
Hack renews scrutiny of crypto security
The attack has reignited concerns about the security of cryptocurrency platforms and the industry's regulatory safeguards.
North Korean-linked hackers have repeatedly targeted cryptocurrency exchanges. Indian platform WazirX, for example, lost approximately $234 million — nearly half of its assets — in a 2024 attack and subsequently underwent restructuring.
Unlike traditional banks, cryptocurrency exchanges operate in a sector that remains comparatively lightly regulated in many jurisdictions and generally lacks government-backed deposit insurance for customers.
The Binance breach has also raised questions about whether artificial intelligence could be used to identify and exploit weaknesses in financial systems. However, there is currently no clear evidence that AI played a role in this attack.
While Binance says it has secured most of the stolen value and has the resources to cover the losses, the incident is likely to intensify calls for stronger security standards and safeguards across the cryptocurrency industry.
