Binance says it has frozen about half of the funds stolen in a "complex" hack that saw $6.3bn (£4.7bn) accessed. The company said $3bn of its stolen digital assets had been secured, but many were still in the hands of unidentified hackers.
Binance first thought a compromised engineer's laptop had allowed unauthorised withdrawals. Co-CEO Richard Teng later said a subsequent investigation "has uncovered additional points of breach" and that "This was not carried out by one person."
Several analytics firms have linked the hack to a North Korean hacking unit. Chainalysis said it had "high confidence" that a North Korean group is linked to the attack. TRM Labs said several elements resembled earlier North Korean-linked incidents, including the 2025 Bybit hack, which was about $1.5bn.
The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover the stolen funds. Binance said it is working with the FBI. Binance said its US-facing exchange was unaffected.
Binance said it had set aside more than $6.34bn in company funds to cover the losses and was "actively buying" a range of crypto tokens. Deposits remain unaffected, the company said. Several legal experts warned that Binance's promise to cover losses may not be legally binding, and that customers may need to pursue litigation. Daniel Tunkel of Edwin Coe said recovery would "come down to what [customers] have been promised in their contracts."
Bitcoin fell 5% to $76,800 in New York trading on Friday, according to the report. Coinbase fell 12%, and Robinhood fell 7.8%.