Binance said Saturday it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets. The theft was announced Thursday and is described by the source as the largest crypto theft on record.
Binance said it will keep buying the remaining token assets through market and over-the-counter channels until coverage reaches 100%. It said it is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets. The exchange said the outstanding 10% consists of tokens outside its top 10 that are less liquid and may take longer to source.
Binance said its next milestone is resuming withdrawal services for users by Sunday, subject to security checks. It continues to investigate the attack. Binance declined to provide further details to CNBC beyond its latest statement.
The FBI said late Saturday that it has determined North Korea was responsible for the theft. The agency said malicious North Korean actors laundered the stolen assets by converting them into Ethereum, and it expects the thieves will convert the assets as they prepare them for further laundering stages.
The source says it is still unclear how the attack took place. Binance first said the hack may have involved a compromised DevOps engineer's laptop that gave an attacker access to a service container. Co-CEO Richard Teng later said the attack involved a more complex process than misuse of a single engineer's permissions.
TRM Labs, a blockchain intelligence company, had earlier pointed to North Korean hackers. It said several features of the attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026.