Binance recovers most of $6.3 billion stolen in hack, FBI links attack to North Korean group

Binance announced on Monday that it has compensated users for 95 per cent of the $6.3 billion worth of tokens stolen from its platform, using its Security Asset Fund for Users (SAFU) program, and that withdrawals have been restored. The exchange said the reimbursement was completed after an intensive effort over the weekend.

The U.S. Federal Bureau of Investigation attributed the breach to a North Korean hacking group identified as TraderTraitor. Initial analysis indicated that the attackers moved the entire sum out of Binance within roughly thirty minutes, first converting the assets into stablecoins such as Tether and USDC before swapping them for decentralized cryptocurrencies like Bitcoin and Ethereum.

Chainalysis, a cryptocurrency-tracking firm, reported that law enforcement and industry participants have frozen about half of the stolen coins. The remaining $3.3 billion in assets are currently circulating across multiple platforms and wallets as the perpetrators attempt to evade detection and eventually convert the funds into fiat currencies.

"The entire process was designed to deliver the lowest possible customer satisfaction," wrote Binance founder Changpeng Zhao in a memoir describing his 2024 incarceration for anti-money-laundering violations.

Zhao, who was later pardoned by President Donald Trump, emphasized that preventing further loss now depends on other crypto exchanges improving their AML controls. U.S. authorities had previously argued that Binance had failed to block illicit transactions involving sanctioned entities and criminal networks.