The US Federal Bureau of Investigation accused North Korea on Saturday of stealing more than $6 billion from Binance, as the cryptocurrency exchange said it replaced about 95% of the affected assets.
Binance put the theft at about $6.3 billion. It has been buying replacement tokens with company resources and arranging a phased restoration of withdrawals after suspending them following the breach.
In its statement, the Federal Bureau of Investigation (FBI) identified the North Korean activity as TraderTraitor and placed the theft on or around Thursday.
Investigators observed the attackers converting stolen assets primarily into ether, the cryptocurrency used on the Ethereum network. They expect further laundering through decentralised finance platforms and instant swap services.
Crypto businesses were urged to block transactions connected to wallet addresses identified by investigators.
Binance’s latest recovery update said it has replaced about 95% of affected assets, up from 90% in its previous announcement. Its remaining purchases involve less liquid tokens that take longer to obtain in the quantities required.
“Binance will bear the financial impact of the stolen funds,” the company said.
Its withdrawal plan scheduled the first phase to begin between 6 am and 9 am GMT on Sunday. Bitcoin, Ether, BNB, XRP and Dogecoin were among the assets included, with availability dependent on the network and completion of security checks. Deposits remained open.
Read More: Binance Hack: $6.3bn Stolen, North Korea Suspected
Customers were directed to check availability for individual assets and networks. Binance warned that heavier traffic during the initial rollout could cause processing delays.
North Korea has previously denied using state-linked cyber units for financial theft and espionage. Its mission in Geneva and embassy in China did not respond to Reuters’ requests for comment.
Binance had earlier announced that it had allocated more than $6.34 billion in company funds to cover the losses. Replacing customer assets is separate from recovering cryptocurrency taken by the attackers.
TraderTraitor was previously blamed for the $1.5 billion theft from cryptocurrency exchange Bybit in February 2025.
Binance plans to publish a detailed incident report after completing its investigation.
(With additional input from Reuters.)
