Binance says $6.3 billion reserve will cover hack losses after North Korea-linked attack

Binance says it has started restoring affected user assets after a hack that it now describes as the biggest crypto theft in history. For PSPs and high-risk operators, the important part is not the headline number alone: the exchange says it will cover all losses from its own resources, while withdrawals were briefly suspended and recovery work is still ongoing.

1. Binance said it had recovered about half of the stolen assets, while many others remain in the hackers’ possession. The company said it is working with authorities and other partners to “trace, freeze and recover additional funds,” and that it has already publicly committed to covering the losses with its own resources.
2. Two analytics firms attributed the incident, which exceeds the record $1.5 billion attack on Bybit in 2025, to a North Korea-based hacker group called TraderTraitor. Check Point said the group is also known in the industry as Lazarus Group, which was responsible for the 2025 cyberattack. Check Point chief information security officer Jayant Dave called Binance’s estimated losses the “largest crypto theft in history.”
3. Binance said it has set aside more than US$ 6.3 billion, the same amount stolen in the attack, to cover the incident. Of that total, US$ 5 billion is already allocated in the same tokens that were affected, and the company said it is completing the purchase of the remaining amount through different channels. It added that this step may take longer and that it will share updates “as soon as possible.”
4. The company said the reserved amounts do not include assets that were frozen and are still going through recovery and verification processes. Binance had previously said US$ 3 billion had been frozen. Withdrawals were temporarily suspended, and the company said on Friday morning that it was working to normalize withdrawals within 45 hours.
5. Binance, founded in China in 2017, says it has more than 300 million registered users worldwide and reported in 2024 that it held more than US$ 160 billion in assets under custody. It has also faced regulatory scrutiny around the world, which is the part that matters here for any PSP or partner trying to judge operational and compliance risk around the platform.

Chainalysis also said it had a “high level of confidence” that the North Korea-linked TraderTraitor group was behind the cyberattack. In practice, that means the funds recovery track is not just an exchange-internal issue; it is now a law-enforcement, sanctions, and blockchain-tracing problem all at once.