TLDR
Binance expects to restore withdrawals before its Sunday deadline and publish a full reserves report by Monday. It has set aside more than US$6.34 billion to cover the record hack, and investigators continue to point to North Korea.
KEY TAKEAWAYS
Binance aims to reopen withdrawals before a Sunday deadline and has set aside more than US$6.34 billion to cover losses from the biggest crypto theft on record.[1]
Co-chief executive Richard Teng said on Friday the exchange hoped to restore withdrawals within 40 hours and would publish a full proof-of-reserves report by Monday. Deposits are running normally.[1]
US$5 billion of the money set aside is already held in the same tokens the attackers took. Binance said it was buying the rest on markets and through over-the-counter trades, and that some purchases could take longer because of thin liquidity.[1]
About US$3 billion of the stolen funds remains frozen.[1]
More than a laptop
Binance first pointed to a compromised engineer's laptop. It has since uncovered "additional points of breach".[1]
Mr Teng said the incident involved "a more complex attack process" than a single "one-click" action. He said the attacker used a "self-destruct mechanism" to destroy tools and traces, which has complicated the investigation.[1]
"Our investigation has not attributed responsibility to any individual," he wrote.[1]
Investigators point to North Korea
Chainalysis chief executive Jonathan Levin said the attack was likely the work of TraderTraitor, a North Korean hacking group. He put the theft at US$6.4 billion, slightly above Binance's estimate of US$6.3 billion.[1]
On-chain investigator ZachXBT said money from the Binance attack and an earlier exploit at the exchange Bitget had been mixed in the same address.[1]
"This indicates the same actor is likely behind both incidents," he said.[1]
The FBI has named TraderTraitor as the group behind the US$1.5 billion Bybit hack in February 2025.[1][2] Binance is working with the FBI to recover funds, according to a source familiar with the matter.[1]
Chainalysis said the attackers appeared to be using automation to move the money through thousands of transactions.[1]
"Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit," the company said.[1]
SOURCES & CITATIONS
FREQUENTLY ASKED QUESTIONS
