Binance swaps $6.3 billion in stolen crypto to protect users

The FBI identified North Korean hackers as the perpetrators behind the largest cryptocurrency theft in history, a $6.3 billion drain from Binance. The agency stated on Saturday that a group known as TraderTraitor stole the virtual assets and is currently moving the money. Investigators observed the actors converting the stolen funds primarily into Ethereum. The FBI warned that the assets are expected to be laundered in further stages.

This operation mirrors a previous attack. The FBI blames TraderTraitor for a $1.5 billion theft from the Bybit platform in February 2025. To combat the current flow of illicit funds, the agency provided specific digital addresses to virtual asset service providers. It called on these providers to block transactions associated with those addresses.

Binance has acted to stabilize the market impact of the breach. The company announced on Saturday that it replaced 90 percent of the stolen amount. It used company funds to purchase new tokens to cover the loss. The remaining 10 percent consists of less liquid tokens, which the company noted may take longer to acquire. Binance stated that it will continue buying assets until the covered amount reaches 100 percent for all tokens.

The exchange emphasized that users will not bear the financial burden. Binance said it will absorb the cost of the stolen funds. The money for these repurchases came from the Secure Asset Fund for Users, a $1 billion Bitcoin reserve. The company also drew from its Futures Insurance Fund and corporate treasury.

Market conditions remained volatile as news spread. Crypto prices fell on Friday, the day before the FBI statement, as Binance worked to reassure customers. Richard Teng, co-CEO of Binance, described the breach on Friday as a complex attack. He explained that the attackers used a compromised laptop and malicious software designed to delete evidence. This made the investigation difficult to trace.

Binance suspended customer withdrawals immediately after the hack. On Saturday, the company said it was on track to reopen withdrawals on Sunday. It also published a new proof-of-reserves snapshot. This document allows users to independently verify that their assets are backed at a minimum 1:1 ratio.