Binance, the world’s largest cryptocurrency exchange, says it has covered 90% of the $6.3bn (£4.7bn) in assets stolen in a hack on Thursday, and the FBI has blamed North Korea for the attack.

The remaining 10% may take longer to source in the required amounts, the company added. Binance has pledged to cover 100% of the losses from what is suspected to be crypto’s biggest hack on record. It said it has set aside more than $6.34bn in company funds to do so.

“Binance will absorb the financial impact of these stolen funds, not our users,” the company said in a statement on Saturday.

Withdrawals start coming back online

In an update on Sunday, Binance said withdrawals had been restored on several of its networks. They had been suspended after the hack. The company had previously said withdrawals would be resumed in phases, and that is now under way.

For the millions of customers who rely on the platform to buy, sell and trade digital assets, that update matters as much as the coverage figures. Binance is estimated to have hundreds of millions of users worldwide, and the exchange was founded in China in 2017.

The FBI points at North Korea

The Federal Bureau of Investigation said on Saturday that North Korea was responsible for the attack. The agency said it had observed hackers converting stolen assets into Ethereum. It expects the assets will then be converted again using decentralised finance and instant swap services, a common method for moving money quickly and making it harder to follow.

Two analytics firms had already told reporters they had robust intelligence pointing to North Korean state-backed hacking unit the Lazarus Group, also known as TraderTraitor. The FBI specifically named that group. North Korea has always denied involvement in these attacks.

Washington is not yet certain

The official line from the White House was far more cautious. Speaking to reporters on Saturday night, US President Donald Trump said the US is still unsure who the culprits are.

“We’re learning about it. We don’t know if it’s North Korea - but if it is, we’ll talk to North Korea about it,” he said.

That gap between an FBI attribution and a president who has not yet accepted it is the kind of split that will shape how the case is handled in diplomatic and financial circles in the coming days.

How the money was replaced

Binance said it had replenished the stolen assets using various funds and its own corporate treasury. All holdings of the cryptocurrencies bitcoin, Ethereum and Tether are covered. Seven other widely traded crypto assets are also covered, the company said.

For traders and investors, the replenishment is the key number. It means the exchange is absorbing the loss on its own balance sheet rather than passing it to the people who hold assets on the platform.

A record heist

The hack is believed to be the largest in history. It eclipses the record of a $1.5bn heist on the Bybit exchange in 2025, which the FBI also blamed on North Korea. That previous attack set the benchmark that crypto security teams have been measuring against, and this one has now surpassed it by a wide margin.

The scale of the theft is what turns this from a single exchange problem into a broader warning for global investors. Crypto assets exist only in digital form. They are accessed through digital wallets or computers, so a breach at a major platform puts real money at risk within minutes.

What went wrong inside the system

Binance’s first investigation suggested that an engineer’s laptop had been compromised. That gave access to unauthorised withdrawals. A later update changed the picture, with the company saying it had uncovered “additional points of breach.”

Richard Teng, Binance’s co-chief executive officer, said the hack was carried out by more than one person. He said the hackers used sophisticated methods to hide their tracks, including what he described as a “self-destruct mechanism.” That detail suggests the attackers planned how to cover their trail before they moved the money.

The freeze and the hunt for funds

On Friday, the company said it had frozen around $3bn of the stolen assets after working with law enforcement, intelligence firms and partners. The investigation is ongoing, it added.

The US Secret Service said on Friday it is “working around the clock” with private sector partners “to identify, freeze, trace, and recover funds” stolen from Binance. That public commitment from a federal agency signals that the recovery effort is being treated as a national security matter as well as a financial one.

Why this matters beyond one exchange

Binance’s decision to absorb the loss is the most important detail for ordinary users. Many crypto platforms have faced hacks in the past, but the stakes rise sharply when an exchange of this size is hit. Customers depend on the platform staying solvent and on withdrawals working, and both were tested here.

The attack also shows how state-linked hacking groups are targeting the crypto industry. The FBI has now linked North Korea to the two largest crypto thefts on record, based on its own assessment. North Korea has denied involvement in both.

For investors in the US, UK and Australia who hold crypto through major exchanges, the lesson is direct. Security breaches at the largest platforms can move quickly, the money can be converted and re-routed within hours, and the recovery process can take far longer than the headline numbers suggest. The remaining 10% of coverage, which Binance says may take longer to source, is the number to watch.

The investigation is still open. Binance says it is continuing to work with law enforcement and partners. Until the trail is fully traced and the last portion of losses is covered, the full cost of the biggest crypto hack on record is not yet known.