Binance says it has frozen about half of the funds stolen in a "complex" hack that saw $6.3bn (£4.7bn) accessed, according to the BBC. The exchange said $3bn of its stolen digital assets had been secured, but many were still in the hands of unidentified hackers.
Binance co-CEO Richard Teng said the attack "was not carried out by one person." He said the initial investigation suggested a compromised laptop was involved, but a later investigation uncovered additional points of breach. He also said the hackers used "a self-destruct mechanism that destroyed tooling and traces as they went."
The firm said it had "set aside" more than $6.34bn in company funds to cover the stolen assets. Binance told users "your money is safe, and we're covering every loss."
Several analytics firms have linked the hack to a North Korean hacking unit. Chainalysis said it had "high confidence" that a North Korean group was linked to the attack. TRM Labs said several elements resembled earlier North Korean-linked incidents, including the 2025 Bybit hack. North Korea has denied involvement.
The US Secret Service said it was "working around the clock" to identify, freeze, trace and recover the stolen funds. Binance said it is working with the FBI.
The BBC reported that the price of Bitcoin fell 5% to $76,800 on Friday afternoon in New York, and that Coinbase shares fell 12%.
Some legal experts have said customers should not treat Binance's promise to cover losses as legally binding. Daniel Tunkel of the London-based law firm Edwin Coe said recovery "would come down to what [customers] have been promised in their contracts."