Binance is trying to separate customer protection from the unresolved question of who carried out the $6.3 billion theft. The exchange says it can absorb the loss; US investigators say the trail leads to North Korea, an assessment Trump has publicly disputed.

Binance said it had replaced 90% of the stolen assets, with the remaining 10% taking longer because the relevant tokens are less liquid. It said it had set aside more than $6.34 billion from company reserves and related funds, maintaining that users would not carry the cost. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said.¹

The company has also said it froze about $3 billion in stolen assets with help from law enforcement, intelligence firms and industry partners, while working to restore withdrawals. Its account of the breach has evolved from a compromised engineer’s laptop to “additional points of breach”; co-chief executive Richard Teng described a multi-person operation using tools designed to erase evidence.¹

The FBI’s position is more definite. It said North Korea was responsible for the theft and identified TraderTraitor, a group believed to be part of the Lazarus network, as the actors behind it. The bureau said it had seen the group converting assets into Ethereum and warned that further laundering through decentralised-finance and swap services was likely.²

Trump, however, has disputed the FBI’s conclusion that North Korea was behind what has been described as the largest hack in cryptocurrency history.³ The available reporting provides no alternative attribution from Trump. North Korea has previously denied involvement in comparable cyberattacks, leaving Binance’s reimbursement effort and the official attribution on separate tracks: one focused on making customers whole, the other on assigning responsibility.