Binance said Saturday that it has covered up to 90% of the roughly $6.3 billion in token assets stolen from its hot wallets in a theft announced Thursday. The exchange said it will keep buying the remaining assets through market and over-the-counter channels until coverage reaches 100%.
Binance said it is using its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its corporate treasury to replenish the assets. "Binance will absorb the financial impact of these stolen funds, not our users," the company said in a statement.
The exchange said the outstanding 10% consists of tokens outside its top 10 that are "less liquid, which means they may take longer to source in the required amounts."
Binance said its next milestone is resuming withdrawal services for users by Sunday, subject to security checks. It declined to provide further details on its investigation to CNBC.
The FBI said late Saturday that it has determined North Korea was responsible for the theft. The agency said malicious North Korean actors laundered the stolen assets by converting them into Ethereum, and it expects the thieves will convert the assets as they prepare them for "further laundering stages."
Binance initially said the hack may have involved "a compromised DevOps engineer's laptop." Co-CEO Richard Teng later said the attack involved a more complex process rather than the misuse of a single engineer's permissions. The exact method of the attack remains unclear.