Binance said it had replaced most of about $6.3 billion in tokens taken in a Thursday theft and would restart withdrawals in phases on Sunday, BBC, Al Jazeera and Dawn reported^1,2,5. Dawn said the company later put the replaced share at 95 percent, or about $6 billion, with a first window from 0600 to 0900 GMT covering 15 assets including bitcoin and ether⁵.

On Saturday the exchange had said 90 percent of the stolen assets were covered and that the rest were less liquid tokens that may take longer to buy^1,2. Binance said it would absorb the financial impact rather than pass it to users^1,2. Al Jazeera and Dawn said replacements came from a Secure Asset Fund for Users, a futures insurance fund and the corporate treasury^2,5. The Verge reported the company had reserved more than $6.34 billion⁴. Co-chief executive Yi He said 50 percent of the SAFU would be used and that Binance would replenish that fund, Dawn reported⁵.

The FBI said Saturday that North Korean actors linked to a group called TraderTraitor were converting stolen assets mainly into ether and asked virtual-asset firms to block listed addresses². TechCrunch and The Verge said TRM Labs, Elliptic and Chainalysis had already attributed the theft to that group^3,4. BBC said President Donald Trump told reporters Saturday the United States was still unsure who was responsible¹. BBC also noted North Korea has denied involvement in such attacks¹.

Binance has said an engineer's laptop was compromised and later that investigators found additional points of breach^1,3,4. Co-chief executive Richard Teng described a complex attack involving more than one person and software meant to hide tracks^1,2,4. The company said it found no evidence that wallet private keys leaked^3,4. About $3 billion in stolen assets were frozen with partners, Binance said Friday^1,3,4,5. The U.S. Secret Service said it was working with private partners to identify, freeze, trace and recover funds¹.