Binance Says It Has Replaced Most Assets Lost in $6.3 Billion Theft

Binance would like the headline to be the ending. About 90 percent of a $6.3 billion theft has been backed again. Bitcoin and ether are fully covered. Customers, we are told, will not pay for the breach. Withdrawals may resume by Sunday, after security checks and a final round of reassurance.

Do not exhale yet.

Restored backing is not recovered money. The tokens taken from those internet-connected withdrawal wallets are gone. Users are being offered a substitution: the Secure Asset Fund for Users, part of the futures insurance fund, and Binance's corporate treasury will stand where the stolen assets stood. That is how a private firm should absorb a private loss. It is also what the thief accomplished. The attacker keeps the haul. The exchange rearranges its pockets. The rearrangement is then called a recovery.

Binance says investigators have found multiple possible points of compromise. Neither the company nor the U.S. government has publicly confirmed a culprit. Caution is not cowardice. Burying the leading hypothesis is. TRM Labs and Chainalysis attributed the attack to North Korea, and they have been right about this species of operation often enough that the attribution should lead the story, not trail it. Pyongyang's hackers have spent years using exchanges and hot wallets as a sanctions workaround. American prosecutors and U.N. monitors have repeatedly tied those proceeds to the regime's weapons programs. The money is not a libertarian curiosity. If the firms are right about this attack, the material fact is not a Sunday reopening. It is that a hostile state got richer by billions because a custodian left the money online.

Call the wallet what it is. An internet-connected balance that can yield $6.3 billion is not a feature of modern finance. It is a failure of custody. Hot wallets exist for speed. They are not a philosophy, and they are not a vault. State crypto theft is a known business model. Designing a withdrawal system as if it were not is negligence with a communications team.

The part worth defending should be defended cleanly. Binance says it will eat the loss rather than pass it to customers, and no one is arranging a taxpayer rescue. After FTX, that distinction is the whole ballgame for anyone who claims to believe in responsibility. A firm that refills the till from its own funds is preferable to one that reaches for the public, or to one that discovers in bankruptcy that the money was never there.

Do not be hypnotized by it. Reimbursement is not deterrence. North Korea, if the analysts are right, does not care which internal fund makes users whole. It cares that the theft cleared. The uncovered remainder — less-liquid tokens Binance says it must still buy in the market and over the counter — shows how elastic the word backed becomes once you leave bitcoin and ether. Buying the shortfall is not the same as having held it. Holders of those names are closer to the price of the cleanup than the press release admits.

Some on the Right will hear any of this as the overture to the old regulatory raid: every breach proves private money is a crime scene, and Washington should superintend the industry into harmlessness. That raid still deserves opposition. A bureaucracy that cannot stop a sanctioned regime from cashing out is not going to grow competent because it has more forms. Pushing activity toward less cooperative venues would be a gift to the same hackers.

The pro-crypto instinct has an evasion of its own. Opposition to a Securities and Exchange Commission that preferred punishment to workable rules was warranted. It is not a lifetime pass. Centralized exchanges are not a protest against the state. They are custodians. Custodians who lose billions to a weapons program have made a national-security problem, whether or not you hold bitcoin. Republicans who argue that weakness invites predators do not get to change the subject because the predator used a wallet instead of a missile.

Seriousness is not a 90 percent figure. It is keeping other people's money offline in amounts you can defend. It is freezing and seizing what can be traced to a state heist. It is naming the adversary when the evidence warrants it, and refusing to let competent customer service impersonate a strategy.

The assets are still stolen. The backing is a promise. If the attribution holds, the regime has already been paid. That is the story. The press release is the part they hope you remember.