Tonight, North Korea was blamed for the $6.3 billion at Binance.

Reuters reported tonight, citing people familiar with the matter, that Binance is cooperating with the FBI and the U.S. Secret Service. Blockchain intelligence firm TRM attributed the attack to TraderTraitor, a North Korean group—the same people who stole $1.5 billion from Bybit last February. TRM says its assessment is high-confidence.

The attackers still have 420,000 Ethereum and 18,270 Bitcoin, worth about $2.4 billion. These coins have no issuer, so no one can freeze them. Of the $3 billion that has been frozen, Tether, Circle, and Ripple account for more than $2.5 billion. It will take legal proceedings to determine who gets that money in the end. TRM’s head of policy told CNBC there is no standard timeline. Binance’s promised reimbursement doesn’t depend on that $3 billion being unfrozen.

Binance says it will cover the full amount using its SAFU fund and the company’s own funds. SAFU is entirely in Bitcoin and is worth $1 billion to $1.2 billion. That’s less than a fifth of the $6.3 billion. The rest will come from the company’s own funds.

Deposits and withdrawals are still suspended, with no timeline for resuming them.

Binance will front the $6.3 billion itself for now, and that cost will eventually be reflected in the price of BNB. These past few days, when watching BNB, I’ve been looking at trading on external exchanges, not Binance’s order book. With withdrawals suspended and funds unable to move, the price on Binance can diverge from the price elsewhere.