Binance says 90% of stolen assets replenished, targets Sunday withdrawals

Binance announced on Saturday that it has replenished 90% of the assets stolen in the record‑breaking $6.3 billion hack that unfolded on Thursday. The exchange said the recovery effort draws on its corporate treasury, a partial draw from the Secure Asset Fund for Users (SAFU) and a slice of its futures insurance fund. Binance aims to resume user withdrawals on Sunday, November 1, after buying back the remaining less‑liquid tokens through market and over‑the‑counter trades. The hack, attributed by TRM Labs to North Korea’s TraderTraitor group, left the platform scrambling to restore confidence among its hundreds of millions of customers.

Background

The theft, described by multiple outlets as the largest cryptocurrency breach on record, targeted Binance’s hot wallets and resulted in the loss of roughly $6.3 billion worth of digital assets. Initial reports indicated that the breach may have begun with a compromised DevOps engineer’s laptop, allowing unauthorized withdrawal commands to be executed, though later statements from Binance co‑CEO Richard Teng suggested a more complex intrusion involving multiple points of failure. Industry partners such as Tether and Circle responded by freezing about $3 billion of the affected assets, a move separate from Binance’s own replacement strategy. Blockchain intelligence firm TRM Labs linked the attack to the North Korean TraderTraitor hacker group, noting similarities to earlier North Korea‑linked heists. In the wake of the incident, the US Secret Service confirmed it was working “around the clock” with private‑sector specialists to trace, freeze and recover the stolen funds. Binance set aside $6.34 billion, including $5 billion in the directly affected cryptocurrencies, to cover the losses and began publishing a new reserves snapshot while generating a zero‑knowledge proof of its holdings, a process it said would take 40 to 50 hours due to computational demands.

What happened

On Thursday, Binance disclosed that hackers had withdrawn $6.3 billion from its hot wallets, marking the biggest crypto theft to date. By Friday, the exchange announced it had earmarked $6.34 billion, including $5 billion in the stolen tokens, to cover the loss. On Saturday, a Binance spokesperson told Cointelegraph that 90% of the stolen assets had been replenished, up from 80% the previous day, and that withdrawals were slated to resume on Sunday. The replenishment effort combines Binance’s corporate treasury, a partial deployment of SAFU and a portion of its futures insurance fund, with the exchange stating it will absorb the financial impact, not users. Binance also published a new reserves snapshot but noted that the full cryptographic proof, a zero‑knowledge proof, would require 40 to 50 hours to generate. The exchange confirmed that balances in Bitcoin, Ether and eight other major tokens are fully backed, while the remaining shortfall consists of less‑liquid tokens that are being purchased through market and over‑the‑counter transactions. CertiK indicated it needs more information to verify the claimed $5 billion in replacement cryptocurrencies. Meanwhile, the US Secret Service reported ongoing collaboration with law‑enforcement and private‑sector partners to freeze and trace the stolen funds, and Binance said it had frozen around $3 billion of the stolen assets.

Market impact

The hack removed $6.3 billion from Binance’s hot wallets, prompting a rapid mobilisation of $6.34 billion from the exchange’s own reserves. Industry partners froze roughly $3 billion of the affected assets, a figure separate from Binance’s replacement programme. Binance’s statement that all balances in Bitcoin, Ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed reassured markets, though the remaining 10% shortfall in less‑liquid tokens introduced uncertainty about price impacts for those assets. The ongoing purchase of these tokens through market and over‑the‑counter channels could generate upward pressure on their prices, while the large influx of replacement crypto from Binance’s treasury may dampen volatility for the top‑ten tokens. The generation of a zero‑knowledge proof, expected to take up to 50 hours, is intended to provide transparent verification, potentially stabilising investor confidence. The coordinated freezing effort by the US Secret Service and other agencies aims to limit further market disruption by preventing the stolen funds from re‑entering circulation.

Why it matters

Binance’s ability to replace 90% of the stolen assets demonstrates the exchange’s deep liquidity reserves and the effectiveness of its SAFU and insurance mechanisms, which could set a new industry benchmark for post‑hack remediation. The swift freezing of $3 billion by partners and law‑enforcement shows heightened coordination across the crypto ecosystem, potentially deterring future large‑scale attacks. However, the reliance on over‑the‑counter purchases for less‑liquid tokens highlights market fragility for niche assets and may affect pricing dynamics for those tokens. The attribution of the hack to a North Korean group underscores the geopolitical dimension of crypto crime, prompting regulators and exchanges to reassess security protocols and cross‑border cooperation. Finally, Binance’s commitment to absorb the financial impact without passing costs to users may preserve user trust and maintain its dominant market position, but it also raises questions about the long‑term sustainability of such large‑scale self‑insurance models.