Binance Says 90% of Stolen Assets Replenished, Targets Nov. 1 Restart

Binance announced on Saturday that it has replenished 90 percent of the digital assets taken in the record‑size breach that saw roughly $6.3 billion siphoned from its hot wallets. The exchange said the replacement effort lifts the balance of ten major tokens to full coverage and that it will reopen withdrawals on Sunday, Nov. 1. The shortfall now consists of less‑liquid tokens that Binance is sourcing through public and over‑the‑counter trades. The company also confirmed that it will absorb the entire financial impact of the theft, drawing on its corporate treasury and the Secure Asset Fund for Users (SAFU).

Background

The hack, which unfolded on Oct. 29 at about 20:05 UTC, targeted Binance’s hot wallets and resulted in unauthorized withdrawals of approximately $6.3 billion across ten blockchains. Binance initially blamed a compromised employee laptop, later expanding the investigation to additional breach points. The exchange set aside more than $6.34 billion of internal funds, including $5 billion already held in the exact tokens that were taken, and tapped a portion of its $1 billion SAFU reserve. Around $3 billion of the stolen assets have been frozen through coordination with law‑enforcement agencies, blockchain intelligence firms, asset issuers and industry partners. Analysts from TRM Labs and Chainalysis have linked the attack to the North Korean hacking group TraderTraitor, a claim that Binance has not confirmed but says it is working with authorities to investigate. The incident has prompted Binance to take a fresh proof‑of‑reserves snapshot, showing coverage ratios of 100 percent or more for the ten listed tokens, with a full cryptographic proof promised by Nov. 3.

What happened

Binance reported that it has replaced 90 percent of the assets stolen in the $6.3 billion breach, up from an earlier estimate of roughly 80 percent (Source 1). The exchange said balances in bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed (Source 1). The remaining 10 percent involves thinner‑traded tokens that are harder to source; Binance is buying them in public markets and via OTC trades with industry partners (Source 1). A portion of the roughly $3 billion in stolen assets that partners have frozen sits outside Binance’s own replacement effort (Source 1). Binance affirmed it will absorb the financial impact, carrying the loss on its own books and drawing from its corporate treasury, a slice of its futures insurance reserve and a partial draw on SAFU, tapping only the SAFU balance above the fund’s required minimum (Source 1). The exchange pledged to rebuild the SAFU reserve to about $1 billion (Source 1). A proof‑of‑reserves snapshot taken at midnight UTC on Oct. 31 showed coverage ratios of 100 percent or more for each of the named tokens, with a full cryptographic proof due by Nov. 3 (Source 1). Co‑CEO Richard Teng described the breach as a “complex attack” involving a compromised laptop and malicious software designed to delete evidence, and said the investigation has not attributed responsibility to any individual (Source 2, Source 3). Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to the North Korean group TraderTraitor with high confidence (Source 1). Binance said it is working closely with law‑enforcement to identify the perpetrators but has not publicly confirmed the attribution (Source 1). Withdrawal services are slated to resume on Sunday, Nov. 1, within the previously stated timeframe (Source 2, Source 3).

Market impact

The breach removed about $6.3 billion from Binance’s hot wallets, a figure that dwarfs the $1.46 billion loss suffered by Bybit the previous year, according to analysts cited in Source 1. Binance’s internal allocation of roughly $6.34 billion to cover the loss includes $5 billion already held in the exact tokens taken, plus additional funds from its corporate treasury, futures insurance reserve and SAFU (Source 1). The exchange’s proof‑of‑reserves snapshot on Oct. 31 showed coverage ratios of at least 1:1 for the ten listed tokens, indicating that user balances are fully backed for those assets (Source 1). Approximately $3 billion of the stolen assets have been frozen on blockchain networks through coordinated efforts with law‑enforcement and industry partners (Source 4). The remaining 10 percent of the loss, consisting of less‑liquid tokens, is being sourced in the market, which could affect the supply‑demand dynamics of those assets as Binance purchases them (Source 1). The upcoming full cryptographic proof of reserves, expected by Nov. 3, may influence market confidence in Binance’s solvency and affect trading volumes on the platform.

Why it matters

The scale of the theft, potentially the largest crypto heist on record, highlights vulnerabilities in hot‑wallet security and the risk of a single credential compromising vast amounts of customer assets, as noted by cybersecurity experts in Source 1. Binance’s decision to absorb the loss using its SAFU fund and corporate treasury sets a precedent for how centralized exchanges might protect users, reinforcing the importance of reserve mechanisms. The attribution to a North Korean hacking group, if confirmed, underscores the geopolitical dimension of crypto theft, linking illicit proceeds to state‑level financing of weapons programs (Source 1). The freeze of $3 billion of stolen assets demonstrates the growing effectiveness of cross‑border cooperation among law‑enforcement, blockchain analytics firms and industry partners. Binance’s upcoming proof‑of‑reserves audit, promising cryptographic verification, could become a benchmark for transparency in the industry, influencing user trust and regulatory scrutiny. Finally, the incident may prompt other exchanges to reassess their hot‑wallet architectures and incident‑response strategies, potentially reshaping market practices around asset custody and risk management.