Binance says it has covered 90% of the $6.3 billion stolen in its hack and is on track to resume withdrawals on 1 November
Binance said on Saturday that it has restored backing for about 90% of the token assets stolen from its hot wallets, using company funds, part of its SAFU emergency fund and part of its futures insurance fund. It says users will not bear the loss and that withdrawals should resume on 1 November, subject to security checks.
Binance, the world’s largest cryptocurrency exchange, said on Saturday 31 October that it has covered about 90% of the roughly $6.3 billion in token assets stolen from its hot wallets on Thursday 29 October, and that it remains on track to resume withdrawals on Sunday 1 November, subject to security checks and final confirmation.
What Binance said. “All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%,” Binance said in a statement reported by CNBC. “Binance will absorb the financial impact of these stolen funds, not our users.” CNBC noted that the figure refers to restored backing, not to funds recovered from the attacker.
The exchange said the remaining 10% is made up of tokens outside its top 10 that are “less liquid”, which may take longer to buy in the required amounts. It said it will keep buying them through market and over-the-counter channels until every token is fully covered.
Binance said it has drawn partly on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury, and has set aside about $6.34 billion of company funds internally, Reuters reported. It said it took a new proof-of-reserves snapshot as of 00:00 GMT on 31 October, and that users holding the ten listed tokens will be able to check that they are backed at least 1:1 once the full proof is published.
The investigation. Binance said on Friday that the theft may have started with a compromised engineer’s laptop and that it had found further points of breach. Co-CEO Richard Teng called it a “complex attack” involving malicious software designed to delete evidence, Reuters reported. Blockchain analysis firms TRM Labs and Chainalysis have linked the theft to North Korea’s TraderTraitor group. Binance has not named anyone, and North Korea routinely denies involvement in crypto thefts, Reuters said.
Withdrawals had not been reported as resumed as of 17:50 GMT on Saturday. Deposits have continued to work normally, Binance has said.
For earlier coverage, see our earlier report.
Sources
- Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday · CNBC
- Binance replenishes 90% of assets stolen in record hack · The Straits Times (Reuters)
- Binance says it has replaced 90% of stolen crypto after massive $6.3 billion breach · CoinDesk
- Security Incident Update · Binance Support
- Crypto exchanges call for quick moves to bolster defenses after Binance heist · Reuters (via Investing.com)
Related coverage
All crypto →
Binance suspends withdrawals as suspected hack drains more than $5.5 billion from its wallets
On-chain trackers put the outflow from Binance-linked wallets at between $5.57 billion and $5.84 billion. Binance says user funds are safe and that it is investigating. Tether and Circle have frozen more than $2 billion of stablecoins. If confirmed, it would be the biggest crypto hack on record.
Coinbase says analytics vendor Amplitude's security incident exposed some customer contact data
Coinbase said a security incident at analytics provider Amplitude affected contact data for a 'small subset' of its customers. The exchange said its own systems were not breached and customer funds were not affected.
Binance applies for Brazil crypto licence ahead of 30 October deadline, delists 22 tokens locally
Binance said it applied to Brazil's central bank for a virtual asset service provider licence through its local unit. From Tuesday it restricted eight services and delisted 22 tokens for Brazilian users.
CoinDCX confirms 15.99 million USDT loss from old wallets after earlier denying a new hack
Indian crypto exchange CoinDCX said on 25 October that about 15.99 million USDT was lost from operational wallets it had retired after a July 2025 breach, because of a failure in its deposit-sweeping service. It said it absorbed the loss and that customer balances were not affected.
Wallet maker NGRAVE says fake app alert led to at least $2.56 million in crypto thefts
Attackers used a third-party notification provider to send LIQUID app users a fake security alert linking to a copycat site that asked for recovery phrases, NGRAVE said.
Qubic halts its network and Cysic suspends its bridge after weekend exploits
Qubic said 1,404 wallets were drained of about 2.94 trillion QU tokens. Cysic said 10 million CYS tokens were minted without authorisation through its bridge.
