Binance says 90% of stolen crypto assets replenished after $6.3 billion security breach

Market Mastery

Webinar by Vishal Malkan

Find the weak links

in your portfolio by Vishal Malkan

Cryptocurrency exchange Binance said on Saturday that it had set aside more than $6.34 billion in company funds to cover losses from a $6.3 billion security breach, with around 90% of the stolen token assets already replenished. The exchange said it is working to restore withdrawal services in phases.

In its second security incident recovery update, Binance said it would absorb the entire financial impact of the theft through its Secure Asset Fund for Users (SAFU) and corporate treasury, ensuring that users do not bear the losses.

"Our last update explained that Binance had set aside more than $6.34B in company funds to cover hacked losses, and we had already covered approximately 80% of the impacted amount of the hacked loss at that time," the exchange said in a statement.

"That covered amount is now up to 90%," it added.

Binance said Bitcoin (BTC), Ether (ETH), Tether (USDT), BNB, Solana (SOL), USD Coin (USDC), XRP, USD1, RLUSD and ZEC were fully backed. It would continue buying the remaining relevant token assets through market and over-the-counter (OTC) channels until coverage reached 100% for all tokens.

The exchange said it had already secured $5 billion in the same digital assets that were stolen, including USDC, USDT, Bitcoin, Ether and BNB. In its earlier update, this represented approximately 80% of the impacted amount.

Binance confirmed that its hot wallets were compromised at around 20:05 UTC on October 29, resulting in unauthorised withdrawals of approximately $6.3 billion worth of digital assets.

As part of its recovery efforts, the exchange said around $3 billion in stolen assets had been frozen on blockchain networks through coordination with law enforcement agencies, blockchain intelligence firms, asset issuers and industry partners.

The company said its technical team was targeting the phased resumption of withdrawals within approximately 34 hours, subject to the completion of security checks. Deposits and other unaffected platform services remained operational.

Binance also announced plans to publish an updated Proof of Reserves report by Monday, November 2, allowing users to verify the digital assets backing their account balances.

On the cause of the breach, the exchange said its initial investigation had pointed to a compromised laptop, but subsequent findings had revealed additional points of intrusion.

"Our initial investigation suggested that the incident may involve a compromised laptop, however, our subsequent investigation has uncovered additional points of breach," it said.

The company reiterated that it had found no evidence of wallet private keys being leaked. Further technical findings were expected within approximately 48 hours, subject to verification.

Meanwhile, blockchain investigation firms TRM Labs and Chainalysis have linked the $6.3 billion theft to a North Korean hacking group known as TraderTraitor, according to Reuters.

Cybersecurity experts cited by Reuters said proceeds from North Korean cryptocurrency thefts have helped fund the country's weapons programmes.

Binance has not publicly confirmed who was responsible for the attack and said its investigation remains ongoing.

The exchange said it would publish a detailed technical report outlining how the breach occurred and the additional security measures being introduced to prevent similar incidents.