Binance replaces 90% of stolen $6.3bn as withdrawals set to resume today

Binance has revealed that it has covered 90% of the roughly $6.3 billion stolen in Thursday’s hack, up from 80% in its previous update. The exchange says it plans to reopen withdrawals today, 1st November.

“We’ve now replenished 90% of the stolen assets, and we’re committed to covering the remaining 10%. Our users will not bear the financial impact of this incident,” co-CEO Richard Teng said on X on Saturday.

In its third and latest update, the company said the 10 largest tokens affected are “fully backed 100%”. These are BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC. The remaining 10% is in less liquid tokens outside that group, which may take longer to source.

Where is the money coming from?

Binance says it used three sources: a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its Futures insurance fund, and its own corporate treasury. It later X post confirmed that the SAFU transfer is complete, pointing to a large transfer of 7,499 BTC visible on the blockchain.

SAFU is an emergency reserve set up in July 2018 for cases such as security breaches. It is held by Nest Clearing and Custody Limited, a clearing house regulated in Abu Dhabi. The crypto company says that it will replenish the fund to about $1 billion.

The Futures insurance fund protects traders from deficit losses on bankrupt positions and limits forced liquidations, known as auto-deleveraging.

Binance says it released only the amount above the fund’s required size and that the remaining balance is a regulatory requirement. It says the fund remains above the required coverage level, though no exchange can completely avoid auto-deleveraging.

Also read: North Korean-linked hackers steal $6.3 billion from Binance in biggest crypto heist ever

Withdrawals and proof of reserves

Binance suspended withdrawals after the attack, which it says began when its hot wallets were compromised at about 20:05 UTC on Thursday. It says deposits and other unaffected services have stayed operational.

The exchange says withdrawals will reopen in phases. It had earlier said it expected to resume within 48 hours.

The company has also published a new Proof of Reserves snapshot, taken at midnight UTC on Saturday. The full zero-knowledge proof takes 40 to 50 hours to generate. It also says that holders of the 10 covered tokens will be able to verify at least 1:1 backing once it is done, which it estimates will be Tuesday. In an earlier update, it had said results would be ready by Monday.

What Binance is yet to address

Binance’s first assessment pointed to a compromised engineer’s laptop. Its second update said further investigation “has uncovered additional points of breach.” Teng has described a “complex attack” involving a compromised laptop and malicious software designed to delete evidence. It says it has found no evidence that wallet private keys were leaked.

About $3 billion of the stolen assets has been frozen on-chain, according to Binance. That is separate from the 90% figure, which reflects replacing assets and not recovering them.

Binance’s updates do not name those responsible. TRM Labs and Chainalysis have linked the attack to North Korea, according to our earlier report. The company says it expects to share further technical findings within about 48 hours of its second update and will publish a full post-mortem.