Binance, the world’s largest cryptocurrency exchange, said it had replenished approximately 90% of the digital assets stolen in a record-breaking $6.3 billion security breach, assuring customers that they would not bear the financial losses.
The disclosure came in a statement posted on X over the weekend, in which the exchange said it had increased the replacement of affected assets from an earlier estimate of 80% to 90%. Binance explained that the remaining 10% consisted of less liquid tokens that were taking longer to source in the required quantities.
The company said it was continuing to purchase the assets through market transactions and over-the-counter channels.
Reassuring customers that the incident would not affect their funds, Binance said it would take responsibility for the financial consequences of the attack.
“Binance will absorb the financial impact of the stolen funds, not users,” the company said in its update.
The hack, which occurred on October 29, saw attackers steal approximately $6.3 billion worth of cryptocurrency from Binance’s hot wallets across ten blockchain networks within about 20 minutes. The incident was believed to be the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit breach in 2025.
According to Binance’s preliminary investigation, the attackers did not steal private keys. Instead, they compromised the laptop of a DevOps engineer and used the access to infiltrate the exchange’s signing infrastructure, the internal system responsible for authorising withdrawals.
Blockchain analytics firm TRM Labs described the technique as hijacking “the system that tells the vault to release money” rather than stealing the vault key itself.
Binance Suffers Record $6.3 Billion Hack as North Korea Link Emerges
Who is Alice Huang? The Woman at the Centre of Nvidia CEO Jensen Huang Intelligence Allegations
Six Dead, 15 Injured After Gunman Opens Fire in Poland’s Krakow
Paraguay President Quits as Ruling Party Withdraws Support Amid Banking Scandal
Binance co-CEO Richard Teng confirmed that the exchange would cover the losses through its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund and corporate treasury reserves. The company also said it expected to restore the SAFU fund to approximately $1 billion following the deployment.
The exchange further disclosed that approximately $3 billion of the stolen assets had been frozen on-chain with assistance from stablecoin issuers, including Tether, Circle, Ripple and Paxos. Their tokens can be remotely blocked, making it possible to prevent stolen funds from being moved.
However, recovering Bitcoin and Ether remained more difficult because neither cryptocurrency has a central issuer capable of freezing individual holdings. An estimated $2.4 billion worth of the stolen assets remained beyond the reach of such freezing mechanisms.
Several blockchain analysis firms, including TRM Labs and Chainalysis, attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group also linked to the Bybit breach. North Korea has routinely denied involvement in cryptocurrency thefts.
Binance said it remained on course to resume withdrawal services by Sunday, November 1, subject to the completion of security checks. The exchange also published a fresh Proof of Reserves snapshot, with a complete zero-knowledge proof expected by November 3.
The breach sent shockwaves through cryptocurrency markets, with Bitcoin briefly falling by approximately 5% to around $76,400, its lowest level in a month. Ether and Binance’s native BNB token also recorded declines following the incident.
