Binance Covers $6 Billion of $6.3 Billion Crypto Hack

Binance, the world’s largest Cryptocurrency exchange, says it has covered approximately $6 billion of the $6.3 billion affected by a major cyberattack, using company funds to purchase replacement tokens. The remaining amount represents less than 10% of the reported loss and consists largely of less liquid assets that may take longer to source in the required quantities.

The development follows an attack that the US Federal Bureau of Investigation (FBI) has attributed to TraderTraitor, a North Korean state-sponsored cyber unit. Binance has said it will bear the financial impact of the incident and is working with industry partners to locate and freeze affected assets.

Binance Covers $6 Billion of Stolen Funds

Binance confirmed the recovery figure in a post on X on Saturday, saying it had already covered $6 billion of the affected amount. The announcement followed an earlier update in which the exchange said it had covered 90% of the stolen funds.

According to Binance, the outstanding amount is now below 10% of the total. The remaining assets are less liquid, meaning the exchange may need additional time to obtain them in sufficient quantities.

The company has also said it has internally set aside approximately $6.34 billion in corporate funds to cover the losses. Rather than relying entirely on the recovery of stolen tokens, Binance is purchasing replacement assets to address the financial shortfall.

FBI Attributes Cyberattack to North Korean Group TraderTraitor

The FBI said on Saturday that the attack was carried out by TraderTraitor, a cyber unit sponsored by North Korea. The group has been linked by US authorities to cryptocurrency-related theft and other cyber activities.

According to the FBI, members of the unit were observed converting stolen assets into Ethereum. The agency also warned that further laundering of the funds could take place through related technologies and services.

North Korea has repeatedly denied using state-linked cyber units for espionage, financial theft and revenue generation. Its mission in Geneva and embassy in China did not respond to requests for comment on the latest allegations.

Analysts had previously pointed to North Korea as a possible source of the attack, with some describing the incident as potentially the largest financial heist of its kind. The FBI’s attribution adds an official US assessment to the investigation.

Industry Partners Help Locate and Freeze Assets

Binance has been working with cryptocurrency industry partners to identify and freeze some of the affected assets. The exchange said approximately $3 billion had been located as of Friday.

Locating stolen cryptocurrency does not necessarily mean that all of it can immediately be recovered. Digital assets can be transferred between wallets and converted into other cryptocurrencies, creating challenges for investigators and companies attempting to trace or restrict their movement.

The FBI’s observation that stolen assets were being converted into Ethereum highlights the importance of monitoring transactions across cryptocurrency networks. Binance’s recovery effort combines cooperation with industry participants and the use of its own financial resources to replace affected tokens.

Binance Uses SAFU Reserve and Corporate Treasury

Binance said the money used to repurchase tokens came from several sources, including its Secure Asset Fund for Users (SAFU), Futures Insurance Fund and corporate treasury.

SAFU is a reserve established by Binance to provide financial protection to customers in the event of security incidents. The fund was valued at approximately $1 billion and was held in bitcoin, according to the exchange.

Co-CEO Yi He said on Saturday that 50% of SAFU funds would be used as part of the response. Binance has committed to replenishing the reserve so that it returns to approximately $1 billion.

The use of these funds demonstrates the scale of the company’s financial response. By combining reserve assets and corporate resources, Binance is seeking to cover customer losses without placing the full burden of the incident on users.

Binance Describes Hack as a Complex Cyberattack

Binance co-CEO Richard Teng previously described the breach as a complex attack involving a compromised laptop and malicious software designed to erase evidence of its activity.

The removal of evidence can make it more difficult for security teams to establish how an intrusion occurred, identify the attackers’ methods and trace the movement of stolen assets. The incident therefore presents both a financial challenge and an investigation-related security concern for the exchange.

Following the attack, Binance temporarily stopped allowing customers to withdraw funds. The company said on Saturday that it remained on track to reopen withdrawals on Sunday. However, withdrawals were still unavailable as of 02:50 GMT on Sunday.

The temporary restriction came as the exchange sought to reassure customers that their funds remained protected despite the scale of the breach.

Binance Updates Proof of Reserves for Customer Assets

Alongside its efforts to cover the losses, Binance said it had taken a fresh snapshot of assets held on its platform as of 00:00 GMT on October 31. The update forms part of its proof-of-reserves process, which is intended to allow users to verify that their holdings are backed by assets held by the exchange.

Binance said customers holding 10 listed tokens would be able to verify backing at a minimum ratio of 1:1 once the complete proof was available.

The listed assets are:

• Bitcoin (BTC)
• Ethereum (ETH)
• Tether (USDT)
• BNB (BNB)
• Solana (SOL)
• USD Coin (USDC)
• XRP (XRP)
• USD1 (USD1)
• RLUSD (RLUSD)
• Zcash (ZEC)

A 1:1 reserve ratio means the exchange holds at least an equivalent amount of assets against the covered customer balances. The updated snapshot is intended to provide users with additional information about the backing of their holdings.

Crypto Market Faces Pressure After Binance Hack

Cryptocurrency prices fell on Friday as the market responded to the security incident and Binance worked to reassure customers. Large-scale hacks can affect confidence in digital asset platforms, particularly when they raise questions about the security of customer holdings and the ability of exchanges to manage operational risks.

Binance’s commitment to cover the reported losses and replenish its SAFU reserve is central to its effort to restore confidence. However, the remaining assets still need to be sourced, and the investigation into the attack and movement of stolen funds remains important.

What Happens Next for Binance?

Binance’s immediate priorities include completing the replacement of the remaining affected assets, continuing cooperation with industry partners and restoring normal withdrawal services. Replenishing SAFU to approximately $1 billion will also be an important part of its financial response.

The incident highlights the security challenges facing major cryptocurrency exchanges, particularly as attackers use sophisticated methods to compromise systems and move digital assets across blockchain networks. Even when an exchange has sufficient financial resources to cover losses, tracing stolen tokens and restoring customer confidence can take time.

Binance says it has already covered around $6 billion of the $6.3 billion affected amount. The remaining recovery effort, the status of customer withdrawals and the completion of its updated proof-of-reserves information will be key developments to watch as the exchange responds to one of the most significant security incidents in the cryptocurrency sector.