Binance Covers 90% of $6.3 Billion Hack, Leans on Reserve Fund to Make Customers Whole

Binance says it has covered $6 billion of the $6.3 billion stolen from its platform, closing roughly 90% of the gap left by what US officials describe as the largest financial heist on record. The exchange, the world's biggest by trading volume, confirmed the figure on X Saturday, updating an earlier estimate that put recovery at the same percentage but in less precise terms.

The remaining shortfall, now under 10% of the total, consists of less liquid assets that Binance says will take longer to source in the required amounts. That detail matters. It suggests the easy money has already been spent, and what's left may require more time, more creativity, or more cost to replace.

The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit that blockchain analysis firm TRM had already flagged a day earlier as the likely culprit. Law enforcement says members of the group were observed converting stolen assets into ethereum, and the bureau expects "further laundering" using related technology. North Korea has long denied running state-linked units for espionage or financial theft. Its mission in Geneva and embassy in China did not respond to requests for comment.

Binance Co-CEO Richard Teng described the breach as a "complex attack" involving a compromised laptop and malware built to erase traces of its own activity, a design choice meant to slow investigators down. That level of operational sophistication aligns with years of warnings from Western security agencies about North Korean cyber units targeting crypto infrastructure for state revenue.

The Recovery Mechanics

Binance funded the replacement tokens using three pools of capital: half of its $1 billion Secure Asset Fund for Users, part of its Futures Insurance Fund, and corporate treasury reserves. Co-CEO Yi He confirmed the SAFU draw on Saturday and said the company is committing to rebuilding that fund back to roughly $1 billion. In total, Binance has earmarked about $6.34 billion internally to absorb the loss.

The company has also been working with industry partners to freeze stolen assets in transit. As of Friday, roughly $3 billion had been located and frozen, a meaningful recovery channel that runs parallel to the company's own capital outlay. Freezing stolen funds doesn't return them to users directly, but it limits what the attackers can actually spend, and it keeps pressure on exchanges and liquidity venues downstream to cooperate with law enforcement.

Withdrawals had been halted since the breach. Binance said Saturday it remained on track to reopen them Sunday, though as of 02:50 GMT Sunday, withdrawals were still closed. The exchange also took a fresh snapshot of platform assets at 0000 GMT October 31 as part of its proof-of-reserves process, covering ten listed tokens: BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC. Users will be able to verify their holdings are backed at a minimum 1:1 ratio once the full proof is published.

Crypto prices fell Friday as news of the hack spread, and Binance spent much of the weekend trying to reassure customers that funds remained safe. That's a predictable market reaction. Confidence in custodial security is the product exchanges sell, and a $6.3 billion breach, even one largely covered, tests that proposition directly.

The broader industry response has been swift. Other exchanges have publicly called for faster moves to shore up defenses in the wake of the Binance incident, recognizing that a successful attack of this scale against the sector's largest player raises uncomfortable questions for everyone else holding customer assets.

What stands out here is less the theft itself, crypto exchanges have been targets for years, and more the speed and scale of Binance's response. Covering 90% of a $6.3 billion loss within days, using a mix of insurance funds and corporate treasury, is a demonstration of balance sheet strength that smaller exchanges simply cannot replicate. That's the real competitive divide emerging from this episode: not security architecture, but capital depth.

It's also worth noting what Binance is not doing. It isn't passing losses to customers, and it isn't freezing withdrawals indefinitely while it sorts out liability. The company has repeatedly said it would bear the financial impact itself. That commitment, if it holds through the final 10%, will matter more to long-term trust than the technical post-mortem on how the breach occurred.

The Bottom Line

Binance's handling of this breach will likely become a reference case for how exchanges respond to large-scale theft, for better or worse. Covering the bulk of $6.3 billion in losses using existing reserves and treasury funds is a strong signal of financial resilience, and it stands in contrast to past industry failures where customer funds simply vanished.

But the story isn't finished. The remaining under-10% in less liquid assets still needs to be sourced, the SAFU fund needs rebuilding to its prior $1 billion level, and roughly $3 billion in frozen assets will need to work through recovery or forfeiture processes that could take months or years. North Korean state actors have shown persistence and sophistication in past attacks, and the FBI's warning of "further laundering" suggests this case isn't closed from a law enforcement standpoint either.

For investors and users, the near-term signal is reassuring: the exchange has the capital to absorb the hit without transferring losses downstream. The longer-term question is whether this incident accelerates regulatory pressure on custodial practices across the sector, and whether competitors without Binance's balance sheet could survive a comparable attack.