Binance Restores 90% of Assets After $6.3 Billion Hack, Withdrawals Set to Reopen

Binance announced that it has replenished 90% of the cryptocurrency stolen in the October 31 attack that drained wallets linked to a $6.3 billion hack, and the exchange remains on track to reopen withdrawals on Sunday, Nov. 1. The update raises the restoration figure from about 80% reported earlier and states that customer holdings of bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are now fully backed.

The remaining 10% consists of less liquid tokens that Binance said may take longer to acquire in the required quantities. Binance is purchasing those tokens through public markets and over-the-counter trades while collaborating with industry partners to complete the acquisitions. The exchange previously set aside more than $6.34 billion in company funds, including $5 billion held in the affected cryptocurrencies, separate from roughly $3 billion in stolen assets that partners had frozen.

Binance said it will absorb the financial impact of the stolen funds and not pass losses to users. The replacement assets are being funded through the corporate treasury and a portion of the futures insurance fund, with a partial deployment of the Secure Asset Fund for Users, or SAFU, expected within 24 hours. Binance indicated it moved only the portion of SAFU above its required size, and that the remaining fund still meets risk-management requirements, while committing to restore SAFU to about $1 billion.

The security investigation remains open after investigators discovered additional breach points beyond an initially suspected compromised employee laptop. U.S. President Donald Trump commented that “we don’t know” if North Korea was behind the breach and said the government is looking into that possibility. Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korea-linked hacking group.

Binance also published a new proof-of-reserves snapshot showing coverage ratios at 100% or more for the named tokens, taken at midnight UTC on Oct. 31. The full cryptographic proof, which would let users independently verify that their balances are included in Binance’s reported liabilities, is expected by Nov. 3.

Liberal News Analysis: What Does This Development Mean?

Binance’s reported replenishment to 90% and the backing of major tokens aim to restore immediate user confidence and enable the planned reopening of withdrawals. The use of corporate treasury funds, part of the futures insurance fund and a partial SAFU deployment demonstrates the exchange’s reliance on internal reserves to cover shortfalls without impacting customer balances. The ongoing security investigation and attribution by blockchain analytics firms underline persistent vulnerabilities and the complexity of tracing large-scale cryptocurrency thefts.

Quick Glance: What You Need to Know

• Binance reported replenishing 90% of the cryptocurrency stolen in the Oct. 31 hack and planned to reopen withdrawals on Nov. 1.
• Customer holdings of bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed according to Binance.
• The remaining 10% comprises less liquid tokens that Binance is purchasing via public markets and over-the-counter trades.
• Binance allocated more than $6.34 billion in company funds to cover the shortfall, separate from roughly $3 billion in stolen assets frozen by partners.
• Replacement assets are funded through the corporate treasury, part of the futures insurance fund, and a partial SAFU deployment, with a commitment to restore SAFU to about $1 billion.
• Investigators found additional breach points beyond an initially suspected compromised employee laptop, and attribution has been made to TraderTraitor by TRM Labs and Chainalysis.
• A proof-of-reserves snapshot taken at midnight UTC on Oct. 31 shows 100% or greater coverage for the named tokens, and a full cryptographic proof is expected by Nov. 3.