Binance says it has replaced 90% of the $6.3 billion stolen in its hack, with withdrawals due Sunday

The skim

• Binance says it has replaced 90% of the roughly $6.3 billion in crypto stolen from its hot wallets on Thursday, buying new tokens with company money and emergency reserves.
• Bitcoin, ether, Tether's USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are now "fully backed 100%," the exchange says. The last 10% is less-liquid tokens that will take longer to buy.
• Withdrawals, paused since the hack, are on track to reopen Sunday, Nov. 1, subject to security checks. Replacing the money is not the same as getting it back from the attackers.

What happened

Two days after the largest crypto theft on record, Binance posted an update on Saturday saying it has covered up to 90% of the stolen assets. "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%," the exchange said, according to CNBC. "Binance will absorb the financial impact of these stolen funds, not our users."

The rest is made up of tokens outside that top 10, which Binance called "less liquid, which means they may take longer to source in the required amounts." It says it will keep buying them on the open market and through over-the-counter trades until every token is back to 100%. That's up from 80% a day earlier, Cointelegraph and CoinDesk report.

The money comes from three places: Binance's corporate treasury, part of its Futures insurance fund, and a partial draw on SAFU, its emergency fund for users. Binance says it set aside more than $6.34 billion of company funds to cover the losses, the BBC reports. CoinDesk says Binance has also committed to topping SAFU back up to about $1 billion.

Why it matters

When attackers drained Binance's hot wallets, the assets backing customer balances came up short. Refilling them is what lets Binance reopen withdrawals without a bank-run-style scramble, and it's the clearest sign yet that customers on Binance.com won't eat the loss. For scale, the previous record theft, about $1.5 billion from Bybit in 2025, was roughly a quarter of this one.

But the stolen crypto is still mostly gone. As CNBC notes, restoring backing for 90% "doesn't mean it has recovered 90% from the attacker." Binance said Friday it had worked with law enforcement and partners to freeze about $3 billion of the stolen assets, per the BBC, and the US Secret Service says it is "working around the clock" with private-sector partners to trace and recover funds. Blockchain analytics firms TRM Labs and Chainalysis have pinned the attack on North Korea's TraderTraitor group, also known as Lazarus. North Korea has always denied involvement in such attacks.

How the attackers got in is still unclear. Binance first pointed to a compromised DevOps engineer's laptop. Co-CEO Richard Teng later said the attack involved a more complex process than one engineer's permissions.

What's next

Binance's "next milestone" is reopening withdrawals. "We remain on track to reopen withdrawals within our previously stated timeframe (on Sunday, 2026-11-01)," the company posted on X, as quoted by The Verge. CoinDesk says Binance published a new proof-of-reserves snapshot showing at least 100% coverage for the named tokens, with a full cryptographic proof that lets users check their own balances expected by Nov. 3. That proof matters: security firm CertiK told Cointelegraph on Friday that it needed more information to verify Binance's claimed $5 billion in replacement crypto. If you hold funds on Binance, watch for that proof and expect heavy traffic when withdrawals open.

Sources: CNBC, BBC, CoinDesk, Cointelegraph and The Verge.