Binance announced it has replaced more than $6.34 billion in digital assets that were stolen during a major security breach on October 29, 2026. The world’s largest cryptocurrency exchange confirmed that user balances are now fully backed on a one-to-one basis, following what regulators and analysts have described as the largest single theft in the history of the crypto sector.
Compensation and Funding Sources
The exchange stated that funds used to cover the losses came from three sources: the Secure Asset Fund for Users (SAFU), Binance’s futures insurance fund, and its corporate treasury. Over the course of two weeks, Binance purchased tokens on the open market and completed several over-the-counter trades to replace lost cryptocurrency in user accounts.
Binance plans to restore its SAFU emergency fund to approximately $1 billion, reaffirming its commitment to user protection. SAFU, established in 2018, is an emergency insurance fund designed to protect Binance users from extreme situations involving security breaches or system flaws.
The company thanked users for their patience and emphasized ongoing upgrades to its security infrastructure while ensuring clients could access their accounts without disruption.
To the users and community, Binance expressed appreciation for patience and understanding during the replacement process and underlined continued enhancements to its platform security.
Details of the October Hack
TRM Labs, a blockchain analysis firm, reported that the hack targeted Binance wallets on ten different blockchains. The attackers were allegedly linked to TraderTraitor, a North Korean group previously associated with cyberattacks on other exchanges.
Within 20 minutes, the hackers drained an unprecedented volume of assets. Investigations also revealed that the incident initially stemmed from a compromised laptop belonging to a DevOps engineer, but further breach points have since been identified.
Nearly $3 billion in stolen digital assets were quickly frozen or intercepted in collaboration with US authorities. However, the attackers reportedly used thousands of crypto wallets and complex transaction paths to obscure the origin and destination of much of the remaining funds, including creating memecoins to help launder around $430,000.
Mini dictionary: TRM Labs is a blockchain intelligence and compliance firm that works with global law enforcement agencies and financial institutions to investigate and prevent digital asset crimes.
Proof-of-Reserves and Asset Holdings
Following the hack, Binance published a new audit snapshot covering 198 different tokens to assure the public of its solvency and user asset safety. The reserve ratios for all major coins, including Bitcoin, Ether, BNB, and Tether, remained at or above 100 percent.
This snapshot, released outside of Binance’s normal schedule, showed that user Bitcoin holdings increased by 0.35% to a total of approximately 687,900 BTC, marking an addition of 2,388 BTC. Ethereum balances rose by 1.04%, reaching 3.48 million ETH, and BNB holdings increased by 1.03% to 42.95 million tokens. The major exception was Tether (USDT), with user holdings down 3.68% to 24.3 billion tokens, a decrease of nearly 928 million USDT.
| Asset | Holdings Before | Holdings After | Change |
|---|---|---|---|
| Bitcoin (BTC) | Approx. 685,512 BTC | 687,900 BTC | +0.35% (+2,388 BTC) |
| Ethereum (ETH) | Approx. 3.44 million ETH | 3.48 million ETH | +1.04% |
| BNB | Approx. 42.51 million | 42.95 million | +1.03% |
| Tether (USDT) | Approx. 25.2 billion | 24.3 billion | -3.68% (-928 million) |
The snapshot also featured a range of smaller tokens such as Solana, USDC, Aave, Polkadot, Arbitrum, Hedera, and Bitcoin Cash. Once Binance completes the zero-knowledge proof generation process, users will be able to independently verify that every account is fully collateralized. The process is expected to take 40 to 50 hours.
The exchange stated that withdrawals will continue to be restored gradually as verification work proceeds to completion.
