Binance replenishes 90% of $6.3 billion stolen crypto, says user funds fully backed

Binance, the world’s largest cryptocurrency exchange by trading volume, announced that it has restored 90% of the assets lost in last week’s $6.3 billion hack. The platform stated that top digital assets including bitcoin, ether, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are now fully backed for all users.

Restoration of Stolen Assets

The exchange reported that this restoration figure rose from the 80% documented in its previous update. Binance aims to resume user withdrawals on Sunday, November 1. The theft remains one of the largest in cryptocurrency history.

Binance detailed that the remaining 10% of lost assets involve lower-liquidity tokens, which are more difficult to replace in the required amounts. The company is sourcing these tokens through both public markets and over-the-counter (OTC) transactions, collaborating with industry partners to expedite the process.

Binance emphasized that it is absorbing the financial loss through its own corporate treasury, futures insurance reserves, and a portion of its Secure Asset Fund for Users (SAFU), ensuring that user balances remain unaffected.

Binance previously allocated more than $6.34 billion in company funds, with $5 billion held directly in the affected cryptocurrencies. Separate efforts by industry partners have managed to freeze about $3 billion of the stolen assets.

Role of SAFU and Insurance Funds

The Secure Asset Fund for Users, or SAFU, operates as Binance’s emergency reserve to protect users from extreme losses. Following the incident, Binance said it will utilize only the fund’s surplus above its mandated minimum. The remaining SAFU reportedly still satisfies all risk management protocols.

Binance committed to quickly restoring the SAFU reserve to approximately $1 billion, maintaining its position as a critical protection layer for customers.

Mini dictionary: SAFU (Secure Asset Fund for Users) is an emergency insurance fund set up by Binance in 2018 to compensate user losses in extreme cases, such as major security breaches or system failures. SAFU is funded with a portion of Binance’s trading fees.

Investigation and Attribution

Security investigations into the attack continue. Co-CEO Richard Teng said that additional breach points were discovered beyond the initially identified compromised employee device. United States President Donald Trump commented on the matter, stating, “We don’t know” if North Korea was behind the hack, but confirmed that authorities are actively investigating the incident.

Blockchain analytics firms TRM Labs and Chainalysis have linked the breach to a hacking group known as TraderTraitor, which has ties to North Korea.

Mini dictionary: TraderTraitor is a hacking group attributed to North Korea, reportedly involved in multiple cyberattacks targeting cryptocurrency exchanges and financial institutions around the world.

Proof-of-Reserves Update

Binance released a new snapshot of its proof-of-reserves, reflecting coverage ratios at 100% or higher for all major tokens as of midnight UTC on October 31. The full cryptographic proof, enabling users to independently verify that their assets are fully backed, is scheduled for release by November 3.

Binance said the security review and asset recovery efforts are ongoing, and the platform remains committed to maintaining full transparency with users.

The exchange reaffirmed, “Binance will absorb the financial impact of these stolen funds, not our users.”