Binance says it has replaced 90% of funds lost in $6.3B hack

Binance says it has replaced 90% of the assets taken in a $6.3 billion security breach, a step toward covering customer losses as withdrawals remain suspended. The exchange’s October 31 recovery update says the remaining 10% involves less liquid tokens that may take longer to buy.

The incident began on October 29, when Binance’s hot wallets—online wallets used to move funds—were compromised. Binance said unauthorized withdrawals removed about $6.3 billion in token assets. The Associated Press reported that blockchain firms described the theft as the largest crypto hack on record, and that investigators linked it to a North Korean hacking unit.

How is Binance covering the stolen assets?

Binance says it is using company funds, part of its Secure Asset Fund for Users (SAFU), and a portion of its futures insurance fund to replace the assets. The exchange said the top ten affected tokens, including Bitcoin, Ether and USDT, were fully backed as of its latest update. It is still buying the remaining tokens through market and over-the-counter channels, which are direct trades between parties.

Binance said it would absorb the loss rather than pass it to users. It also said it plans to restore SAFU to about $1 billion after using part of the reserve. These are Binance’s statements; its full technical account of how the breach happened is still pending.

What happened to withdrawals and trading?

Binance paused withdrawals while it checks and repairs affected systems. Deposits and other unaffected platform services remained operational, according to its October 30 incident update. The available company updates do not say that trading was halted.

Binance said it had worked with blockchain partners to freeze about $3 billion of affected assets. It has not said that all frozen assets have been recovered. In its October 31 update, the company said it remained on track to reopen withdrawals on November 1, subject to confirmation.

What is known about the breach?

Binance’s initial investigation suggested that a compromised engineer’s laptop may have given an attacker access to a service container, which then enabled unauthorized withdrawal transactions. The company later said investigators had found additional points of breach, and reported no evidence that wallet private keys were leaked.

The AP reported that blockchain intelligence firm TRM attributed the attack to TraderTraitor, a North Korean hacking unit. Binance has said it is working with law enforcement and industry partners to identify those responsible and trace the funds. The investigation is ongoing.

Sources

• October 31 recovery update — binance.com